* adjust for usability

* change executor

* add input arg

Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>
This commit is contained in:
Carrie Roberts
2021-01-25 06:42:40 -07:00
committed by GitHub
parent 0b39063268
commit 3b9bddaf20
+14 -4
View File
@@ -118,11 +118,21 @@ atomic_tests:
del #{file_or_folder}\T1222.001_attrib*.txt
rmdir #{file_or_folder}
name: command_prompt
- name: 'Grant Full Access to Entire C:\ Drive for Everyone - Ryuk Ransomware Style'
- name: 'Grant Full Access to folder for Everyone - Ryuk Ransomware Style'
auto_generated_guid: ac7e6118-473d-41ec-9ac0-ef4f1d1ed2f6
description: Invokes the command line used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone.
description: |
Invokes the command line similar to that used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone.
**icacls "C:\*" /grant Everyone:F /T /C /Q**
However, for this atomic we set the permission on C:\Users\Public so it completes faster and doesn't irreversibly affect the host.
You can set your own path variable to "C:\*" if you prefer.
supported_platforms:
- windows
input_arguments:
path:
description: Path of folder to recursively set permissions on
type: path
default: 'C:\Users\Public\*'
executor:
command: icacls "C:\*" /grant Everyone:F /T /C /Q
name: powershell
command: icacls "#{path}" /grant Everyone:F /T /C /Q
name: command_prompt
elevation_required: true