diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv
index 794ac61e..caa5343c 100644
--- a/atomics/Indexes/Indexes-CSV/index.csv
+++ b/atomics/Indexes/Indexes-CSV/index.csv
@@ -734,6 +734,7 @@ discovery,T1087.001,Local Account,11,Enumerate logged on users via PowerShell,2b
discovery,T1069.001,Local Groups,1,Permission Groups Discovery (Local),952931a4-af0b-4335-bbbe-73c8c5b327ae,sh
discovery,T1069.001,Local Groups,2,Basic Permission Groups Discovery Windows (Local),1f454dd6-e134-44df-bebb-67de70fb6cd8,command_prompt
discovery,T1069.001,Local Groups,3,Permission Groups Discovery PowerShell (Local),a580462d-2c19-4bc7-8b9a-57a41b7d3ba4,powershell
+discovery,T1069.001,Local Groups,4,SharpHound3 - LocalAdmin,e03ada14-0980-4107-aff1-7783b2b59bb1,powershell
discovery,T1046,Network Service Scanning,1,Port Scan,68e907da-2539-48f6-9fc9-257a78c05540,sh
discovery,T1046,Network Service Scanning,2,Port Scan Nmap,515942b0-a09f-4163-a7bb-22fefb6f185f,sh
discovery,T1046,Network Service Scanning,3,Port Scan NMap for Windows,d696a3cb-d7a8-4976-8eb5-5af4abf2e3df,powershell
diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv
index ac3c38db..9fdcc430 100644
--- a/atomics/Indexes/Indexes-CSV/windows-index.csv
+++ b/atomics/Indexes/Indexes-CSV/windows-index.csv
@@ -489,6 +489,7 @@ discovery,T1087.001,Local Account,10,Enumerate logged on users via CMD (Local),a
discovery,T1087.001,Local Account,11,Enumerate logged on users via PowerShell,2bdc42c7-8907-40c2-9c2b-42919a00fe03,powershell
discovery,T1069.001,Local Groups,2,Basic Permission Groups Discovery Windows (Local),1f454dd6-e134-44df-bebb-67de70fb6cd8,command_prompt
discovery,T1069.001,Local Groups,3,Permission Groups Discovery PowerShell (Local),a580462d-2c19-4bc7-8b9a-57a41b7d3ba4,powershell
+discovery,T1069.001,Local Groups,4,SharpHound3 - LocalAdmin,e03ada14-0980-4107-aff1-7783b2b59bb1,powershell
discovery,T1046,Network Service Scanning,3,Port Scan NMap for Windows,d696a3cb-d7a8-4976-8eb5-5af4abf2e3df,powershell
discovery,T1046,Network Service Scanning,4,Port Scan using python,6ca45b04-9f15-4424-b9d3-84a217285a5c,powershell
discovery,T1135,Network Share Discovery,3,Network Share Discovery command prompt,20f1097d-81c1-405c-8380-32174d493bbb,command_prompt
diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md
index ffaeee97..81372c2b 100644
--- a/atomics/Indexes/Indexes-Markdown/index.md
+++ b/atomics/Indexes/Indexes-Markdown/index.md
@@ -1242,6 +1242,7 @@
- Atomic Test #1: Permission Groups Discovery (Local) [macos, linux]
- Atomic Test #2: Basic Permission Groups Discovery Windows (Local) [windows]
- Atomic Test #3: Permission Groups Discovery PowerShell (Local) [windows]
+ - Atomic Test #4: SharpHound3 - LocalAdmin [windows]
- [T1046 Network Service Scanning](../../T1046/T1046.md)
- Atomic Test #1: Port Scan [linux, macos]
- Atomic Test #2: Port Scan Nmap [linux, macos]
diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md
index 9198ccee..8aab3925 100644
--- a/atomics/Indexes/Indexes-Markdown/windows-index.md
+++ b/atomics/Indexes/Indexes-Markdown/windows-index.md
@@ -878,6 +878,7 @@
- [T1069.001 Local Groups](../../T1069.001/T1069.001.md)
- Atomic Test #2: Basic Permission Groups Discovery Windows (Local) [windows]
- Atomic Test #3: Permission Groups Discovery PowerShell (Local) [windows]
+ - Atomic Test #4: SharpHound3 - LocalAdmin [windows]
- [T1046 Network Service Scanning](../../T1046/T1046.md)
- Atomic Test #3: Port Scan NMap for Windows [windows]
- Atomic Test #4: Port Scan using python [windows]
diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
index 0ff6c9f3..a0775aeb 100644
--- a/atomics/Indexes/index.yaml
+++ b/atomics/Indexes/index.yaml
@@ -53181,6 +53181,49 @@ discovery:
get-localgroup
Get-LocalGroupMember -Name "Administrators"
name: powershell
+ - name: SharpHound3 - LocalAdmin
+ auto_generated_guid: e03ada14-0980-4107-aff1-7783b2b59bb1
+ description: 'This module runs the Windows executable of SharpHound in order
+ to remotely list members of the local Administrators group (SAMR)
+
+'
+ supported_platforms:
+ - windows
+ input_arguments:
+ domain:
+ description: FQDN of the targeted domain
+ type: string
+ default: DOMAIN.CORP
+ sharphound_path:
+ description: SharpHound Windows executable
+ type: path
+ default: "$env:TEMP\\SharpHound.exe"
+ output_path:
+ description: Output for SharpHound
+ type: path
+ default: "$env:TEMP\\SharpHound\\"
+ dependency_executor_name: powershell
+ dependencies:
+ - description: |
+ SharpHound binary must exist on disk and at specified location (#{sharphound_path}).
+ And the computer must be domain joined (implicit authentication).
+ prereq_command: 'if (Test-Path "#{sharphound_path}") { exit 0 } else { exit
+ 1 }
+
+'
+ get_prereq_command: 'Invoke-WebRequest "https://github.com/BloodHoundAD/BloodHound/blob/e062fe73d73c015dccb37fae5089342d009b84b8/Collectors/SharpHound.exe?raw=true"
+ -OutFile "#{sharphound_path}"
+
+'
+ executor:
+ name: powershell
+ elevation_required: false
+ command: |
+ New-Item -Path "#{output_path}" -ItemType Directory > $null
+ & "#{sharphound_path}" -d "#{domain}" --CollectionMethod LocalAdmin --NoSaveCache --OutputDirectory "#{output_path}"
+ cleanup_command: 'Remove-Item -Recurse #{output_path}
+
+'
T1046:
technique:
id: attack-pattern--e3a12395-188d-4051-9a16-ea8e14d07b88
diff --git a/atomics/T1069.001/T1069.001.md b/atomics/T1069.001/T1069.001.md
index 56654c95..612b6f81 100644
--- a/atomics/T1069.001/T1069.001.md
+++ b/atomics/T1069.001/T1069.001.md
@@ -12,6 +12,8 @@ Commands such as net localgroup of the [Net](https://attack.mitre.o
- [Atomic Test #3 - Permission Groups Discovery PowerShell (Local)](#atomic-test-3---permission-groups-discovery-powershell-local)
+- [Atomic Test #4 - SharpHound3 - LocalAdmin](#atomic-test-4---sharphound3---localadmin)
+
@@ -102,4 +104,57 @@ Get-LocalGroupMember -Name "Administrators"
+
+
+
+## Atomic Test #4 - SharpHound3 - LocalAdmin
+This module runs the Windows executable of SharpHound in order to remotely list members of the local Administrators group (SAMR)
+
+**Supported Platforms:** Windows
+
+
+**auto_generated_guid:** e03ada14-0980-4107-aff1-7783b2b59bb1
+
+
+
+
+
+#### Inputs:
+| Name | Description | Type | Default Value |
+|------|-------------|------|---------------|
+| domain | FQDN of the targeted domain | string | DOMAIN.CORP|
+| sharphound_path | SharpHound Windows executable | path | $env:TEMP\SharpHound.exe|
+| output_path | Output for SharpHound | path | $env:TEMP\SharpHound\|
+
+
+#### Attack Commands: Run with `powershell`!
+
+
+```powershell
+New-Item -Path "#{output_path}" -ItemType Directory > $null
+& "#{sharphound_path}" -d "#{domain}" --CollectionMethod LocalAdmin --NoSaveCache --OutputDirectory "#{output_path}"
+```
+
+#### Cleanup Commands:
+```powershell
+Remove-Item -Recurse #{output_path}
+```
+
+
+
+#### Dependencies: Run with `powershell`!
+##### Description: SharpHound binary must exist on disk and at specified location (#{sharphound_path}).
+And the computer must be domain joined (implicit authentication).
+##### Check Prereq Commands:
+```powershell
+if (Test-Path "#{sharphound_path}") { exit 0 } else { exit 1 }
+```
+##### Get Prereq Commands:
+```powershell
+Invoke-WebRequest "https://github.com/BloodHoundAD/BloodHound/blob/e062fe73d73c015dccb37fae5089342d009b84b8/Collectors/SharpHound.exe?raw=true" -OutFile "#{sharphound_path}"
+```
+
+
+
+