diff --git a/atomics/T1086/T1086.md b/atomics/T1086/T1086.md index 2202125a..a6065c75 100644 --- a/atomics/T1086/T1086.md +++ b/atomics/T1086/T1086.md @@ -147,7 +147,7 @@ Using PS 5.1, add a user via CLI | password | password to use | string | ATOM1CR3DT3@M| | description | Brief description of account | string | Atomic Things| -#### Run it with `command_prompt`! +#### Run it with `powershell`! ``` New-LocalUser -FullName '#{full_name}' -Name '#{user_name}' -Password #{password} -Description '#{description}' ``` diff --git a/atomics/T1086/T1086.yaml b/atomics/T1086/T1086.yaml index 94d2dad9..c03f794e 100644 --- a/atomics/T1086/T1086.yaml +++ b/atomics/T1086/T1086.yaml @@ -112,7 +112,7 @@ atomic_tests: type: string default: Atomic Things executor: - name: command_prompt + name: powershell command: | New-LocalUser -FullName '#{full_name}' -Name '#{user_name}' -Password #{password} -Description '#{description}' @@ -199,4 +199,4 @@ atomic_tests: name: command_prompt command: | reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggJyVTeXN0ZW1Sb290JS9UZW1wL2FydC1tYXJrZXIudHh0JyAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI=" - powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART))) \ No newline at end of file + powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART))) diff --git a/atomics/index.yaml b/atomics/index.yaml index 775a55a2..6ee8fde6 100644 --- a/atomics/index.yaml +++ b/atomics/index.yaml @@ -13770,7 +13770,7 @@ execution: type: string default: Atomic Things executor: - name: command_prompt + name: powershell command: 'New-LocalUser -FullName ''#{full_name}'' -Name ''#{user_name}'' -Password #{password} -Description ''#{description}'' @@ -13848,7 +13848,7 @@ execution: - windows executor: name: command_prompt - command: |- + command: | reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggJyVTeXN0ZW1Sb290JS9UZW1wL2FydC1tYXJrZXIudHh0JyAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI=" powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART))) T1121: