diff --git a/atomics/T1482/T1482.md b/atomics/T1482/T1482.md index 95400bb9..6dd099c9 100644 --- a/atomics/T1482/T1482.md +++ b/atomics/T1482/T1482.md @@ -8,6 +8,8 @@ - [Atomic Test #2 - Windows - Discover domain trusts with nltest](#atomic-test-2---windows---discover-domain-trusts-with-nltest) +- [Atomic Test #3 - Powershell enumerate domains and forests](#atomic-test-3---powershell-enumerate-domains-and-forests) +
@@ -43,4 +45,23 @@ nltest /domain_trusts +
+
+ +## Atomic Test #3 - Powershell enumerate domains and forests +Use powershell to enumerate AD information + +**Supported Platforms:** Windows + + +#### Run it with `powershell`! +``` +Get-NetDomainTrust +Get-NetForestTrust +Get-ADDomain +Get-ADGroupMember Administrators -Recursive +``` + + +
diff --git a/atomics/index.md b/atomics/index.md index 31f88412..7aac073b 100644 --- a/atomics/index.md +++ b/atomics/index.md @@ -542,6 +542,7 @@ - [T1482 Domain Trust Discovery](./T1482/T1482.md) - Atomic Test #1: Windows - Discover domain trusts with dsquery [windows] - Atomic Test #2: Windows - Discover domain trusts with nltest [windows] + - Atomic Test #3: Powershell enumerate domains and forests [windows] - [T1083 File and Directory Discovery](./T1083/T1083.md) - Atomic Test #1: File and Directory Discovery [windows] - Atomic Test #2: File and Directory Discovery [windows] diff --git a/atomics/index.yaml b/atomics/index.yaml index f64ebd7e..fafb2bdd 100644 --- a/atomics/index.yaml +++ b/atomics/index.yaml @@ -15899,6 +15899,20 @@ discovery: command: 'nltest /domain_trusts ' + - name: Powershell enumerate domains and forests + description: 'Use powershell to enumerate AD information + +' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: | + Get-NetDomainTrust + Get-NetForestTrust + Get-ADDomain + Get-ADGroupMember Administrators -Recursive T1083: technique: x_mitre_permissions_required: diff --git a/atomics/windows-index.md b/atomics/windows-index.md index 772bf8de..cd84e413 100644 --- a/atomics/windows-index.md +++ b/atomics/windows-index.md @@ -384,6 +384,7 @@ - [T1482 Domain Trust Discovery](./T1482/T1482.md) - Atomic Test #1: Windows - Discover domain trusts with dsquery [windows] - Atomic Test #2: Windows - Discover domain trusts with nltest [windows] + - Atomic Test #3: Powershell enumerate domains and forests [windows] - [T1083 File and Directory Discovery](./T1083/T1083.md) - Atomic Test #1: File and Directory Discovery [windows] - Atomic Test #2: File and Directory Discovery [windows]