diff --git a/atomics/T1098/T1098.yaml b/atomics/T1098/T1098.yaml index a4f6598d..1a832c77 100644 --- a/atomics/T1098/T1098.yaml +++ b/atomics/T1098/T1098.yaml @@ -151,7 +151,7 @@ atomic_tests: type: string default: p4sswd user_principal_name: - description: Name of the targeted user (user principal) + description: Display Name, or User Principal Name, of the targeted user principal type: string default: SuperUser role_name: @@ -172,7 +172,7 @@ atomic_tests: $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword Connect-AzureAD -Credential $Credential - $user = Get-AzureADUser -Filter "DisplayName eq '#{user_principal_name}'" + $user = Get-AzureADUser -Filter "DisplayName eq '#{user_principal_name}' or UserPrincipalName eq '#{user_principal_name}'" if ($user -eq $null) { Write-Warning "User not found"; exit } $role = Get-AzureADDirectoryRole -Filter "DisplayName eq '#{role_name}'" if ($role -eq $null) { Write-Warning "Role not found"; exit } @@ -184,7 +184,7 @@ atomic_tests: $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword Connect-AzureAD -Credential $Credential -ErrorAction Ignore - $user = Get-AzureADUser -Filter "DisplayName eq '#{user_principal_name}'" + $user = Get-AzureADUser -Filter "DisplayName eq '#{user_principal_name}' or UserPrincipalName eq '#{user_principal_name}'" if ($user -eq $null) { Write-Warning "User not found"; exit } $role = Get-AzureADDirectoryRole -Filter "DisplayName eq '#{role_name}'" if ($role -eq $null) { Write-Warning "Role not found"; exit } @@ -286,7 +286,7 @@ atomic_tests: type: string default: p4sswd user_principal_name: - description: Name of the targeted user (user principal) + description: Display Name, or User Principal Name, of the targeted user principal type: string default: SuperUser role_name: @@ -311,7 +311,7 @@ atomic_tests: $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword Connect-AzAccount -Credential $Credential - $user = Get-AzADUser | where-object {$_.DisplayName -eq "#{user_principal_name}"} + $user = Get-AzADUser | where-object {$_.DisplayName -eq "#{user_principal_name}" -or $_.UserPrincipalName -eq "#{user_principal_name}" } if ($user -eq $null) { Write-Warning "User not found"; exit } $subscription = Get-AzSubscription | where-object {$_.Name -eq "#{subscription}"} if ($subscription -eq $null) { Write-Warning "Subscription not found"; exit } @@ -326,7 +326,7 @@ atomic_tests: $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword Connect-AzAccount -Credential $Credential -ErrorAction Ignore - $user = Get-AzADUser | where-object {$_.DisplayName -eq "#{user_principal_name}"} + $user = Get-AzADUser | where-object {$_.DisplayName -eq "#{user_principal_name}" -or $_.UserPrincipalName -eq "#{user_principal_name}" } if ($user -eq $null) { Write-Warning "User not found"; exit } $subscription = Get-AzSubscription | where-object {$_.Name -eq "#{subscription}"} if ($subscription -eq $null) { Write-Warning "Subscription not found"; exit }