security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1675 from glallen/T1069.001

Browse Source 
T1069.001 - update existing test with: id, getent, cat group
This commit is contained in:
Carl
2021-12-07 10:01:07 -07:00
committed by GitHub
parent 37ea965727 35d7f4739e
commit c0a387fb65
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1069.001/T1069.001.yaml
+4 -1
View File
@@ -13,6 +13,9 @@ atomic_tests:
if [ -x "$(command -v dscacheutil)" ]; then dscacheutil -q group; else echo "dscacheutil is missing from the machine. skipping..."; fi;
if [ -x "$(command -v dscl)" ]; then dscl . -list /Groups; else echo "dscl is missing from the machine. skipping..."; fi;
if [ -x "$(command -v groups)" ]; then groups; else echo "groups is missing from the machine. skipping..."; fi;
if [ -x "$(command -v id)" ]; then id; else echo "id is missing from the machine. skipping..."; fi;
if [ -x "$(command -v getent)" ]; then getent group; else echo "getent is missing from the machine. skipping..."; fi;
cat /etc/group
name: sh
- name: Basic Permission Groups Discovery Windows (Local)
auto_generated_guid: 1f454dd6-e134-44df-bebb-67de70fb6cd8
@@ -95,4 +98,4 @@ atomic_tests:
executor:
command: |
Get-WMIObject Win32_Group
name: powershell
name: powershell