deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1098: Account Manipulation
Test: Azure - adding service principal to Azure role in subscription
Platforms: iaas:azure
Executor: powershell

Description:
The adversaries want to add service principal to some Azure role, also called Azure resource role. Threat actor 
may be interested primarily in highly privileged roles, e.g. Owner, Contributor.
By default, the role Reader is assigned to service principal in this test.

New-AzRoleAssignment cmdlet could be also use to assign user/service principal to resource, resource group and management group.

The account you use to run the PowerShell command must have Microsoft.Authorization/roleAssignments/write 
(e.g. such as User Access Administrator or Owner) and the Azure Active Directory Graph Directory.Read.All 
and Microsoft Graph Directory.Read.All permissions.

Detection hint - check Operation Name "Create role assignment" in subscriptions Activity Logs.


Command:
Import-Module -Name Az.Resources
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzAccount -Credential $Credential

$sp = Get-AzADServicePrincipal | where-object {$_.DisplayName -eq "#{service_principal_name}"}
if ($sp -eq $null) { Write-Warning "Service Principal not found"; exit }
$subscription = Get-AzSubscription | where-object {$_.Name -eq "#{subscription}"} 
if ($subscription -eq $null) { Write-Warning "Subscription not found"; exit }
$role = Get-AzRoleDefinition | where-object {$_.Name -eq "#{role_name}"}
if ($role -eq $null) { Write-Warning "Role not found"; exit }

New-AzRoleAssignment -ObjectId $sp.id -RoleDefinitionId $role.id -Scope 

Cleanup:
Import-Module -Name AzureAD -ErrorAction Ignore
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzAccount -Credential $Credential -ErrorAction Ignore

$s

Dependencies:
Az.Resources module must be installed.
Atomic Red Team — T1098: Account Manipulation
Test: Azure AD - adding permission to application
Platforms: azure-ad
Executor: powershell

Description:
The adversaries want to add permission to newly created application. Application could be then used for persistence or for further operation in the attacked infrastructure. Permissions like AppRoleAssignment.ReadWrite.All or RoleManagement.ReadWrite.Directory in particular can be a valuable target for a threat actor.
This technique will create a new app, with the provided name, and give it the provided permission. But if you prefer to add credentials to an existing app, replace in the code: "Get-AzureADApplication" instead of "New-AzureADServicePrincipal".
The DirectoryRecommendations.Read.All permissions has been selected as the default.

The account you use to run the PowerShell command should have Global Administrator/Application Administrator/Cloud Application Administrator role in your Azure AD.

Detection hint - check Operation Name "Add app role assignment to service principal" in subscriptions Activity Logs.
You can also take a look at the materials:
https://learnsentinel.blog/2022/01/04/azuread-privesc-sentinel/
https://github.com/reprise99/Sentinel-Queries
https://docs.google.com/presentation/d/1AWx1w0Xcq8ENvOmSjAJswEgEio-il09QWZlGg9PbHqE/edit#slide=id.g10460eb209c_0_2766
https://gist.github.com/andyrobbins/7c3dd62e6ed8678c97df9565ff3523fb


Command:
Import-Module -Name AzureAD
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential

$aadApplication = New-AzureADApplication -DisplayName "#{application_name}"
$servicePrincipal = New-AzureADServicePrincipal -AppId $aadApplication.AppId
#$aadApplication = Get-AzureADApplication -Filter "DisplayName eq '#{application_name}'"

#Get Service Principal of Microsoft Graph Resource API 
$graphSP = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Graph'"

#Initialize RequiredResourceAccess for Microsoft Graph Resource API 
$requiredGraphAccess = New-Object Microsoft.Open.AzureAD.Model.RequiredResourceAccess
$requir

Cleanup:
Import-Module -Name AzureAD
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential

$aadApplication = @(Get-AzureADApplication -

Dependencies:
AzureAD module must be installed.
Atomic Red Team — T1098: Account Manipulation
Test: Password Change on Directory Service Restore Mode (DSRM) Account
Platforms: windows
Executor: command_prompt

Description:
Change the password on the Directory Service Restore Mode (DSRM) account using ntdsutil by syncing to existing account


Command:
ntdsutil "set dsrm password" "sync from domain account #{sync_account}" "q" "q"
Atomic Red Team — T1098: Account Manipulation
Test: Domain Password Policy Check: Short Password
Platforms: windows
Executor: powershell

Description:
Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password.  You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was.


Command:
$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $new[CREDENTIAL_REDACTED]-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 

Dependencies:
Password for current user must be stored in a credential file
Atomic Red Team — T1098: Account Manipulation
Test: Domain Password Policy Check: No Number in Password
Platforms: windows
Executor: powershell

Description:
Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was. 


Command:
$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $new[CREDENTIAL_REDACTED]-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 

Dependencies:
Password for current user must be stored in a credential file
Atomic Red Team — T1098: Account Manipulation
Test: Domain Password Policy Check: No Special Character in Password
Platforms: windows
Executor: powershell

Description:
Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was. 


Command:
$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $new[CREDENTIAL_REDACTED]-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 

Dependencies:
Password for current user must be stored in a credential file
Atomic Red Team — T1098: Account Manipulation
Test: Domain Password Policy Check: No Uppercase Character in Password
Platforms: windows
Executor: powershell

Description:
Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was. 


Command:
$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $new[CREDENTIAL_REDACTED]-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 

Dependencies:
Password for current user must be stored in a credential file
Atomic Red Team — T1098: Account Manipulation
Test: Domain Password Policy Check: No Lowercase Character in Password
Platforms: windows
Executor: powershell

Description:
Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was. 


Command:
$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $new[CREDENTIAL_REDACTED]-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 

Dependencies:
Password for current user must be stored in a credential file
Atomic Red Team — T1098: Account Manipulation
Test: Domain Password Policy Check: Only Two Character Classes
Platforms: windows
Executor: powershell

Description:
Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was. 


Command:
$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $new[CREDENTIAL_REDACTED]-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 

Dependencies:
Password for current user must be stored in a credential file
Atomic Red Team — T1098: Account Manipulation
Test: Domain Password Policy Check: Common Password Use
Platforms: windows
Executor: powershell

Description:
Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was. 


Command:
$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $new[CREDENTIAL_REDACTED]-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 

Dependencies:
Password for current user must be stored in a credential file
Atomic Red Team — T1098: Account Manipulation
Test: GCP - Delete Service Account Key
Platforms: iaas:gcp
Executor: sh

Description:
This Atomic will: 
  - Create a service account
  - Create a service account key, 
  - Store the result of retrieving a single key for that service account as a variable
  - Pass that variable for deletion
  - Delete the service account

The idea for this Atomic came from a Rule published by the Elastic team.

Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP).
Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. 
If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly.

Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml


Command:
gcloud config set project #{project_id}
KEY=`gcloud iam service-accounts keys list --iam-account=#{service_name}@#{project_id}.iam.gserviceaccount.com --format="value(KEY_ID)" --limit=1`
gcloud iam service-accounts keys delete $KEY --iam-account=#{service_name}@#{project_id}.iam.gserviceaccount.com --quiet


Cleanup:
cd "$PathToAtomicsFolder/T1098/src/T1098-17/"
terraform state rm google_service_account_key.key
terraform destroy -auto-approve


Dependencies:
Requires gcloud

Check if user is logged in 

Check if terraform is installed.
Atomic Red Team — T1548.003: Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Test: Sudo usage
Platforms: macos, linux
Executor: sh

Description:
Common Sudo enumeration methods.


Command:
sudo -l      
sudo cat /etc/sudoers
sudo vim /etc/sudoers
Atomic Red Team — T1548.003: Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Test: Sudo usage (freebsd)
Platforms: linux
Executor: sh

Description:
Common Sudo enumeration methods.


Command:
sudo -l      
sudo cat /usr/local/etc/sudoers
sudo ee /usr/local/etc/sudoers


Dependencies:
Check if sudo is installed.
Atomic Red Team — T1548.003: Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Test: Unlimited sudo cache timeout
Platforms: macos, linux
Executor: sh

Description:
Sets sudo caching timestamp_timeout to a value for unlimited. This is dangerous to modify without using 'visudo', do not do this on a production system.


Command:
sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /etc/sudoers
sudo visudo -c -f /etc/sudoers
Atomic Red Team — T1548.003: Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Test: Unlimited sudo cache timeout (freebsd)
Platforms: linux
Executor: sh

Description:
Sets sudo caching timestamp_timeout to a value for unlimited. This is dangerous to modify without using 'visudo', do not do this on a production system.


Command:
sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /usr/local/etc/sudoers
sudo visudo -c -f /usr/local/etc/sudoers


Dependencies:
Check if sudo is installed.
Atomic Red Team — T1548.003: Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Test: Disable tty_tickets for sudo caching
Platforms: macos, linux
Executor: sh

Description:
Sets sudo caching tty_tickets value to disabled. This is dangerous to modify without using 'visudo', do not do this on a production system.


Command:
sudo sh -c "echo Defaults "'!'"tty_tickets >> /etc/sudoers"
sudo visudo -c -f /etc/sudoers
Atomic Red Team — T1548.003: Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Test: Disable tty_tickets for sudo caching (freebsd)
Platforms: linux
Executor: sh

Description:
Sets sudo caching tty_tickets value to disabled. This is dangerous to modify without using 'visudo', do not do this on a production system.


Command:
sudo sh -c "echo Defaults "'!'"tty_tickets >> /usr/local/etc/sudoers"
sudo visudo -c -f /usr/local/etc/sudoers


Dependencies:
Check if sudo is installed.
Atomic Red Team — T1531: Account Access Removal
Test: Change User Password - Windows
Platforms: windows
Executor: command_prompt

Description:
Changes the user password to hinder access attempts. Seen in use by LockerGoga. Upon execution, log into the user account "AtomicAdministrator" with
the password "HuHuHUHoHo283283".


Command:
net user #{user_account} #{new_user_password} /add
net.exe user #{user_account} #{new_password}


Cleanup:
net.exe user #{user_account} /delete >nul 2>&1
Atomic Red Team — T1531: Account Access Removal
Test: Delete User - Windows
Platforms: windows
Executor: command_prompt

Description:
Deletes a user account to prevent access. Upon execution, run the command "net user" to verify that the new "AtomicUser" account was deleted.


Command:
net user #{user_account} #{new_user_password} /add
net.exe user #{user_account} /delete
Atomic Red Team — T1531: Account Access Removal
Test: Remove Account From Domain Admin Group
Platforms: windows
Executor: powershell

Description:
This test will remove an account from the domain admins group


Command:
$PWord = ConvertTo-SecureString -String #{super_pass} -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList #{super_user}, $PWord
if((Get-ADUser #{remove_user} -Properties memberof).memberof -like "CN=Domain Admins*"){
  Remove-ADGroupMember -Identity "Domain Admins" -Members #{remove_user} -Credential $Credential -Confirm:$False
} else{
    write-host "Error - Make sure #{remove_user} is in the domain admins group" -foregroundcolor Red
}


Dependencies:
Requires the Active Directory module for powershell to be installed.
Atomic Red Team — T1531: Account Access Removal
Test: Change User Password via passwd
Platforms: macos, linux
Executor: sh

Description:
This test changes the user password to hinder access to the account using passwd utility.


Command:
passwd #{user_account} #enter admin password > enter new password > confirm new password
Atomic Red Team — T1531: Account Access Removal
Test: Delete User via dscl utility
Platforms: macos
Executor: sh

Description:
This test deletes the user account using the dscl utility.


Command:
dscl . -delete /Users/#{user_account} #enter admin password


Cleanup:
dscl . -create /Users/#{user_account} #enter admin password
dscl . -create /Users/#{user_account} UserShell /bin/bash
dscl . -create /Users/#{user_account} UniqueID 503
dscl . -create /Users/#{user_account} NFSHomeDirectory /Users/#{user_account}
dscl . -passwd /Users/#{user_account} #{user_password
Atomic Red Team — T1531: Account Access Removal
Test: Delete User via sysadminctl utility
Platforms: macos
Executor: sh

Description:
This test deletes the user account using the sysadminctl utility.


Command:
sysadminctl -deleteUser #{user_account} #enter admin password


Cleanup:
sysadminctl -addUser #{user_account} -fullName "#{user_name}" -password #{user_password}
Atomic Red Team — T1531: Account Access Removal
Test: Azure AD - Delete user via Azure AD PowerShell
Platforms: azure-ad
Executor: powershell

Description:
Deletes a user in Azure AD. Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (excluding changed credentials) to remove access to accounts.

Command:
Connect-AzureAD
$userprincipalname = "#{userprincipalname}"
Remove-AzureADUser -ObjectId $userprincipalname

Cleanup:
N/A

Dependencies:
Check if AzureAD PowerShell module is installed
Check if AzureAD PowerShell module is installed
Atomic Red Team — T1531: Account Access Removal
Test: Azure AD - Delete user via Azure CLI
Platforms: azure-ad
Executor: powershell

Description:
Deletes a user in Azure AD. Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (excluding changed credentials) to remove access to accounts.

Command:
az login
$userprincipalname = "#{userprincipalname}"
az ad user delete --id $userprincipalname

Cleanup:
N/A

Dependencies:
Check if Azure CLI is installed and install manually
Check if Azure CLI is installed and install via PowerShell
Update the userprincipalname to meet your requirements