attack_technique: T1531
display_name: Account Access Removal
atomic_tests:
- name: Change User Password - Windows
  auto_generated_guid: 1b99ef28-f83c-4ec5-8a08-1a56263a5bb2
  description: |
    Changes the user password to hinder access attempts. Seen in use by LockerGoga. Upon execution, log into the user account "AtomicAdministrator" with
    the password "HuHuHUHoHo283283".
  supported_platforms:
  - windows
  input_arguments:
    user_account:
      description: User account whose password will be changed.
      type: String
      default: AtomicAdministrator
    new_user_password:
      description: Password to use if user account must be created first
      type: String
      default: User2ChangePW!
    new_password:
      description: New password for the specified account.
      type: String
      default: HuHuHUHoHo283283@dJD
  executor:
    command: |
      net user #{user_account} #{new_user_password} /add
      net.exe user #{user_account} #{new_password}
    cleanup_command: |
      net.exe user #{user_account} /delete >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: Delete User - Windows
  auto_generated_guid: f21a1d7d-a62f-442a-8c3a-2440d43b19e5
  description: |
    Deletes a user account to prevent access. Upon execution, run the command "net user" to verify that the new "AtomicUser" account was deleted.
  supported_platforms:
  - windows
  input_arguments:
    new_user_password:
      description: Password to use if user account must be created first
      type: String
      default: User2DeletePW!
    user_account:
      description: User account to be deleted.
      type: String
      default: AtomicUser
  executor:
    command: |
      net user #{user_account} #{new_user_password} /add
      net.exe user #{user_account} /delete
    name: command_prompt
    elevation_required: true
- name: Remove Account From Domain Admin Group
  auto_generated_guid: 43f71395-6c37-498e-ab17-897d814a0947
  description: |
    This test will remove an account from the domain admins group
  supported_platforms:
  - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Requires the Active Directory module for powershell to be installed.
    prereq_command: |
      if(Get-Module -ListAvailable -Name ActiveDirectory) {exit 0} else {exit 1}
    get_prereq_command: |
      Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"
  input_arguments:
    super_user:
      description: Account used to run the execution command (must include domain).
      type: String
      default: 'domain\super_user'
    super_pass:
      description: super_user account password.
      type: String
      default: "password"
    remove_user:
      description: Account to remove from domain admins.
      type: String
      default: "remove_user"
  executor:
    command: |
      $PWord = ConvertTo-SecureString -String #{super_pass} -AsPlainText -Force
      $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList #{super_user}, $PWord
      if((Get-ADUser #{remove_user} -Properties memberof).memberof -like "CN=Domain Admins*"){
        Remove-ADGroupMember -Identity "Domain Admins" -Members #{remove_user} -Credential $Credential -Confirm:$False
      } else{
          write-host "Error - Make sure #{remove_user} is in the domain admins group" -foregroundcolor Red
      }
    name: powershell
    elevation_required: false
