diff --git a/atomics/T1222.001/T1222.001.yaml b/atomics/T1222.001/T1222.001.yaml index 75146a0e..4f03b7de 100644 --- a/atomics/T1222.001/T1222.001.yaml +++ b/atomics/T1222.001/T1222.001.yaml @@ -118,11 +118,21 @@ atomic_tests: del #{file_or_folder}\T1222.001_attrib*.txt rmdir #{file_or_folder} name: command_prompt -- name: 'Grant Full Access to Entire C:\ Drive for Everyone - Ryuk Ransomware Style' +- name: 'Grant Full Access to folder for Everyone - Ryuk Ransomware Style' auto_generated_guid: ac7e6118-473d-41ec-9ac0-ef4f1d1ed2f6 - description: Invokes the command line used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone. + description: | + Invokes the command line similar to that used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone. + **icacls "C:\*" /grant Everyone:F /T /C /Q** + However, for this atomic we set the permission on C:\Users\Public so it completes faster and doesn't irreversibly affect the host. + You can set your own path variable to "C:\*" if you prefer. supported_platforms: - windows + input_arguments: + path: + description: Path of folder to recursively set permissions on + type: path + default: 'C:\Users\Public\*' executor: - command: icacls "C:\*" /grant Everyone:F /T /C /Q - name: powershell + command: icacls "#{path}" /grant Everyone:F /T /C /Q + name: command_prompt + elevation_required: true \ No newline at end of file