Potential label issues and dual-use samples in powershell_benign_dataset

First, thank you for publishing MPSD. I reviewed a group of samples that repeatedly surfaced as high-confidence false positives.

I reviewed the 64 files below at commit 37cf29c461f5dfe0384e8e1256d15b8912e7405e.

Summary

• 47 files in powershell_benign_dataset contain direct offensive capabilities such as keylogging, credential theft, C2, exploitation, privilege escalation, process injection, lateral movement, or payload generation. I recommend moving or relabeling these as malicious/offensive.
• 15 files are dual-use security or administration utilities. I recommend documenting the dataset's policy for these and tagging them separately rather than treating them as confirmed malware or ordinary benign automation.
• Six filenames occur in both powershell_benign_dataset and malicious_pure, but the paired files are not byte-identical. These are filename collisions, not duplicate samples or direct cross-folder label conflicts.

High-confidence offensive/malicious-capability files (47)

1. 181.ps1 - functional keylogger using keyboard-state APIs and logging keystrokes to disk.
2. 3151.ps1 - obfuscated dnscat-style C2 with command execution and upload/download support.
3. 4226.ps1 - Cred-Popper fake Outlook/domain credential prompt.
4. 4227.ps1 - PsUACme UAC-bypass toolkit with embedded shellcode/DLL material.
5. 4229.ps1 - extracts stored Wi-Fi passwords with key=clear.
6. 4230.ps1 - finds and decrypts Group Policy cpassword values.
7. 4236.ps1 - DaisyChain HTTP relay/C2 with domain fronting and encoded scripts.
8. 4238.ps1 - enumerates service-permission weaknesses for privilege escalation.
9. 4239.ps1 - WMI remote execution and remote-host reconnaissance.
10. 4240.ps1 - EventVwr registry-hijack UAC bypass.
11. 4242.ps1 - converts DLLs to reflective-injection shellcode.
12. 4243.ps1 - background keylogger.
13. 4244.ps1 - dumps NTDS.dit through ntdsutil IFM.
14. 4245.ps1 - named-pipe payload proxy/relay.
15. 4248.ps1 - SMB client with NTLM-hash authentication and pass-the-hash capability.
16. 4249.ps1 - Powercat with command execution, relays, DNS mode, and payload generation.
17. 4250.ps1 - EternalBlue/MS17-010 exploit and payload delivery.
18. 4251.ps1 - service-abuse and privilege-escalation toolkit.
19. 4252.ps1 - local/remote shellcode injection with Metasploit payload support.
20. 4253.ps1 - token impersonation/duplication and process creation with stolen tokens.
21. 4255.ps1 - enables sensitive token privileges used for privilege escalation.
22. 4256.ps1 - SharpSocks HTTP proxy/C2 channel with domain fronting.
23. 4257.ps1 - WMI remote command execution across target ranges.
24. 4258.ps1 - remote PowerShell sessions through WinRM.
25. 4259.ps1 - WMI event-subscription persistence.
26. 4262.ps1 - pass-the-hash SMBExec/WMIExec remote command execution.
27. 4263.ps1 - PsExec-style SMB/NTLM remote execution.
28. 4264.ps1 - MS16-032 local privilege-escalation exploit.
29. 4265.ps1 - SMBExec pass-the-hash remote execution.
30. 4266.ps1 - NTLM relay/WPAD spoofing and credential interception.
31. 4267.ps1 - process injection through remote-thread/APC methods.
32. 4269.ps1 - NBNS/LLMNR/mDNS spoofing for credential harvesting.
33. 4270.ps1 - Active Directory password spraying.
34. 4271.ps1 - DCSync credential replication with injection support.
35. 4274.ps1 - multiple UAC-bypass and DLL-hijacking methods.
36. 4275.ps1 - named-pipe/token escalation to SYSTEM.
37. 4278.ps1 - MS16-032 local privilege-escalation exploit.
38. 4279.ps1 - Pipekat SMB relay/pass-the-hash and shellcode injection.
39. 4281.ps1 - WMIExec remote execution with NTLM-hash authentication.
40. 4282.ps1 - Inveigh NTLM capture/relay and name-resolution spoofing.
41. 4283.ps1 - retrieves Group Policy autologon credentials.
42. 4285.ps1 - PoshMSDaisy named-pipe C2 relay.
43. 4286.ps1 - PoshC2 server component.
44. 4287.ps1 - generates implants, encoded payloads, and delivery artifacts.
45. 4288.ps1 - PoshC2 implant handler and tasking interface.
46. 4289.ps1 - PoshC2 implant viewer/management component.
47. 4290.ps1 - downloads and installs PoshC2 and creates execution-policy-bypass shortcuts.

Dual-use files needing an explicit labeling policy (15)

1. 2708.ps1 - PE parser and process-memory inspection; no direct injection or execution in this file.
2. 2781.ps1 - Base64/GZip decoding and writing bytes to disk; payload-staging pattern without execution context.
3. 4228.ps1 - local-administrator enumeration across domain computers.
4. 4232.ps1 - SMB host scanner.
5. 4233.ps1 - ARP/NetBIOS scanner with embedded DLL.
6. 4234.ps1 - reports user idle time; can support anti-analysis but is not harmful in isolation.
7. 4235.ps1 - reverse DNS/IP-range reconnaissance.
8. 4237.ps1 - raw packet sniffer.
9. 4246.ps1 - full port scanner.
10. 4247.ps1 - searches files for payment-card patterns; possible DLP or data-discovery use.
11. 4261.ps1 - checks systems for known local privilege-escalation vulnerabilities.
12. 4268.ps1 - enumerates recently accessed shortcut targets.
13. 4273.ps1 - broad host/domain enumeration and reporting.
14. 4276.ps1 - reads LAPS-managed local administrator passwords from Active Directory.
15. 4277.ps1 - creates full process minidumps and could target LSASS, but accepts any process supplied by the caller.

Same-name collisions with malicious_pure

The following paths share filenames across the two folders, but their SHA-256 hashes and contents differ. The malicious_pure copies are short download/execute or in-memory shellcode-launcher samples and appear correctly malicious.

Suggested resolution

1. Move or relabel the 47 high-confidence offensive-capability files, or document that powershell_benign_dataset intentionally includes offensive tools.
2. Add an explicit dual_use or offensive_tool category for the 15 ambiguous security utilities.
3. Use full relative path and/or content hash as sample identity so same-name files across folders cannot be accidentally joined.