diff --git a/atomics/T1016/T1016.yaml b/atomics/T1016/T1016.yaml index 43849b88..ac3a8998 100644 --- a/atomics/T1016/T1016.yaml +++ b/atomics/T1016/T1016.yaml @@ -122,4 +122,15 @@ atomic_tests: cleanup_command: | Remove-Item -ErrorAction ignore "#{output_file}" name: powershell +- name: Adfind - Enumerate Active Directory Subnet Objects + description: | + Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Subnet Objects + reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html + supported_platforms: + - windows + executor: + command: | + PathToAtomicsFolder\T1087.002\src\AdFind -f (objectcategory=subnet) + name: command_prompt + diff --git a/atomics/T1018/T1018.yaml b/atomics/T1018/T1018.yaml index ba82e142..36f443ea 100644 --- a/atomics/T1018/T1018.yaml +++ b/atomics/T1018/T1018.yaml @@ -178,4 +178,25 @@ atomic_tests: adidnsdump -u #{user_name} -p #{acct_pass} --print-zones #{host_name} name: command_prompt elevation_required: true +- name: Adfind - Enumerate Active Directory Computer Objects + description: | + Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects + reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html + supported_platforms: + - windows + executor: + command: | + PathToAtomicsFolder\T1087.002\src\AdFind -f (objectcategory=computer) + name: command_prompt +- name: Adfind - Enumerate Active Directory Domain Controller Objects + description: | + Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects + reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html + supported_platforms: + - windows + executor: + command: | + PathToAtomicsFolder\T1087.002\src\AdFind -sc dclist + name: command_prompt + diff --git a/atomics/T1069.002/T1069.002.yaml b/atomics/T1069.002/T1069.002.yaml index dd43b214..294a3cdc 100644 --- a/atomics/T1069.002/T1069.002.yaml +++ b/atomics/T1069.002/T1069.002.yaml @@ -103,3 +103,14 @@ atomic_tests: elevation_required: false command: | get-aduser -f * -pr DoesNotRequirePreAuth | where {$_.DoesNotRequirePreAuth -eq $TRUE} +- name: Adfind - Query Active Directory Groups + description: | + Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Groups + reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html + supported_platforms: + - windows + executor: + command: | + PathToAtomicsFolder\T1087.002\src\AdFind -f (objectcategory=group) + name: command_prompt + diff --git a/atomics/T1087.002/T1087.002.yaml b/atomics/T1087.002/T1087.002.yaml index 5f2ed858..49423c21 100644 --- a/atomics/T1087.002/T1087.002.yaml +++ b/atomics/T1087.002/T1087.002.yaml @@ -78,3 +78,34 @@ atomic_tests: command: | PathToAtomicsFolder\T1087.002\src\AdFind -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties name: powershell +- name: Adfind - Enumerate Active Directory Admins + description: | + Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Admin accounts + reference- http://www.joeware.net/freetools/tools/adfind/, https://stealthbits.com/blog/fun-with-active-directorys-admincount-attribute/ + supported_platforms: + - windows + executor: + command: | + PathToAtomicsFolder\T1087.002\src\AdFind -sc admincountdmp + name: command_prompt +- name: Adfind - Enumerate Active Directory User Objects + description: | + Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory User Objects + reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html + supported_platforms: + - windows + executor: + command: | + PathToAtomicsFolder\T1087.002\src\AdFind -f (objectcategory=person) + name: command_prompt +- name: Adfind - Enumerate Active Directory Exchange AD Objects + description: | + Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Exchange Objects + reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html + supported_platforms: + - windows + executor: + command: | + PathToAtomicsFolder\T1087.002\src\AdFind -sc exchaddresses + name: command_prompt + diff --git a/atomics/T1482/T1482.yaml b/atomics/T1482/T1482.yaml index 3a782468..10fb05f9 100644 --- a/atomics/T1482/T1482.yaml +++ b/atomics/T1482/T1482.yaml @@ -60,4 +60,25 @@ atomic_tests: Get-ADDomain Get-ADGroupMember Administrators -Recursive name: powershell +- name: Adfind - Enumerate Active Directory OUs + description: | + Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory OUs + reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html + supported_platforms: + - windows + executor: + command: | + PathToAtomicsFolder\T1087.002\src\AdFind -f (objectcategory=organizationalUnit) + name: command_prompt +- name: Adfind - Enumerate Active Directory Trusts + description: | + Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Trusts + reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html + supported_platforms: + - windows + executor: + command: | + PathToAtomicsFolder\T1087.002\src\AdFind -gcb -sc trustdmp + name: command_prompt +