Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Atomic Test #7 - System Owner/User Discovery Using Command Prompt #2657

Merged
merged 9 commits into from
Jan 20, 2024
Merged

Atomic Test #7 - System Owner/User Discovery Using Command Prompt #2657

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2e0b697
Atomic Test #7 - System Owner/User Discovery Using Command Prompt
prashanthpulisetti Jan 18, 2024
45ad3b8
Update T1033.yaml
prashanthpulisetti Jan 18, 2024
d8a4048
Update T1033.yaml
prashanthpulisetti Jan 18, 2024
9942612
Update T1033.yaml
prashanthpulisetti Jan 18, 2024
da62d3f
Update T1033.yaml
prashanthpulisetti Jan 18, 2024
14f6389
Update T1033.yaml
prashanthpulisetti Jan 18, 2024
c0eba58
Update T1033.yaml
prashanthpulisetti Jan 18, 2024
48a50d0
Update T1033.yaml
prashanthpulisetti Jan 18, 2024
c6ae070
Merge branch 'master' into patch-5
clr2of8 Jan 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions atomics/T1033/T1033.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,3 +105,25 @@ atomic_tests:
cleanup_command: |
Remove-Item -Path #{output_path}\rad*.tmp -Force
name: powershell

- name: "System Owner/User Discovery Using Command Prompt"
description: "Identify the system owner or current user using native Windows command prompt utilities."
supported_platforms:
- "windows"
auto_generated_guid: "9f12ab45-c332-4f5a-8e9b-6c81a8343e2e"
input_arguments:
output_file_path:
description: "Location of output file."
type: "string"
default: "$env:temp"
executor:
name: "command_prompt"
elevation_required: false
command: |
set file=#{output_file_path}\user_info_%random%.tmp
echo Username: %USERNAME% > %file%
echo User Domain: %USERDOMAIN% >> %file%
net users >> %file%
query user >> %file%
cleanup_command: |
del #{output_file_path}\\user_info_*.tmp