diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index 27aa2e7e..1d66b27a 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -114,6 +114,7 @@ persistence,T1136.001,Local Account,2,Create a user account on a MacOS system,01 persistence,T1136.001,Local Account,3,Create a new user in a command prompt,6657864e-0323-4206-9344-ac9cd7265a4f,command_prompt persistence,T1136.001,Local Account,4,Create a new user in PowerShell,bc8be0ac-475c-4fbf-9b1d-9fffd77afbde,powershell persistence,T1136.001,Local Account,5,Create a new user in Linux with `root` UID and GID.,a1040a30-d28b-4eda-bd99-bb2861a4616c,bash +persistence,T1136.001,Local Account,6,Create a new Windows admin user,fda74566-a604-4581-a4cc-fbbe21d66559,command_prompt persistence,T1037.002,Logon Script (Mac),1,Logon Scripts - Mac,f047c7de-a2d9-406e-a62b-12a09d9516f4,manual persistence,T1037.001,Logon Script (Windows),1,Logon Scripts,d6042746-07d4-4c92-9ad8-e644c114a231,command_prompt persistence,T1546.007,Netsh Helper DLL,1,Netsh Helper DLL Registration,3244697d-5a3a-4dfc-941c-550f69f91a4d,command_prompt diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv index 94a65cf9..7656d38c 100644 --- a/atomics/Indexes/Indexes-CSV/windows-index.csv +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -211,6 +211,7 @@ persistence,T1546.012,Image File Execution Options Injection,1,IFEO Add Debugger persistence,T1546.012,Image File Execution Options Injection,2,IFEO Global Flags,46b1f278-c8ee-4aa5-acce-65e77b11f3c1,command_prompt persistence,T1136.001,Local Account,3,Create a new user in a command prompt,6657864e-0323-4206-9344-ac9cd7265a4f,command_prompt persistence,T1136.001,Local Account,4,Create a new user in PowerShell,bc8be0ac-475c-4fbf-9b1d-9fffd77afbde,powershell +persistence,T1136.001,Local Account,6,Create a new Windows admin user,fda74566-a604-4581-a4cc-fbbe21d66559,command_prompt persistence,T1037.001,Logon Script (Windows),1,Logon Scripts,d6042746-07d4-4c92-9ad8-e644c114a231,command_prompt persistence,T1546.007,Netsh Helper DLL,1,Netsh Helper DLL Registration,3244697d-5a3a-4dfc-941c-550f69f91a4d,command_prompt persistence,T1574.009,Path Interception by Unquoted Path,1,Execution of program.exe as service with unquoted service path,2770dea7-c50f-457b-84c4-c40a47460d9f,command_prompt diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index ecf68be6..a700eb14 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -253,6 +253,7 @@ - Atomic Test #3: Create a new user in a command prompt [windows] - Atomic Test #4: Create a new user in PowerShell [windows] - Atomic Test #5: Create a new user in Linux with `root` UID and GID. [linux] + - Atomic Test #6: Create a new Windows admin user [windows] - T1078.003 Local Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - [T1037.002 Logon Script (Mac)](../../T1037.002/T1037.002.md) - Atomic Test #1: Logon Scripts - Mac [macos] diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md index b1169884..a48f1cc0 100644 --- a/atomics/Indexes/Indexes-Markdown/windows-index.md +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -416,6 +416,7 @@ - [T1136.001 Local Account](../../T1136.001/T1136.001.md) - Atomic Test #3: Create a new user in a command prompt [windows] - Atomic Test #4: Create a new user in PowerShell [windows] + - Atomic Test #6: Create a new Windows admin user [windows] - T1078.003 Local Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - [T1037.001 Logon Script (Windows)](../../T1037.001/T1037.001.md) - Atomic Test #1: Logon Scripts [windows] diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 9f15c0d1..614cd113 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -11955,15 +11955,39 @@ persistence: type: String default: BetterWithButter executor: - command: "useradd -g 0 -M -d /root -s /bin/bash #{username}\nif [ $(cat /etc/os-release - | grep -i 'Name=\"ubuntu\"') ]; then echo \"#{username}:#{password}\" | - sudo chpasswd; else echo \"#{password}\" | passwd --stdin #{username}; fi; - \ \n" + command: | + useradd -g 0 -M -d /root -s /bin/bash #{username} + if [ $(cat /etc/os-release | grep -i 'Name="ubuntu"') ]; then echo "#{username}:#{password}" | sudo chpasswd; else echo "#{password}" | passwd --stdin #{username}; fi; cleanup_command: 'userdel #{username} ' name: bash elevation_required: true + - name: Create a new Windows admin user + auto_generated_guid: fda74566-a604-4581-a4cc-fbbe21d66559 + description: 'Creates a new admin user in a command prompt. + +' + supported_platforms: + - windows + input_arguments: + username: + description: Username of the user to create + type: String + default: T1136.001_Admin + password: + description: Password of the user to create + type: String + default: T1136_pass + executor: + command: | + net user /add "#{username}" "#{password}" + net localgroup administrators "#{username}" /add + cleanup_command: 'net user /del "#{username}" >nul 2>&1 + +' + name: command_prompt + elevation_required: true T1078.003: technique: external_references: diff --git a/atomics/T1136.001/T1136.001.md b/atomics/T1136.001/T1136.001.md index 653f79ec..38303054 100644 --- a/atomics/T1136.001/T1136.001.md +++ b/atomics/T1136.001/T1136.001.md @@ -16,6 +16,8 @@ Such accounts may be used to establish secondary credentialed access that do not - [Atomic Test #5 - Create a new user in Linux with `root` UID and GID.](#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid) +- [Atomic Test #6 - Create a new Windows admin user](#atomic-test-6---create-a-new-windows-admin-user) +
@@ -192,4 +194,39 @@ userdel #{username} +
+
+ +## Atomic Test #6 - Create a new Windows admin user +Creates a new admin user in a command prompt. + +**Supported Platforms:** Windows + + + + +#### Inputs: +| Name | Description | Type | Default Value | +|------|-------------|------|---------------| +| username | Username of the user to create | String | T1136.001_Admin| +| password | Password of the user to create | String | T1136_pass| + + +#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin) + + +```cmd +net user /add "#{username}" "#{password}" +net localgroup administrators "#{username}" /add +``` + +#### Cleanup Commands: +```cmd +net user /del "#{username}" >nul 2>&1 +``` + + + + +
diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index d1b106a9..b5a40d48 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -553,3 +553,4 @@ a90c2f4d-6726-444e-99d2-a00cd7c20480 d696a3cb-d7a8-4976-8eb5-5af4abf2e3df efe86d95-44c4-4509-ae42-7bfd9d1f5b3d 7382a43e-f19c-46be-8f09-5c63af7d3e2b +fda74566-a604-4581-a4cc-fbbe21d66559