devasmith4
61 lines
3.1 KiB
YAML
61 lines
3.1 KiB
YAML
attack_technique: T1505.005
|
|
display_name: 'Server Software Component: Terminal Services DLL'
|
|
atomic_tests:
|
|
- name: Simulate Patching termsrv.dll
|
|
auto_generated_guid: 0b2eadeb-4a64-4449-9d43-3d999f4a317b
|
|
description: |
|
|
Simulates patching of termsrv.dll by making a benign change to the file and replacing it with the original afterwards.
|
|
Before we can make the modifications we need to take ownership of the file and grant ourselves the necessary permissions.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
elevation_required: true
|
|
command: |
|
|
$termsrvDll = "C:\Windows\System32\termsrv.dll"
|
|
|
|
$ACL = Get-Acl $termsrvDll
|
|
$permission = "Administrators","FullControl","Allow"
|
|
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
|
|
$ACL.SetAccessRule($accessRule)
|
|
Set-Acl -Path $termsrvDll -AclObject $ACL
|
|
|
|
Copy-Item -Path "C:\Windows\System32\termsrv.dll" -Destination "C:\Windows\System32\termsrv_backup.dll" -ErrorAction Ignore
|
|
Add-Content -Path "C:\Windows\System32\termsrv.dll" -Value "`n" -NoNewline -ErrorAction Ignore
|
|
Move-Item -Path "C:\Windows\System32\termsrv_backup.dll" -Destination "C:\Windows\System32\termsrv.dll" -Force -ErrorAction Ignore
|
|
cleanup_command: |
|
|
Move-Item -Path "C:\Windows\System32\termsrv_backup.dll" -Destination "C:\Windows\System32\termsrv.dll" -Force -ErrorAction Ignore
|
|
name: powershell
|
|
|
|
- name: Modify Terminal Services DLL Path
|
|
auto_generated_guid: 18136e38-0530-49b2-b309-eed173787471
|
|
description: This atomic test simulates the modification of the ServiceDll value in HKLM\System\CurrentControlSet\services\TermService\Parameters. This technique may be leveraged by adversaries to establish persistence by loading a patched version of the DLL containing malicious code.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
elevation_required: true
|
|
command: |-
|
|
$termsrvDll = "C:\Windows\System32\termsrv.dll"
|
|
|
|
$ACL = Get-Acl $termsrvDll
|
|
$permission = "Administrators","FullControl","Allow"
|
|
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
|
|
$ACL.SetAccessRule($accessRule)
|
|
Set-Acl -Path $termsrvDll -AclObject $ACL
|
|
|
|
Copy-Item -Path $termsrvDll -Destination "$HOME\AtomicTest.dll"
|
|
|
|
$newServiceDll = "$HOME\AtomicTest.dll"
|
|
|
|
$registryPath = "HKLM:\System\CurrentControlSet\services\TermService\Parameters"
|
|
|
|
# Check if the registry key exists
|
|
if (Test-Path -Path $registryPath) {
|
|
# Modify the ServiceDll value in the registry
|
|
Set-ItemProperty -Path $registryPath -Name "ServiceDll" -Value $newServiceDll
|
|
Write-Host "ServiceDll value in the registry has been updated to: $newServiceDll"
|
|
} else {
|
|
Write-Host "Registry key not found. Make sure the 'TermService\Parameters' key exists."
|
|
}
|
|
cleanup_command: Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\services\TermService\Parameters" -Name "ServiceDll" -Value "C:\Windows\System32\termsrv.dll"
|
|
name: powershell
|