Ryuk (#1376)
* adjust for usability * change executor * add input arg Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>
This commit is contained in:
@@ -118,11 +118,21 @@ atomic_tests:
|
||||
del #{file_or_folder}\T1222.001_attrib*.txt
|
||||
rmdir #{file_or_folder}
|
||||
name: command_prompt
|
||||
- name: 'Grant Full Access to Entire C:\ Drive for Everyone - Ryuk Ransomware Style'
|
||||
- name: 'Grant Full Access to folder for Everyone - Ryuk Ransomware Style'
|
||||
auto_generated_guid: ac7e6118-473d-41ec-9ac0-ef4f1d1ed2f6
|
||||
description: Invokes the command line used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone.
|
||||
description: |
|
||||
Invokes the command line similar to that used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone.
|
||||
**icacls "C:\*" /grant Everyone:F /T /C /Q**
|
||||
However, for this atomic we set the permission on C:\Users\Public so it completes faster and doesn't irreversibly affect the host.
|
||||
You can set your own path variable to "C:\*" if you prefer.
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
path:
|
||||
description: Path of folder to recursively set permissions on
|
||||
type: path
|
||||
default: 'C:\Users\Public\*'
|
||||
executor:
|
||||
command: icacls "C:\*" /grant Everyone:F /T /C /Q
|
||||
name: powershell
|
||||
command: icacls "#{path}" /grant Everyone:F /T /C /Q
|
||||
name: command_prompt
|
||||
elevation_required: true
|
||||
Reference in New Issue
Block a user