TALDCommands = {
    "TALDCommands": [
        r"mimikatz",
        r"secretsdump",
        r"lsass",
        r"kerberoast",
        r"crackmapexec",
        r"ntdsutil",
        r"hashdump",
        r"runas /user",
        r"sudo su",
        r"sudo -i",
        r"su -",
        r"passwd -d",
        r"chmod 777",
        r"kill -9",
        r"taskkill /IM",
        r"pkill",
        r"ps aux | grep",
        r"wmic process call create",
        r"tasklist",
        r"systemctl stop",
        r"systemctl disable",
        r"systemctl mask",
        r"sc config",
        r"sc stop",
        r"sc start",
        r"sc delete",
        r"shutdown -r",
        r"shutdown -h now",
        r"rm -rf",
        r"mv /etc/passwd",
        r"dd if=",
        r"chmod 777",
        r"chown root:root",
        r"touch /tmp",
        r"curl -fsSL",
        r"wget -qO-",
        r"echo .* > ~/.bashrc",
        r"echo .* > /etc/profile",
        r"echo .* > /etc/crontab",
        r"echo .* > /etc/rc.local",
        r"tar -xvf",
        r"zip -r",
        r"tar -czf",
        r"nmap -sS",
        r"nmap -A",
        r"nmap --script",
        r"nmap -sU",
        r"nmap -O",
        r"nmap -T4",
        r"tcpdump -i",
        r"wireshark -i",
        r"tshark -i",
        r"bettercap -T",
        r"arpspoof",
        r"dsniff",
        r"netdiscover",
        r"fping",
        r"ip a",
        r"netstat -anp",
        r"traceroute",
        r"scp",
        r"sftp",
        r"curl -T",
        r"wget -O",
        r"ftp",
        r"nc -e",
        r"python -m http.server",
        r"socat",
        r"rsync",
        r"ftpd",
        r"tftp",
        r"wget --mirror",
        r"wget --recursive",
        r"curl --recursive",
        r"curl -u",
        r"ipconfig",
        r"ifconfig",
        r"route -n",
        r"netstat -an",
        r"arp -a",
        r"cat /etc/passwd",
        r"cat /etc/shadow",
        r"find / -perm -4000",
        r"msfconsole",
        r"msfvenom",
        r"searchsploit",
        r"beef",
        r"metasploit",
        r"hydra",
        r"john",
        r"hashcat",
        r"dirbuster",
        r"nikto",
        r"wpscan",
        r"sqlmap",
        r"nc -lvp",
        r"echo .* > /etc/cron.d",
        r"echo .* > ~/.bashrc",
        r"echo .* > /etc/profile",
        r"perl -e .*",
        r"python -c .*",
        r"php -r .*",
        r"crontab -e",
        r"systemctl enable",
        r"systemctl start",
        r"rc.local",
        r"init.d",
        r"bash -i >& /dev/tcp/",
        r"echo * > /dev/null",
        r"wget http://",
        r"curl http://",
        r"certutil -urlcache",
        r"powershell IEX",
        r"Invoke-WebRequest",
        r"bitsadmin",
        r"regsvr32 /s",
        r"mshta",
        r"powershell -w hidden",
        r"cmd /c powershell",
        r"ssh -R",
        r"ssh -L",
        r"ssh -D",
        r"export HISTFILE=",
        r"unset HISTFILE",
        r"nohup",
        r"tmux",
        r"disown",
        r"systemctl enable",
        r"setenforce 0",
        r"setenforce 1",
        r"wget --mirror",
        r"dirb",
        r"gobuster",
        r"nikto",
        r"wafw00f",
        r"burpsuite",
        r"burp -i",
        r"gdb",
        r"objdump",
        r"strace",
        r"ltrace",
        r"readelf",
        r"pwndbg",
        r"ropper",
        r"pwntools",
        r"setoolkit",
        r"Social-Engineer Toolkit",
        r"chattr +i",
        r"echo 1 > /proc/sys/net/ipv4/ip_forward",
        r"sysctl -w",
        r"iptables -A",
        r"firewalld",
        r"ufw disable",
        r"ddos",
        r"LOLBAS tools",
        r"malfind",
        r"rkhunter",
        r"chkrootkit",
        r"ncat -l",
        r"metasploit-framework",
        r"hashcat -m 1000",
        r"wireshark -k",
        r"tcpdump -nn",
        r"inject /bin/bash",
        r"wget -qO /tmp/payload.sh",
        r"curl -o /tmp/payload.sh",
        r"wget --quiet",
        r"systemctl restart",
        r"mount --bind",
        r"mount -o loop",
        r"umount -l",
        r"fuser -k",
        r"strace -e trace=network",
        r"bpfcc-tools",
        r"curl -X POST",
        r"python3 -m http.server 8080",
        r"msfvenom -p windows/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -f exe -o payload.exe",
        r"traceroute -m 30",
        r"scp -r",
        r"ftp -n",
        r"telnet",
        r"ssh-keygen",
        r"ssh-copy-id",
        r"openssl",
        r"Burp Suite",
        r"Wireshark",
        r"Metasploit",
        r"Hydra",
        r"John the Ripper",
        r"Nmap",
        r"Nikto",
        r"SQLmap",
        r"Netcat",
        r"Aircrack-ng",
        r"Ettercap",
        r"Fping",
        r"Raccoon",
        r"Faraday",
        r"Social-Engineer Toolkit",
        r"OSFuzzer",
        r"Wifite",
        r"Dirbuster",
        r"Hashcat",
        r"ZAP Proxy",
        r"Cewl",
        r"Responder",
        r"Armitage",
        r"Nikto",
        r"Metasploit Community",
        r"Fuzzbunch",
        r"P0f",
        r"Empire",
        r"Maltego",
        r"Airgeddon",
        r"Nessus",
        r"OpenVAS",
        r"Cobalt Strike",
        r"Ratsniff",
        r"Suricata",
        r"Seclists",
        r"Xerosploit",
        r"Dsniff",
        r"Wifiphisher",
        r"Kismet",
    ]
}
