T1083 yaml

2018-05-25 06:52:09 -04:00
parent 2a4247f64e
commit ac7da2beef
1 changed files with 23 additions and 0 deletions
@@ -0,0 +1,23 @@
+---
+attack_technique: T1083
+display_name: File and Directory Discovery
+
+atomic_tests:
+- name: File and Directory Discovery
+  description: |
+    Find or discovery files on the file system
+
+  supported_platforms:
+    - windows
+
+  executor:
+    name: command_prompt
+    command: |
+     dir /s c:\ >> %temp%\download
+     dir /s "c:\Documents and Settings" >> %temp%\download
+     dir /s "c:\Program Files\" >> %temp%\download
+     dir /s d:\ >> %temp%\download
+     dir "%systemdrive%\Users\*.*"
+     dir "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.*"
+     dir "%userprofile%\Desktop\*.*"
+     tree /F >> %temp%\download