Offensive tooling download (mimikatz)

offensive_tool_download

Downloads mimikatz and two PowerSploit scripts to a temporary file to see whether the proxy, DNS filter or on-access scanner intervenes. The files are never executed and are deleted immediately.

Severity high how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

--i-understand
Needs explicit consent: this test changes machine state or fetches real offensive tooling.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1105	Ingress Tool Transfer	Command and Control	coverage statistics
T1588.002	Obtain Capabilities: Tool	Resource Development	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other malware samples tests

Other tests in the Malware samples category.
Test	What it does	Severity
Live malware sample download and unpack malware_bazaar_live_sample	Downloads real malware samples from MalwareBazaar as password-protected ZIP archives and unpacks them into the sandbox, to see whether the download or…	critical
MalwareBazaar metadata query malware_bazaar_hash_query	Queries abuse.ch's MalwareBazaar API for recently submitted samples and records the hashes and family labels it returns. Metadata only: no sample is r…	low

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.