attack_technique: T1562
display_name: 'Impair Defenses'
atomic_tests:
- name: Windows Disable LSA Protection
  auto_generated_guid: 40075d5f-3a70-4c66-9125-f72bee87247d
  description: |
    The following Atomic adds a registry entry to disable LSA Protection.

    The LSA controls and manages user rights information, password hashes and other important bits of information in memory. Attacker tools, such as mimikatz, rely on accessing this content to scrape password hashes or clear-text passwords. Enabling LSA Protection configures Windows to control the information stored in memory in a more secure fashion - specifically, to prevent non-protected processes from accessing that data.
    Upon successful execution, the registry will be modified and RunAsPPL will be set to 0, disabling Lsass protection.
    https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#how-to-disable-lsa-protection
    https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/
    https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/  
  supported_platforms:
  - windows
  executor:
    command: |
      reg add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f
    cleanup_command: |
      reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /f >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: Disable journal logging via systemctl utility
  auto_generated_guid: c3a377f9-1203-4454-aa35-9d391d34768f
  description: |
    The atomic test disables the journal logging using built-in systemctl utility
  supported_platforms:
  - linux
  executor:
    command: |
      sudo systemctl stop systemd-journald #disables journal logging
    cleanup_command: |
      sudo systemctl start systemd-journald #starts journal service
      sudo systemctl enable systemd-journald #starts journal service automatically at boot time
    name: sh
    elevation_required: true
- name: Disable journal logging via sed utility
  auto_generated_guid: 12e5551c-8d5c-408e-b3e4-63f53b03379f
  description: |
    The atomic test disables the journal logging by searching and replacing the "Storage" parameter to "none" within the journald.conf file, thus any new journal entries will only be temporarily available in memory and not written to disk
  supported_platforms:
  - linux
  executor:
    command: |
      sudo sed -i 's/Storage=auto/Storage=none/' /etc/systemd/journald.conf
    cleanup_command: |
      sudo sed -i 's/Storage=none/Storage=auto/' /etc/systemd/journald.conf #re-enables storage of journal data
      sudo systemctl restart systemd-journald #restart the journal service
    name: sh
    elevation_required: true