From 9ece49e65e4fb785887ad56a314f2d276bc9e9bf Mon Sep 17 00:00:00 2001
From: JimmyAstle <JimmyAstle@users.noreply.github.com>
Date: Thu, 12 Nov 2020 13:36:12 -0500
Subject: [PATCH] New test for domain admin account (#1286)

Quick test for default domain administrator account enumeration

Co-authored-by: Jimmy Astle <jastle@vmware.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
---
 atomics/T1087.002/T1087.002.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/atomics/T1087.002/T1087.002.yaml b/atomics/T1087.002/T1087.002.yaml
index d0c2e578..fbcff925 100644
--- a/atomics/T1087.002/T1087.002.yaml
+++ b/atomics/T1087.002/T1087.002.yaml
@@ -163,4 +163,12 @@ atomic_tests:
     command: |
       #{adfind_path} -sc exchaddresses
     name: command_prompt
-
+- name: Enumerate Default Domain Admin Details (Domain)
+  description: |
+    This test will enumerate the details of the built-in domain admin account
+  supported_platforms:
+  - windows
+  executor:
+    command: |
+      net user administrator /domain
+    name: command_prompt