dwhite9
2c8c26fb71
* Adding T1086 Alternate Data Stream atomic * Added newline T1086 * Syncing changes with updstream and origin. * Added Cleanup to Logon Scripts Atomic T1037 * Added timout to allow time for detection logic to register change. * Fixed issue with upstream sync, Re-added timout to allow time for detection logic. * Fixed cleanup command. Yaml tag not working to allow it to run. * Update T1158 test 11. Corrected ADS syntax. Added loop to run embedded ADS command from shell. Also added cleanup code. * Update T1037.yaml Moved Reg delete command under the cleanup_command tag for consistency. * Update T1037.yaml Moved reg removal command under cleanup_command tag for consistency.
52 lines
1.3 KiB
YAML
52 lines
1.3 KiB
YAML
---
|
|
attack_technique: T1037
|
|
display_name: Logon Scripts
|
|
|
|
atomic_tests:
|
|
- name: Logon Scripts
|
|
description: |
|
|
Added Via Reg.exe
|
|
|
|
supported_platforms:
|
|
- windows
|
|
|
|
input_arguments:
|
|
script_command:
|
|
description: Command To Execute
|
|
type: String
|
|
default: cmd.exe /c calc.exe
|
|
|
|
executor:
|
|
name: command_prompt
|
|
elevation_required: false
|
|
command: |
|
|
REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "#{script_command}"
|
|
cleanup_command: |
|
|
REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f
|
|
|
|
- name: Logon Scripts - Mac
|
|
description: |
|
|
Mac logon script
|
|
|
|
supported_platforms:
|
|
- macos
|
|
|
|
executor:
|
|
name: manual
|
|
steps: |
|
|
1. Create the required plist file
|
|
|
|
sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist
|
|
|
|
2. Populate the plist with the location of your shell script
|
|
|
|
sudo defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh
|
|
|
|
3. Create the required plist file in the target user's Preferences directory
|
|
|
|
touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist
|
|
|
|
4. Populate the plist with the location of your shell script
|
|
|
|
defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh
|