diff --git a/atomics/T1518/T1518.md b/atomics/T1518/T1518.md index 1b4f1e39..f9b8c519 100644 --- a/atomics/T1518/T1518.md +++ b/atomics/T1518/T1518.md @@ -4,6 +4,7 @@ ## Atomic Tests + - [Atomic Test #1 - Find and Display Internet Explorer Browser Version](#atomic-test-1---find-and-display-internet-explorer-browser-version) - [Atomic Test #2 - Applications Installed](#atomic-test-2---applications-installed) @@ -17,13 +18,28 @@ Adversaries may attempt to get a listing of non-security related software that i **Supported Platforms:** Windows -#### Run it with `command_prompt`! +#### Run it with `command_prompt`! ``` reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer" /v svcVersion ``` +
+ +## Atomic Test #2 - Applications Installed +Adversaries may attempt to get a listing of non-security related software that is installed on the system. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors. This test queries two registry keys in Windows known to have installation information for programs. + +References: +https://blogs.technet.microsoft.com/heyscriptingguy/2011/11/13/use-powershell-toquickly-find-installed-software +https://blogs.technet.microsoft.com/heyscriptingguy/2013/11/15/use-powershell-to-find-installed-software + +**Supported Platforms:** Windows +#### Run it with `command_prompt`! +``` +POWERSHELL.EXE "Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize" +powershell.exe "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize" +```

diff --git a/execution-frameworks/Invoke-AtomicRedTeam/README.md b/execution-frameworks/Invoke-AtomicRedTeam/README.md index 730ecfa0..49b4a02f 100644 --- a/execution-frameworks/Invoke-AtomicRedTeam/README.md +++ b/execution-frameworks/Invoke-AtomicRedTeam/README.md @@ -4,7 +4,7 @@ ### Install Atomic Red Team -* Be sure to get permission and necessary approval before conducting test's. Unauthorized testing is a bad decision +* Be sure to get permission and necessary approval before conducting tests. Unauthorized testing is a bad decision and can potentially be a resume-generating event. * Set up a test machine that would be similar to the build in your environment. Be sure you have your collection/EDR @@ -41,7 +41,7 @@ DownloadPath Force - Force the new installation removing any previous installations in -InstallPath. **BE CAREFUL this will delete the entire install path folder** - + `Install-AtomicRedTeam -Force` ### Manual