Andrew Beers
72ed340500
* add command to test * move test to another atomic * fixed old tests Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
71 lines
1.6 KiB
YAML
71 lines
1.6 KiB
YAML
---
|
|
attack_technique: T1069
|
|
display_name: Permission Groups Discovery
|
|
|
|
atomic_tests:
|
|
- name: Permission Groups Discovery
|
|
description: |
|
|
Permission Groups Discovery
|
|
|
|
supported_platforms:
|
|
- macos
|
|
- linux
|
|
|
|
executor:
|
|
name: sh
|
|
command: |
|
|
dscacheutil -q group
|
|
dscl . -list /Groups
|
|
groups
|
|
|
|
- name: Basic Permission Groups Discovery Windows
|
|
description: |
|
|
Basic Permission Groups Discovery for Windows
|
|
|
|
supported_platforms:
|
|
- windows
|
|
|
|
executor:
|
|
name: command_prompt
|
|
elevation_required: false
|
|
command: |
|
|
net localgroup
|
|
net group /domain
|
|
net group "domain admins" /domain
|
|
|
|
- name: Permission Groups Discovery PowerShell
|
|
description: |
|
|
Permission Groups Discovery utilizing PowerShell
|
|
|
|
supported_platforms:
|
|
- windows
|
|
|
|
input_arguments:
|
|
user:
|
|
description: User to identify what groups a user is a member of
|
|
type: string
|
|
default: administrator
|
|
|
|
executor:
|
|
name: powershell
|
|
elevation_required: false
|
|
command: |
|
|
get-localgroup
|
|
get-ADPrincipalGroupMembership #{user} | select name
|
|
|
|
- name: Elevated group enumeration using net group
|
|
description: |
|
|
Runs "net group" command including command aliases and loose typing to simulate enumeration/discovery of high value domain groups
|
|
|
|
supported_platforms:
|
|
- windows
|
|
|
|
executor:
|
|
name: command_prompt
|
|
elevation_required: false
|
|
command: |
|
|
net group /domai "Domain Admins"
|
|
net groups "Account Operators" /doma
|
|
net groups "Exchange Organization Management" /doma
|
|
net group "BUILTIN\Backup Operators" /doma
|