diff --git a/atomics/T1028/T1028.md b/atomics/T1028/T1028.md index 93be88be..566ebb96 100644 --- a/atomics/T1028/T1028.md +++ b/atomics/T1028/T1028.md @@ -24,6 +24,8 @@ Remote Support: Yes - [Atomic Test #4 - Psexec](#atomic-test-4---psexec) +- [Atomic Test #5 - Invoke-Command](#atomic-test-5---invoke-command) +
@@ -100,3 +102,22 @@ Utilize psexec to start remote process psexec \\host -u domain\user -p password -s cmd.exe ```
+
+ +## Atomic Test #5 - Invoke-Command +Execute Invoke-command on remote host + +**Supported Platforms:** Windows + + +#### Inputs +| Name | Description | Type | Default Value | +|------|-------------|------|---------------| +| host_name | Remote Windows Host Name | String | Test| +| remote_command | Command to execute on remote Host | String | ipconfig| + +#### Run it with `powershell`! +``` +invoke-command -computername #{host_name} -scriptblock {#{remote_command}} +``` +
diff --git a/atomics/index.md b/atomics/index.md index 0b86ffed..9d1693af 100644 --- a/atomics/index.md +++ b/atomics/index.md @@ -460,6 +460,7 @@ - Atomic Test #2: PowerShell Lateral Movement [windows] - Atomic Test #3: WMIC Process Call Create [windows] - Atomic Test #4: Psexec [windows] + - Atomic Test #5: Invoke-Command [windows] # lateral-movement - [T1155 AppleScript](./T1155/T1155.md) @@ -491,6 +492,7 @@ - Atomic Test #2: PowerShell Lateral Movement [windows] - Atomic Test #3: WMIC Process Call Create [windows] - Atomic Test #4: Psexec [windows] + - Atomic Test #5: Invoke-Command [windows] # collection - [T1123 Audio Capture](./T1123/T1123.md) diff --git a/atomics/windows-index.md b/atomics/windows-index.md index 8da80c60..28bdc779 100644 --- a/atomics/windows-index.md +++ b/atomics/windows-index.md @@ -294,6 +294,7 @@ - Atomic Test #2: PowerShell Lateral Movement [windows] - Atomic Test #3: WMIC Process Call Create [windows] - Atomic Test #4: Psexec [windows] + - Atomic Test #5: Invoke-Command [windows] # collection - [T1123 Audio Capture](./T1123/T1123.md) @@ -385,6 +386,7 @@ - Atomic Test #2: PowerShell Lateral Movement [windows] - Atomic Test #3: WMIC Process Call Create [windows] - Atomic Test #4: Psexec [windows] + - Atomic Test #5: Invoke-Command [windows] # command-and-control - T1043 Commonly Used Port [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)