security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

New test, spelling fix (#717)

Browse Source 
Added a test for all software installed and minor spelling fix
This commit is contained in:
Micheal Fleck
2019-12-10 10:22:30 -08:00
committed by Carrie Roberts
parent fbda422009
commit 3293e54771
2 changed files with 35 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1518/T1518.md
+21 -6
View File
@@ -4,22 +4,37 @@
## Atomic Tests
- [Atomic Test #1 - Find and Display Iinternet Explorer Browser Version](#atomic-test-1---find-and-display-iinternet-explorer-browser-version)
- [Atomic Test #1 - Find and Display Iinternet Explorer Browser Version](#atomic-test-1---find-and-display-internet-explorer-browser-version)
- [Atomic Test #2 - Find and Display Currently Installed Software](#atomic-test-2---applications-installed)
<br/>
## Atomic Test #1 - Find and Display Iinternet Explorer Browser Version
## Atomic Test #1 - Find and Display Internet Explorer Browser Version
Adversaries may attempt to get a listing of non-security related software that is installed on the system. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors
**Supported Platforms:** Windows
#### Run it with `command_prompt`!
#### Run it with `command_prompt`!
```
reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer" /v svcVersion
```
<br/>
## Atomic Test #2 - Applications Installed
Adversaries may attempt to get a listing of non-security related software that is installed on the system. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors. This test queries two registry keys in Windows known to have installation information for programs.
References:
https://blogs.technet.microsoft.com/heyscriptingguy/2011/11/13/use-powershell-toquickly-find-installed-software
https://blogs.technet.microsoft.com/heyscriptingguy/2013/11/15/use-powershell-to-find-installed-software
**Supported Platforms:** Windows
#### Run it with `command_prompt`!
```
POWERSHELL.EXE "Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize"
powershell.exe "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize"
```
<br/>
atomics/T1518/T1518.yaml
+14 -1
View File
@@ -3,7 +3,7 @@ attack_technique: T1518
display_name: Software Discovery
atomic_tests:
- name: Find and Display Iinternet Explorer Browser Version
- name: Find and Display Internet Explorer Browser Version
description: |
Adversaries may attempt to get a listing of non-security related software that is installed on the system. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors
@@ -16,3 +16,16 @@ atomic_tests:
command: | # these are the actaul attack commands, at least one command must be provided
reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer" /v svcVersion
- name: Applications Installed
description: |
Adversaries may attempt to get a listing of all software that is installed on the system. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false # indicates whether command must be run with admin privileges. If the elevation_required attribute is not defined, the value is assumed to be false
command: | # these are the actual attack commands, at least one command must be provided
POWERSHELL.EXE "Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize"
powershell.exe "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize"