diff --git a/atomics/T1090/T1090.md b/atomics/T1090/T1090.md
index b4b40823..1c537928 100644
--- a/atomics/T1090/T1090.md
+++ b/atomics/T1090/T1090.md
@@ -10,6 +10,8 @@ Internal connection proxies can be used to consolidate internal connections from
- [Atomic Test #1 - Connection Proxy](#atomic-test-1---connection-proxy)
+- [Atomic Test #2 - portproxy reg key](#atomic-test-2---portproxy-reg-key)
+
@@ -40,3 +42,31 @@ unset https_proxy
```
+
+
+## Atomic Test #2 - portproxy reg key
+Adds a registry key to set up a proxy on the endpoint at
+HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
+
+**Supported Platforms:** Windows
+
+
+#### Inputs
+| Name | Description | Type | Default Value |
+|------|-------------|------|---------------|
+| listenport | Specifies the IPv4 port, by port number or service name, on which to listen. | string | 1337|
+| connectport | Specifies the IPv4 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer. | string | 1337|
+| connectaddress | Specifies the IPv4 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer. | string | 127.0.0.1|
+
+#### Run it with `powershell`! Elevation Required (e.g. root or admin)
+```
+netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport} connectaddress=#{connectaddress}
+```
+
+
+#### Cleanup Commands:
+```
+netsh interface portproxy delete v4tov4 listenport=#{listenport}
+```
+
+
diff --git a/atomics/index.md b/atomics/index.md
index b52d9db4..23f6940c 100644
--- a/atomics/index.md
+++ b/atomics/index.md
@@ -183,6 +183,7 @@
- Atomic Test #1: Component Object Model Hijacking [windows]
- [T1090 Connection Proxy](./T1090/T1090.md)
- Atomic Test #1: Connection Proxy [macos, linux]
+ - Atomic Test #2: portproxy reg key [windows]
- [T1196 Control Panel Items](./T1196/T1196.md)
- Atomic Test #1: Control Panel Items [windows]
- [T1207 DCShadow](./T1207/T1207.md)
@@ -869,6 +870,7 @@
- T1092 Communication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1090 Connection Proxy](./T1090/T1090.md)
- Atomic Test #1: Connection Proxy [macos, linux]
+ - Atomic Test #2: portproxy reg key [windows]
- T1094 Custom Command and Control Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1024 Custom Cryptographic Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1132 Data Encoding](./T1132/T1132.md)
diff --git a/atomics/index.yaml b/atomics/index.yaml
index 12a61aa4..4db6990c 100644
--- a/atomics/index.yaml
+++ b/atomics/index.yaml
@@ -5923,9 +5923,39 @@ defense-evasion:
command: 'export #{proxy_scheme}_proxy=#{proxy_server}
'
- cleanup_command: |-
+ cleanup_command: |
unset http_proxy
unset https_proxy
+ - name: portproxy reg key
+ description: |
+ Adds a registry key to set up a proxy on the endpoint at
+ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
+ supported_platforms:
+ - windows
+ input_arguments:
+ listenport:
+ description: Specifies the IPv4 port, by port number or service name, on
+ which to listen.
+ type: string
+ default: 1337
+ connectport:
+ description: Specifies the IPv4 port, by port number or service name, to
+ which to connect. If connectport is not specified, the default is the
+ value of listenport on the local computer.
+ type: string
+ default: 1337
+ connectaddress:
+ description: Specifies the IPv4 address to which to connect. Acceptable
+ values are IP address, computer NetBIOS name, or computer DNS name. If
+ an address is not specified, the default is the local computer.
+ type: string
+ default: 127.0.0.1
+ executor:
+ name: powershell
+ elevation_required: true
+ command: netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport}
+ connectaddress=#{connectaddress}
+ cleanup_command: netsh interface portproxy delete v4tov4 listenport=#{listenport}
T1196:
technique:
x_mitre_permissions_required:
@@ -24113,9 +24143,39 @@ command-and-control:
command: 'export #{proxy_scheme}_proxy=#{proxy_server}
'
- cleanup_command: |-
+ cleanup_command: |
unset http_proxy
unset https_proxy
+ - name: portproxy reg key
+ description: |
+ Adds a registry key to set up a proxy on the endpoint at
+ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
+ supported_platforms:
+ - windows
+ input_arguments:
+ listenport:
+ description: Specifies the IPv4 port, by port number or service name, on
+ which to listen.
+ type: string
+ default: 1337
+ connectport:
+ description: Specifies the IPv4 port, by port number or service name, to
+ which to connect. If connectport is not specified, the default is the
+ value of listenport on the local computer.
+ type: string
+ default: 1337
+ connectaddress:
+ description: Specifies the IPv4 address to which to connect. Acceptable
+ values are IP address, computer NetBIOS name, or computer DNS name. If
+ an address is not specified, the default is the local computer.
+ type: string
+ default: 127.0.0.1
+ executor:
+ name: powershell
+ elevation_required: true
+ command: netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport}
+ connectaddress=#{connectaddress}
+ cleanup_command: netsh interface portproxy delete v4tov4 listenport=#{listenport}
T1132:
technique:
x_mitre_data_sources:
diff --git a/atomics/windows-index.md b/atomics/windows-index.md
index af933d3c..e8321834 100644
--- a/atomics/windows-index.md
+++ b/atomics/windows-index.md
@@ -24,6 +24,7 @@
- [T1122 Component Object Model Hijacking](./T1122/T1122.md)
- Atomic Test #1: Component Object Model Hijacking [windows]
- [T1090 Connection Proxy](./T1090/T1090.md)
+ - Atomic Test #2: portproxy reg key [windows]
- [T1196 Control Panel Items](./T1196/T1196.md)
- Atomic Test #1: Control Panel Items [windows]
- [T1207 DCShadow](./T1207/T1207.md)
@@ -620,6 +621,7 @@
- T1043 Commonly Used Port [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1092 Communication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1090 Connection Proxy](./T1090/T1090.md)
+ - Atomic Test #2: portproxy reg key [windows]
- T1094 Custom Command and Control Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1024 Custom Cryptographic Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1132 Data Encoding](./T1132/T1132.md)