attack_technique: T1018
display_name: Remote System Discovery
atomic_tests:
- name: Remote System Discovery - net
  auto_generated_guid: 85321a9c-897f-4a60-9f20-29788e50bccd
  description: |
    Identify remote systems with net.exe.

    Upon successful execution, cmd.exe will execute `net.exe view` and display results of local systems on the network that have file and print sharing enabled.
  supported_platforms:
  - windows
  executor:
    command: |
      net view /domain
      net view
    name: command_prompt
- name: Remote System Discovery - net group Domain Computers
  auto_generated_guid: f1bf6c8f-9016-4edf-aff9-80b65f5d711f
  description: |
    Identify remote systems with net.exe querying the Active Directory Domain Computers group.

    Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Computers" group. Output will be via stdout.
  supported_platforms:
  - windows
  executor:
    command: |
      net group "Domain Computers" /domain
    name: command_prompt
- name: Remote System Discovery - nltest
  auto_generated_guid: 52ab5108-3f6f-42fb-8ba3-73bc054f22c8
  description: |
    Identify domain controllers for specified domain.

    Upon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout.
  supported_platforms:
  - windows
  input_arguments:
    target_domain:
      description: Domain to query for domain controllers
      type: String
      default: '%userdnsdomain%'
  executor:
    command: |
      nltest.exe /dclist:#{target_domain}
    name: command_prompt
- name: Remote System Discovery - ping sweep
  auto_generated_guid: 6db1f57f-d1d5-4223-8a66-55c9c65a9592
  description: |
    Identify remote systems via ping sweep.

    Upon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout.
  supported_platforms:
  - windows
  executor:
    command: |
      for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i
    name: command_prompt
- name: Remote System Discovery - arp
  auto_generated_guid: 2d5a61f5-0447-4be4-944a-1f8530ed6574
  description: |
    Identify remote systems via arp. 

    Upon successful execution, cmd.exe will execute arp to list out the arp cache. Output will be via stdout.
  supported_platforms:
  - windows
  executor:
    command: |
      arp -a
    name: command_prompt
- name: Remote System Discovery - arp nix
  auto_generated_guid: acb6b1ff-e2ad-4d64-806c-6c35fe73b951
  description: |
    Identify remote systems via arp.

    Upon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout.
  supported_platforms:
  - linux
  - macos
  dependency_executor_name: sh
  dependencies:
  - description: |
      Check if arp command exists on the machine
    prereq_command: |
      if [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi;
    get_prereq_command: |
      (which yum && yum -y install net-tools)||(which apt-get && apt-get install -y net-tools)
  executor:
    command: |
      arp -a | grep -v '^?'
    name: sh
- name: Remote System Discovery - sweep
  auto_generated_guid: 96db2632-8417-4dbb-b8bb-a8b92ba391de
  description: |
    Identify remote systems via ping sweep.

    Upon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active.
  supported_platforms:
  - linux
  - macos
  input_arguments:
    start_host:
      description: Subnet used for ping sweep.
      type: String
      default: "1"
    stop_host:
      description: Subnet used for ping sweep.
      type: String
      default: "254"
    subnet:
      description: Subnet used for ping sweep.
      type: String
      default: 192.168.1
  executor:
    command: |
      for ip in $(seq #{start_host} #{stop_host}); do ping -c 1 #{subnet}.$ip; [ $? -eq 0 ] && echo "#{subnet}.$ip UP" || : ; done
    name: sh
- name: Remote System Discovery - nslookup
  auto_generated_guid: baa01aaa-5e13-45ec-8a0d-e46c93c9760f
  description: |
    Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig.

    Upon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout.
  supported_platforms:
  - windows
  executor:
    command: |
      $localip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1]
      $pieces = $localip.split(".")
      $firstOctet = $pieces[0]
      $secondOctet = $pieces[1]
      $thirdOctet = $pieces[2]
      foreach ($ip in 1..255 | % { "$firstOctet.$secondOctet.$thirdOctet.$_" } ) {cmd.exe /c nslookup $ip}
    name: powershell
    elevation_required: true
- name: Remote System Discovery - adidnsdump
  auto_generated_guid: 95e19466-469e-4316-86d2-1dc401b5a959
  description: |
    This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks
    Python 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test.
    Successful execution of this test will list dns zones in the terminal.
  supported_platforms:
  - windows
  input_arguments:
    user_name:
      description: username including domain.
      type: String
      default: 'domain\user'
    acct_pass:
      description: Account password.
      type: String
      default: "password"
    host_name:
      description: hostname or ip address to connect to.
      type: String
      default: "192.168.1.1"
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Computer must have python 3 installed
    prereq_command: |
      if (python --version) {exit 0} else {exit 1}
    get_prereq_command: |
      echo "Python 3 must be installed manually"
  - description: |
      Computer must have pip installed
    prereq_command: |
      if (pip3 -V) {exit 0} else {exit 1}
    get_prereq_command: |
      echo "PIP must be installed manually"
  - description: |
      adidnsdump must be installed and part of PATH
    prereq_command: |
      if (cmd /c adidnsdump -h) {exit 0} else {exit 1}
    get_prereq_command: |
      pip3 install adidnsdump
  executor:
    command: |
      adidnsdump -u #{user_name} -p #{acct_pass} --print-zones #{host_name}
    name: command_prompt
    elevation_required: true
- name: Adfind - Enumerate Active Directory Computer Objects
  auto_generated_guid: a889f5be-2d54-4050-bd05-884578748bb4
  description: | 
    Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects
    reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
  supported_platforms:
  - windows
  input_arguments:
    adfind_path:
      description: Path to the AdFind executable
      type: Path
      default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AdFind.exe must exist on disk at specified location (#{adfind_path})
    prereq_command: |
      if (Test-Path #{adfind_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
  executor:
    command: |
      #{adfind_path} -f (objectcategory=computer)
    name: command_prompt
- name: Adfind - Enumerate Active Directory Domain Controller Objects
  auto_generated_guid: 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e
  description: | 
    Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects
    reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
  supported_platforms:
  - windows
  input_arguments:
    adfind_path:
      description: Path to the AdFind executable
      type: Path
      default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AdFind.exe must exist on disk at specified location (#{adfind_path})
    prereq_command: |
      if (Test-Path #{adfind_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
  executor:
    command: |
      #{adfind_path} -sc dclist
    name: command_prompt

- name: Remote System Discovery - ip neighbour
  auto_generated_guid: 158bd4dd-6359-40ab-b13c-285b9ef6fa25
  description: |
    Use the ip neighbour command to display the known link layer (ARP table) addresses for hosts sharing the same network segment. 
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies:
  - description: |
      Check if ip command exists on the machine
    prereq_command: |
      if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;
    get_prereq_command: |
      apt-get install iproute2 -y
  executor:
    command: |
      ip neighbour show
    name: sh

- name: Remote System Discovery - ip route
  auto_generated_guid: 1a4ebe70-31d0-417b-ade2-ef4cb3e7d0e1
  description: |
    Use the ip route command to display the kernels routing tables. 
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies:
  - description: |
      Check if ip command exists on the machine
    prereq_command: |
      if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;
    get_prereq_command: |
      apt-get install iproute2 -y
  executor:
    command: |
      ip route show
    name: sh

- name: Remote System Discovery - ip tcp_metrics
  auto_generated_guid: 6c2da894-0b57-43cb-87af-46ea3b501388
  description: |
    Use the ip tcp_metrics command to display the recent cached entries for IPv4 and IPv6 source and destination addresses. 
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies:
  - description: |
      Check if ip command exists on the machine
    prereq_command: |
      if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;
    get_prereq_command: |
      apt-get install iproute2 -y
  executor:
    command: |
      ip tcp_metrics show |grep --invert-match "^127\."
    name: sh

