attack_technique: T1087.002
display_name: 'Account Discovery: Domain Account'
atomic_tests:
- name: Enumerate all accounts (Domain)
  auto_generated_guid: 6fbc9e68-5ad7-444a-bd11-8bf3136c477e
  description: |
    Enumerate all accounts
    Upon exection, multiple enumeration commands will be run and their output displayed in the PowerShell session
  supported_platforms:
  - windows
  executor:
    command: |
      net user /domain
      net group /domain
    name: command_prompt
- name: Enumerate all accounts via PowerShell (Domain)
  auto_generated_guid: 8b8a6449-be98-4f42-afd2-dedddc7453b2
  description: |
    Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      net user /domain
      get-localgroupmember -group Users
      get-aduser -filter *
    name: powershell
- name: Enumerate logged on users via CMD (Domain)
  auto_generated_guid: 161dcd85-d014-4f5e-900c-d3eaae82a0f7
  description: |
    Enumerate logged on users. Upon exeuction, logged on users will be displayed.
  supported_platforms:
  - windows
  input_arguments:
    computer_name:
      description: Name of remote system to query
      type: String
      default: $env:COMPUTERNAME
  executor:
    command: |
      query user /SERVER:#{computer_name}
    name: command_prompt
- name: Automated AD Recon (ADRecon)
  auto_generated_guid: 95018438-454a-468c-a0fa-59c800149b59
  description: |
    ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its
    path will be displayed.
  supported_platforms:
  - windows
  input_arguments:
    adrecon_path:
      description: Path of ADRecon.ps1 file
      type: Path
      default: $env:TEMP\ADRecon.ps1
  dependency_executor_name: powershell
  dependencies:
  - description: |
      ADRecon must exist on disk at specified location (#{adrecon_path})
    prereq_command: |
      if (Test-Path #{adrecon_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest -Uri "https://raw.githubusercontent.com/sense-of-security/ADRecon/38e4abae3e26d0fa87281c1d0c65cabd4d3c6ebd/ADRecon.ps1" -OutFile #{adrecon_path}
  executor:
    command: |
      Invoke-Expression #{adrecon_path}
    cleanup_command: |
      Remove-Item #{adrecon_path} -Force -ErrorAction Ignore | Out-Null
      Get-ChildItem $env:TEMP -Recurse -Force | Where{$_.Name -Match "^ADRecon-Report-"} | Remove-Item -Force -Recurse
    name: powershell
- name: Adfind -Listing password policy
  auto_generated_guid: 736b4f53-f400-4c22-855d-1a6b5a551600
  description: |
    Adfind tool can be used for reconnaissance in an Active directory environment. The example chosen illustrates adfind used to query the local password policy.
    reference- http://www.joeware.net/freetools/tools/adfind/, https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
  supported_platforms:
  - windows
  input_arguments:
    adfind_path:
      description: Path to the AdFind executable
      type: Path
      default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AdFind.exe must exist on disk at specified location (#{adfind_path})
    prereq_command: |
      if (Test-Path #{adfind_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
  executor:
    command: |
      #{adfind_path} -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties
    name: command_prompt
- name: Adfind - Enumerate Active Directory Admins
  auto_generated_guid: b95fd967-4e62-4109-b48d-265edfd28c3a
  description: |
    Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Admin accounts
    reference- http://www.joeware.net/freetools/tools/adfind/, https://stealthbits.com/blog/fun-with-active-directorys-admincount-attribute/
  supported_platforms:
  - windows
  input_arguments:
    adfind_path:
      description: Path to the AdFind executable
      type: Path
      default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AdFind.exe must exist on disk at specified location (#{adfind_path})
    prereq_command: |
      if (Test-Path #{adfind_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
  executor:
    command: |
      #{adfind_path} -sc admincountdmp
    name: command_prompt
- name: Adfind - Enumerate Active Directory User Objects
  auto_generated_guid: e1ec8d20-509a-4b9a-b820-06c9b2da8eb7
  description: |
    Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory User Objects
    reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
  supported_platforms:
  - windows
  input_arguments:
    adfind_path:
      description: Path to the AdFind executable
      type: Path
      default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AdFind.exe must exist on disk at specified location (#{adfind_path})
    prereq_command: |
      if (Test-Path #{adfind_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
  executor:
    command: |
      #{adfind_path} -f (objectcategory=person)
    name: command_prompt
- name: Adfind - Enumerate Active Directory Exchange AD Objects
  auto_generated_guid: 5e2938fb-f919-47b6-8b29-2f6a1f718e99
  description: |
    Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Exchange Objects
    reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
  supported_platforms:
  - windows
  input_arguments:
    adfind_path:
      description: Path to the AdFind executable
      type: Path
      default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AdFind.exe must exist on disk at specified location (#{adfind_path})
    prereq_command: |
      if (Test-Path #{adfind_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
  executor:
    command: |
      #{adfind_path} -sc exchaddresses
    name: command_prompt
- name: Enumerate Default Domain Admin Details (Domain)
  auto_generated_guid: c70ab9fd-19e2-4e02-a83c-9cfa8eaa8fef
  description: |
    This test will enumerate the details of the built-in domain admin account
  supported_platforms:
  - windows
  executor:
    command: |
      net user administrator /domain
    name: command_prompt

- name: Enumerate Active Directory for Unconstrained Delegation
  auto_generated_guid: 46f8dbe9-22a5-4770-8513-66119c5be63b
  description: |
    Attackers may attempt to query for computer objects with the UserAccountControl property
    'TRUSTED_FOR_DELEGATION' (0x80000;524288) set
    More Information - https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html#when-the-stars-align-unconstrained-delegation-leads-to-rce
    Prerequisite: AD RSAT PowerShell module is needed and it must run under a domain user
  supported_platforms:
  - windows
  input_arguments:
    domain:
      description: Domain FQDN
      type: String
      default: $env:UserDnsDomain
    uac_prop:
      description: UAC Property to search
      type: String
      default: 524288
  dependencies:
  - description: |
      PowerShell ActiveDirectory Module must be installed
    prereq_command: |
      Try {
          Import-Module ActiveDirectory -ErrorAction Stop | Out-Null
          exit 0
      }
      Catch {
          exit 1
      }
    get_prereq_command: |
      if((Get-CimInstance -ClassName Win32_OperatingSystem).ProductType -eq 1) {
        Add-WindowsCapability -Name (Get-WindowsCapability -Name RSAT.ActiveDirectory.DS* -Online).Name -Online
      } else {
        Install-WindowsFeature RSAT-AD-PowerShell
      }
  executor:
    name: powershell
    elevation_required: false
    command: |
      Get-ADObject -LDAPFilter '(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})' -Server #{domain}
