tfMITRE ATT&CK technique

Account Manipulation T1098

Tactics: Persistence, Privilege Escalation
Platforms: Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
Version: 2.8
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Jannie Li, Microsoft Threat Intelligence Center (MSTIC); Praetorian; Tim MalcomVetter; Wojciech Lesicki; Arad Inbar, Fidelis Security

Sub-techniques 7109 rules across the family · 64 mapped directly to T1098 · 5 of 7 carry rules

.001Additional Cloud Credentials5 .002Additional Email Delegate Permissions6 .003Additional Cloud Roles26 .004SSH Authorized Keys4 .005Device Registration7 .006Additional Container Cluster Roles0 .007Additional Local or Domain Groups0

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.[1] These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 3%

Detection rules97th percentile · 97% of ATT&CK techniques have this many detection rules written or fewer.

Account Manipulation MITRE reference T1098

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamPCPG1056 ↗

Has modified settings to publish private Aqua Security repositories to GitHub as public.1

created 2026-07-161 referenceaka PCPCat

VOID MANTICOREG1055 ↗

Has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.1 2

created 2026-04-202 referencesaka COBALT MYSTIQUE

Scattered SpiderG1015 ↗

Has added accounts to the ESX Admins group to grant them full admin rights in vSphere.1

created 2023-07-051 referenceaka Roasted 0ktapus

HAFNIUMG0125 ↗

Has granted privileges to domain accounts and reset the password for default admin accounts.1 2

created 2021-03-032 referencesaka Operation Exchange Marauder

Lazarus GroupG0032 ↗

Malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.1 2

created 2017-05-312 referencesaka Labyrinth Chollima

All 5 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

2016 Ukraine Electric Power AttackC0025 ↗

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the sp_addlinkedsrvlogin command in MS-SQL to create a link between a created account and other servers in the network.1

2016

All 1 campaigns for this technique

3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Shai-HuludS9008 ↗

Has modified GitHub account settings for private repositories and changed them to public.1 2 3 4

created 2026-04-09MALWARE

CalistoS0274 ↗

Adds permissions and remote logins to all users.1

created 2018-10-17MALWARE

MimikatzS0002 ↗

The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.1 2

created 2017-05-31TOOLcarried by 51 groups

All 3 software entries for this technique

Offense vs defense T1098

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 34Splunk ESCU (cumulative) · 30

first rule: 2017 Q1 · 1 of 1 campaigns plotted

Account Manipulation detection strategy DET0096

MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Account Manipulation Behavior Chain Detection

Enterprise

6 platforms

AN0265 · Windows

Account attribute changes (e.g., password set, group membership, servicePrincipalName, logon hours) correlated with unusual process lineage or timing, indicating privilege escalation or persistence via valid accounts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	WinEventLog:Security	EventCode=4738, 4728, 4670
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time between suspicious process and account change (e.g., 5m).
HighPrivilegeGroupList	Customize group list (e.g., Domain Admins, Enterprise Admins) to monitor.
SubjectTargetMismatch	Flag if account modifier != modified user (potential hijack).

AN0266 · Linux

Use of native tools or scripting (e.g., usermod, passwd, groupmod) to escalate permissions or persist access on existing users, correlated with login or process events.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	auditd:SYSCALL	usermod, groupmod, passwd
File ModificationDC0061	auditd:PATH	/etc/passwd or /etc/group file write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SudoPath	Common sudo or privilege escalation paths (e.g., `/usr/bin/passwd`).
ModifiedShellList	Detect if user shell is changed to unusual one (e.g., /bin/sh -> /bin/bash).

AN0267 · macOS

Modifications to user accounts via dscl, pwpolicy, or System Preferences CLI (sysadminctl) that alter user groups, enable root, or bypass MDM restrictions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	macos:unifiedlog	com.apple.accountsd, com.apple.opendirectoryd

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ModifiedUserList	Track known non-system user UIDs or service accounts.
GroupMembershipChanges	List of sensitive groups (admin, _developer, _analyticsd).

AN0268 · Identity Provider

Modifications to SSO/SAML user attributes (e.g., isAdmin, role, MFA bypass, App assignments) often through CLI, API, or rogue IdP apps.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	saas:okta	User Attribute Modified / Role Assignment Changed

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RoleAssignmentBaseline	Expected user-role pairings per app or org unit.
APIUsageContext	Caller identity or IP address ranges for identity admin actions.

AN0269 · ESXi

Addition of new users or changes to role permissions (e.g., ReadOnly -> Admin) via API or vSphere Client, particularly from non-jumpbox IPs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Active Directory Object ModificationDC0066	esxi:vpxa	vim.SessionManager.login / vim.AccountManager.createUser

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VMAdminAccountName	Expected account name patterns for ESXi/vCenter admins.
NetworkAccessLocation	Expected IPs/subnets for legitimate ESXi access.

AN0270 · SaaS

Role escalation (e.g., Editor → Owner) in cloud collaboration tools (Google Workspace, O365) or file sharing apps to maintain elevated access.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	m365:unified	Admin Activity > Role Change or Sharing Change

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SharingSensitivityLabel	Threshold for labeling sensitive document access escalation.
CrossOrgChanges	Track changes made across organizational boundaries (e.g., guest users).

1 analytic

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

Tests17ExecutorsPowerShell 14 · sh 2 · cmd 1Need elevation2 of 17Have prerequisites15Have cleanup9Platformswindows, iaas:aws, azure-ad, iaas:azure, iaas:gcp

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Admin Account Manipulate windows PowerShell Required — Yes

Manipulate Admin Account Name

Attack command

$x = Get-Random -Minimum 2 -Maximum 9999
$y = Get-Random -Minimum 2 -Maximum 9999
$z = Get-Random -Minimum 2 -Maximum 9999
$w = Get-Random -Minimum 2 -Maximum 9999
Write-Host HaHa_$x$y$z

$fmm = Get-LocalGroupMember -Group Administrators |?{ $_.ObjectClass -match "User" -and $_.PrincipalSource -match "Local"} | Select Name

foreach($member in $fmm) {
    if($member -like "*Administrator*") {
        $account = $member.Name.Split("\")[-1] # strip computername\
        $originalDescription = (Get-LocalUser -Name $account).Description
        Set-LocalUser -Name $account -Description "atr:$account;$originalDescription".Substring(0,48) # Keep original name in description
        Rename-LocalUser -Name $account -NewName "HaHa_$x$y$z" # Required due to length limitation
        Write-Host "Successfully Renamed $account Account on " $Env:COMPUTERNAME
        }
    }

Cleanup command

$list = Get-LocalUser |?{$_.Description -like "atr:*"}
foreach($u in $list) {
  $u.Description -match "atr:(?<Name>[^;]+);(?<Description>.*)"
  Set-LocalUser -Name $u.Name -Description $Matches.Description
  Rename-LocalUser -Name $u.Name -NewName $Matches.Name
  Write-Host "Successfully Reverted Account $($u.Name) to $($Matches.Name) on " $Env:COMPUTERNAME
}

GUID156e9167-94fc-4b26-a1fd-cee544663bc4

02 Domain Account and Group Manipulate windows PowerShell — 1 Yes

Create a random atr-nnnnnnnn account and add it to a domain group (by default, Domain Admins). The quickest way to run it is against a domain controller, using -Session of Invoke-AtomicTest. Alternatively, you need to install PS Module ActiveDirectory (in prereqs) and run the script with appropriare AD privileges to create the user and alter the group. Automatic installation of the dependency requires an elevated session, and is unlikely to work with Powershell Core (untested). If you consider running this test against a production Active Directory, the good practise is to create a dedicated service account whose delegation is given onto a dedicated OU for user creation and deletion, as well as delegated as group manager of the target group. Example: Invoke-AtomicTest -Session $session 'T1098' -TestNames "Domain Account and Group Manipulate" -InputArgs @{"group" = "DNSAdmins" }

Input arguments

Name	Type	Default	Description
group	string	Domain Admins	Name of the group to alter
create_args	string		Additional string appended to New-ADUser call
account_prefix	string	atr-	Prefix string of the random username (by default, atr-). Because the cleanup deletes such account based on a match `(&(samaccountname=#{account_prefix}-*)(givenName=Test))`, if you are to change it, be careful.

Attack command

$x = Get-Random -Minimum 2 -Maximum 99
$y = Get-Random -Minimum 2 -Maximum 99
$z = Get-Random -Minimum 2 -Maximum 99
$w = Get-Random -Minimum 2 -Maximum 99

Import-Module ActiveDirectory
$account = "#{account_prefix}-$x$y$z"
New-ADUser -Name $account -GivenName "Test" -DisplayName $account -SamAccountName $account -Surname $account -Enabled:$False #{create_args}
Add-ADGroupMember "#{group}" $account

Cleanup command

Get-ADUser -LDAPFilter "(&(samaccountname=#{account_prefix}-*)(givenName=Test))" | Remove-ADUser -Confirm:$False

Prerequisite

PS Module ActiveDirectory

Check

Try {
    Import-Module ActiveDirectory -ErrorAction Stop | Out-Null
    exit 0
} 
Catch {
    exit 1
}

Satisfy

if((Get-CimInstance -ClassName Win32_OperatingSystem).ProductType -eq 1) {
  Add-WindowsCapability -Name (Get-WindowsCapability -Name RSAT.ActiveDirectory.DS* -Online).Name -Online
} else {
  Install-WindowsFeature RSAT-AD-PowerShell
}

GUID340743ca-eaad-4160-9884-345e6d95a548

03 AWS - Create a group and add a user to that group iaas:aws sh — 1 Yes

Adversaries create AWS group, add users to specific to that group to elevate their privileges to gain more accesss

Input arguments

Name	Type	Default	Description
username	string	atomicredteam	Name of the AWS group to create

Attack command

aws iam create-group --group-name #{username}
aws iam add-user-to-group --user-name #{username} --group-name #{username}

Cleanup command

aws iam remove-user-from-group --user-name #{username} --group-name #{username}
aws iam delete-group --group-name #{username}

Prerequisite

Check if the user exists, we can only add a user to a group if the user exists.

Check

aws iam list-users | grep #{username}

Satisfy

echo Please run atomic test T1136.003, before running this atomic test

GUIDa7060679-cfed-44d9-9776-0abd0ea64ede

04 Azure AD - adding user to Azure AD role azure-ad PowerShell — 1 Yes

The adversaries want to add user to some Azure AD role. Threat actor may be interested primarily in highly privileged roles, e.g. Global Administrator, Application Administrator, Privileged Authentication Administrator (this role can reset Global Administrator password!). By default, the role Global Reader is assigned to the user principal in this test. The account you use to run the PowerShell command should have Privileged Role Administrator or Global Administrator role in your Azure AD. Detection hint - check Activity "Add member to role" in Azure AD Audit Logs. In targer you will also see User as a type.

Input arguments

Name	Type	Default	Description
password	string	p4sswd	Azure AD password
username	string	jonh@contoso.com	Azure AD username
role_name	string	Global Reader	Name of the targeted Azure AD role
user_principal_name	string	SuperUser	Display Name, or User Principal Name, of the targeted user principal

Attack command

Import-Module -Name AzureAD
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential

$user = Get-AzureADUser -Filter "DisplayName eq '#{user_principal_name}' or UserPrincipalName eq '#{user_principal_name}'"
if ($user -eq $null) { Write-Warning "User not found"; exit }
$role = Get-AzureADDirectoryRole -Filter "DisplayName eq '#{role_name}'"
if ($role -eq $null) { Write-Warning "Role not found"; exit }
Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId $user.ObjectId
Write-Host "User $($user.DisplayName) was added to $($role.DisplayName) role"

Cleanup command

Import-Module -Name AzureAD -ErrorAction Ignore
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential -ErrorAction Ignore

$user = Get-AzureADUser -Filter "DisplayName eq '#{user_principal_name}' or UserPrincipalName eq '#{user_principal_name}'"
if ($user -eq $null) { Write-Warning "User not found"; exit }
$role = Get-AzureADDirectoryRole -Filter "DisplayName eq '#{role_name}'"
if ($role -eq $null) { Write-Warning "Role not found"; exit }

Remove-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -MemberId $user.ObjectId
Write-Host "User $($user.DisplayName) was removed from $($role.DisplayName) role"

Prerequisite

AzureAD module must be installed.

Check

try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name AzureAD -Force

GUID4bdaf42f-e877-4014-8364-c409dcd25fe1

05 Azure AD - adding service principal to Azure AD role azure-ad PowerShell — 1 Yes

The adversaries want to add service principal to some Azure AD role. Threat actor may be interested primarily in highly privileged roles, e.g. Global Administrator, Application Administrator, Privileged Authentication Administrator (this role can reset Global Administrator password!). By default, the role Global Reader is assigned to service principal in this test. The account you use to run the PowerShell command should have Privileged Role Administrator or Global Administrator role in your Azure AD. Detection hint - check Activity "Add member to role" in Azure AD Audit Logs. In targer you will also see Service Principal as a type.

Input arguments

Name	Type	Default	Description
password	string	p4sswd	Azure AD password
username	string	jonh@contoso.com	Azure AD username
role_name	string	Global Reader	Name of the targeted Azure AD role
service_principal_name	string	SuperSP	Name of the service principal

Attack command

Import-Module -Name AzureAD
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential

$sp = Get-AzureADServicePrincipal -Filter "DisplayName eq '#{service_principal_name}'"
if ($sp -eq $null) { Write-Warning "Service Principal not found"; exit }
$role = Get-AzureADDirectoryRole -Filter "DisplayName eq '#{role_name}'"
if ($role -eq $null) { Write-Warning "Role not found"; exit }
Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId $sp.ObjectId
Write-Host "Service Principal $($sp.DisplayName) was added to $($role.DisplayName)"

Cleanup command

Import-Module -Name AzureAD -ErrorAction Ignore
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential -ErrorAction Ignore

$sp = Get-AzureADServicePrincipal -Filter "DisplayName eq '#{service_principal_name}'"
if ($sp -eq $null) { Write-Warning "Service Principal not found"; exit }
$role = Get-AzureADDirectoryRole -Filter "DisplayName eq '#{role_name}'"
if ($role -eq $null) { Write-Warning "Role not found"; exit }

Remove-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -MemberId $sp.ObjectId
Write-Host "Service Principal $($sp.DisplayName) was removed from $($role.DisplayName) role"

Prerequisite

AzureAD module must be installed.

Check

try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name AzureAD -Force

GUIDd78c2eb2-bf2d-4bfd-a888-c65eb9816700

06 Azure - adding user to Azure role in subscription iaas:azure PowerShell — 1 Yes

The adversaries want to add user to some Azure role, also called Azure resource role. Threat actor may be interested primarily in highly privileged roles, e.g. Owner, Contributor. By default, the role Reader is assigned to user in this test. New-AzRoleAssignment cmdlet could be also use to assign user/service principal to resource, resource group and management group. The account you use to run the PowerShell command must have Microsoft.Authorization/roleAssignments/write (e.g. such as User Access Administrator or Owner) and the Azure Active Directory Graph Directory.Read.All and Microsoft Graph Directory.Read.All permissions. Detection hint - check Operation Name "Create role assignment" in subscriptions Activity Logs.

Input arguments

Name	Type	Default	Description
password	string	p4sswd	Azure AD password
username	string	jonh@contoso.com	Azure AD username
role_name	string	Reader	Name of the targeted Azure role
subscription	string	Azure subscription 1	Name of the targeted subscription
user_principal_name	string	SuperUser	Display Name, or User Principal Name, of the targeted user principal

Attack command

Import-Module -Name Az.Resources
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzAccount -Credential $Credential

$user = Get-AzADUser | where-object {$_.DisplayName -eq "#{user_principal_name}" -or $_.UserPrincipalName -eq "#{user_principal_name}" }
if ($user -eq $null) { Write-Warning "User not found"; exit }
$subscription = Get-AzSubscription | where-object {$_.Name -eq "#{subscription}"}
if ($subscription -eq $null) { Write-Warning "Subscription not found"; exit }
$role = Get-AzRoleDefinition | where-object {$_.Name -eq "#{role_name}"}
if ($role -eq $null) { Write-Warning "Role not found"; exit }

New-AzRoleAssignment -ObjectId $user.id -RoleDefinitionId $role.id -Scope /subscriptions/$subscription
Write-Host "User $($user.DisplayName) was added to $($role.Name) role in subscriptions $($subscriptions.Name)"

Cleanup command

Import-Module -Name AzureAD -ErrorAction Ignore
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzAccount -Credential $Credential -ErrorAction Ignore

$user = Get-AzADUser | where-object {$_.DisplayName -eq "#{user_principal_name}" -or $_.UserPrincipalName -eq "#{user_principal_name}" }
if ($user -eq $null) { Write-Warning "User not found"; exit }
$subscription = Get-AzSubscription | where-object {$_.Name -eq "#{subscription}"}
if ($subscription -eq $null) { Write-Warning "Subscription not found"; exit }
$role = Get-AzRoleDefinition | where-object {$_.Name -eq "#{role_name}"}
if ($role -eq $null) { Write-Warning "Role not found"; exit }

Remove-AzRoleAssignment -ObjectId $user.id -RoleDefinitionId $role.id -Scope /subscriptions/$subscription
Write-Host "User Principal $($sp.DisplayName) was removed from $($role.Name) role in subscriptions $($subscriptions.Name)"

Prerequisite

Az.Resources module must be installed.

Check

try {if (Get-InstalledModule -Name Az.Resources -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name Az.Resources -Force

GUIDae7a3244-37e1-441f-8655-4f4b5cc00190

07 Azure - adding service principal to Azure role in subscription iaas:azure PowerShell — 1 Yes

The adversaries want to add service principal to some Azure role, also called Azure resource role. Threat actor may be interested primarily in highly privileged roles, e.g. Owner, Contributor. By default, the role Reader is assigned to service principal in this test. New-AzRoleAssignment cmdlet could be also use to assign user/service principal to resource, resource group and management group. The account you use to run the PowerShell command must have Microsoft.Authorization/roleAssignments/write (e.g. such as User Access Administrator or Owner) and the Azure Active Directory Graph Directory.Read.All and Microsoft Graph Directory.Read.All permissions. Detection hint - check Operation Name "Create role assignment" in subscriptions Activity Logs.

Input arguments

Name	Type	Default	Description
password	string	p4sswd	Azure AD password
username	string	jonh@contoso.com	Azure AD username
role_name	string	Reader	Name of the targeted Azure role
subscription	string	Azure subscription 1	Name of the targeted subscription
service_principal_name	string	SuperSP	Name of the service principal

Attack command

Import-Module -Name Az.Resources
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzAccount -Credential $Credential

$sp = Get-AzADServicePrincipal | where-object {$_.DisplayName -eq "#{service_principal_name}"}
if ($sp -eq $null) { Write-Warning "Service Principal not found"; exit }
$subscription = Get-AzSubscription | where-object {$_.Name -eq "#{subscription}"} 
if ($subscription -eq $null) { Write-Warning "Subscription not found"; exit }
$role = Get-AzRoleDefinition | where-object {$_.Name -eq "#{role_name}"}
if ($role -eq $null) { Write-Warning "Role not found"; exit }

New-AzRoleAssignment -ObjectId $sp.id -RoleDefinitionId $role.id -Scope /subscriptions/$subscription
Write-Host "Service Principal $($sp.DisplayName) was added to $($role.Name) role in subscriptions $($subscriptions.Name)"

Cleanup command

Import-Module -Name AzureAD -ErrorAction Ignore
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzAccount -Credential $Credential -ErrorAction Ignore

$sp = Get-AzADServicePrincipal | where-object {$_.DisplayName -eq "#{service_principal_name}"}
if ($sp -eq $null) { Write-Warning "Service Principal not found"; exit }
$subscription = Get-AzSubscription | where-object {$_.Name -eq "#{subscription}"} 
if ($subscription -eq $null) { Write-Warning "Subscription not found"; exit }
$role = Get-AzRoleDefinition | where-object {$_.Name -eq "#{role_name}"}
if ($role -eq $null) { Write-Warning "Role not found"; exit }

Remove-AzRoleAssignment -ObjectId $sp.id -RoleDefinitionId $role.id -Scope /subscriptions/$subscription
Write-Host "Service Principal $($sp.DisplayName) was removed from $($role.Name) role in subscriptions $($subscriptions.Name)"

Prerequisite

Az.Resources module must be installed.

Check

try {if (Get-InstalledModule -Name Az.Resources -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name Az.Resources -Force

GUIDd79a2a06-2ca3-4517-9cc4-1caadd1558f5

08 Azure AD - adding permission to application azure-ad PowerShell — 1 Yes

The adversaries want to add permission to newly created application. Application could be then used for persistence or for further operation in the attacked infrastructure. Permissions like AppRoleAssignment.ReadWrite.All or RoleManagement.ReadWrite.Directory in particular can be a valuable target for a threat actor. This technique will create a new app, with the provided name, and give it the provided permission. But if you prefer to add credentials to an existing app, replace in the code: "Get-AzureADApplication" instead of "New-AzureADServicePrincipal". The DirectoryRecommendations.Read.All permissions has been selected as the default. The account you use to run the PowerShell command should have Global Administrator/Application Administrator/Cloud Application Administrator role in your Azure AD. Detection hint - check Operation Name "Add app role assignment to service principal" in subscriptions Activity Logs. You can also take a look at the materials: https://learnsentinel.blog/2022/01/04/azuread-privesc-sentinel/ https://github.com/reprise99/Sentinel-Queries https://docs.google.com/presentation/d/1AWx1w0Xcq8ENvOmSjAJswEgEio-il09QWZlGg9PbHqE/edit#slide=id.g10460eb209c_0_2766 https://gist.github.com/andyrobbins/7c3dd62e6ed8678c97df9565ff3523fb

Input arguments

Name	Type	Default	Description
password	string	p4sswd	Azure AD password
username	string	jonh@contoso.com	Azure AD username
application_name	string	test_app	Name of the targeted application that will be created
application_permission	string	DirectoryRecommendations.Read.All	Permission from Microsoft Graph Resource API that will be added to application

Attack command

Import-Module -Name AzureAD
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential

$aadApplication = New-AzureADApplication -DisplayName "#{application_name}"
$servicePrincipal = New-AzureADServicePrincipal -AppId $aadApplication.AppId
#$aadApplication = Get-AzureADApplication -Filter "DisplayName eq '#{application_name}'"

#Get Service Principal of Microsoft Graph Resource API 
$graphSP = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Graph'"

#Initialize RequiredResourceAccess for Microsoft Graph Resource API 
$requiredGraphAccess = New-Object Microsoft.Open.AzureAD.Model.RequiredResourceAccess
$requiredGraphAccess.ResourceAppId = $graphSP.AppId
$requiredGraphAccess.ResourceAccess = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.ResourceAccess]

#Set Application Permissions
$ApplicationPermissions = @('#{application_permission}')

$reqPermission = $graphSP.AppRoles | Where-Object {$_.Value -eq $ApplicationPermissions}
if($reqPermission)
{
$resourceAccess = New-Object Microsoft.Open.AzureAD.Model.ResourceAccess
$resourceAccess.Type = "Role"
$resourceAccess.Id = $reqPermission.Id    
#Add required app permission
$requiredGraphAccess.ResourceAccess.Add($resourceAccess)
}
else
{
Write-Host "App permission $permission not found in the Graph Resource API" -ForegroundColor Red
}

#Add required resource accesses
$requiredResourcesAccess = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.RequiredResourceAccess]
$requiredResourcesAccess.Add($requiredGraphAccess)

#Set permissions in existing Azure AD App
Set-AzureADApplication -ObjectId $aadApplication.ObjectId -RequiredResourceAccess $requiredResourcesAccess

$servicePrincipal = Get-AzureADServicePrincipal -Filter "AppId eq '$($aadApplication.AppId)'"

New-AzureADServiceAppRoleAssignment -ObjectId $servicePrincipal.ObjectId -PrincipalId $servicePrincipal.ObjectId -ResourceId $graphSP.ObjectId -Id $reqPermission.Id

Cleanup command

Import-Module -Name AzureAD
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
Connect-AzureAD -Credential $Credential

$aadApplication = @(Get-AzureADApplication -Filter "DisplayName eq '#{application_name}'")
If ($aadApplication.Count -eq 0)
{
  Write-Host "App not found: cannot delete it"
  exit
}
ElseIf ($aadApplication.Count -gt 1)
{
  Write-Host "Found several app with name '#{application_name}': one is likely the one this technique created, but as a precaution, none will be deleted. Manual cleanup is required."
  exit
}
Else
{
  Remove-AzureADApplication -ObjectId $aadApplication[0].ObjectId
  Write-Host "Successfully deleted app"
}

Prerequisite

AzureAD module must be installed.

Check

try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name AzureAD -Force

GUIDe251eec1-abe4-4ff1-8337-22108a5f1dc1

09 Password Change on Directory Service Restore Mode (DSRM) Account windows cmd Required — —

Change the password on the Directory Service Restore Mode (DSRM) account using ntdsutil by syncing to existing account

Input arguments

Name	Type	Default	Description
sync_account	string	%username%	Account to sync password from

Attack command

ntdsutil "set dsrm password" "sync from domain account #{sync_account}" "q" "q"

GUID972b3c06-dc58-4c40-af16-0764b1fd7e22

10 Domain Password Policy Check: Short Password windows PowerShell — 1 —

Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password. If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the password policy will likely prevent you from setting the password back to what it was.

Input arguments

Name	Type	Default	Description
cred_file	path	$env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt	A file containing the password of the current user
new_password	string	Uplow-1	The password to set for the current domain user (default value is 7 characters)

Attack command

$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $newPassword = ConvertTo-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 86) {
            Write-Host -ForegroundColor Yellow "The stored password for the current user is incorrect. Please run the prereq commands to set the correct credentials"
            Remove-Item $credFile
        }
        exit $errCode
    }
    Write-Host -ForegroundColor Cyan "Successfully changed the password to #{new_password}"
    $newCred = New-Object System.Management.Automation.PSCredential ($env:USERNAME, $(ConvertTo-SecureString "#{new_password}" -AsPlainText -Force))
    $newCred.Password | ConvertFrom-SecureString | Out-File $credFile
}
else {
    Write-Host -ForegroundColor Yellow "You must store the password of the current user by running the prerequisite commands first"
}

Prerequisite

Password for current user must be stored in a credential file

Check

if (Test-Path #{cred_file}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{cred_file}") -ErrorAction Ignore | Out-Null
$cred = Get-Credential -UserName  $env:USERNAME -message "Enter password for $env:USERNAME to use during password change attempt"
$cred.Password | ConvertFrom-SecureString | Out-File "#{cred_file}"

GUID0005a1ca-4073-40bd-adb8-61d407eef50c

11 Domain Password Policy Check: No Number in Password windows PowerShell — 1 —

Input arguments

Name	Type	Default	Description
cred_file	path	$env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt	A file containing the password of the current user
new_password	string	UpperLowerLong-special	The password to set for the current domain user (default is long and has upper and lower case and special character but no number)

Attack command

$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $newPassword = ConvertTo-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 86) {
            Write-Host -ForegroundColor Yellow "The stored password for the current user is incorrect. Please run the prereq commands to set the correct credentials"
            Remove-Item $credFile
        }
        exit $errCode
    }
    Write-Host -ForegroundColor Cyan "Successfully changed the password to #{new_password}"
    $newCred = New-Object System.Management.Automation.PSCredential ($env:USERNAME, $(ConvertTo-SecureString "#{new_password}" -AsPlainText -Force))
    $newCred.Password | ConvertFrom-SecureString | Out-File $credFile
}
else {
    Write-Host -ForegroundColor Yellow "You must store the password of the current user by running the prerequisite commands first"
}

Prerequisite

Password for current user must be stored in a credential file

Check

if (Test-Path #{cred_file}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{cred_file}") -ErrorAction Ignore | Out-Null
$cred = Get-Credential -UserName  $env:USERNAME -message "Enter password for $env:USERNAME to use during password change attempt"
$cred.Password | ConvertFrom-SecureString | Out-File "#{cred_file}"

GUID5d1a7315-abea-4536-925a-a4992c4abcc6

12 Domain Password Policy Check: No Special Character in Password windows PowerShell — 1 —

Input arguments

Name	Type	Default	Description
cred_file	path	$env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt	A file containing the password of the current user
new_password	string	UpperLowerLong333noSpecialChar	The password to set for the current domain user (default is long and has upper and lower case and number but no special character)

Attack command

$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $newPassword = ConvertTo-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 86) {
            Write-Host -ForegroundColor Yellow "The stored password for the current user is incorrect. Please run the prereq commands to set the correct credentials"
            Remove-Item $credFile
        }
        exit $errCode
    }
    Write-Host -ForegroundColor Cyan "Successfully changed the password to #{new_password}"
    $newCred = New-Object System.Management.Automation.PSCredential ($env:USERNAME, $(ConvertTo-SecureString "#{new_password}" -AsPlainText -Force))
    $newCred.Password | ConvertFrom-SecureString | Out-File $credFile
}
else {
    Write-Host -ForegroundColor Yellow "You must store the password of the current user by running the prerequisite commands first"
}

Prerequisite

Password for current user must be stored in a credential file

Check

if (Test-Path #{cred_file}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{cred_file}") -ErrorAction Ignore | Out-Null
$cred = Get-Credential -UserName  $env:USERNAME -message "Enter password for $env:USERNAME to use during password change attempt"
$cred.Password | ConvertFrom-SecureString | Out-File "#{cred_file}"

GUID56352021-7067-45c2-a33e-65a44fdb3f6f

13 Domain Password Policy Check: No Uppercase Character in Password windows PowerShell — 1 —

Input arguments

Name	Type	Default	Description
cred_file	path	$env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt	A file containing the password of the current user
new_password	string	lower-long-special-333	The password to set for the current domain user (default is long and has and lower case and special character and number but no uppercase)

Attack command

$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $newPassword = ConvertTo-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 86) {
            Write-Host -ForegroundColor Yellow "The stored password for the current user is incorrect. Please run the prereq commands to set the correct credentials"
            Remove-Item $credFile
        }
        exit $errCode
    }
    Write-Host -ForegroundColor Cyan "Successfully changed the password to #{new_password}"
    $newCred = New-Object System.Management.Automation.PSCredential ($env:USERNAME, $(ConvertTo-SecureString "#{new_password}" -AsPlainText -Force))
    $newCred.Password | ConvertFrom-SecureString | Out-File $credFile
}
else {
    Write-Host -ForegroundColor Yellow "You must store the password of the current user by running the prerequisite commands first"
}

Prerequisite

Password for current user must be stored in a credential file

Check

if (Test-Path #{cred_file}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{cred_file}") -ErrorAction Ignore | Out-Null
$cred = Get-Credential -UserName  $env:USERNAME -message "Enter password for $env:USERNAME to use during password change attempt"
$cred.Password | ConvertFrom-SecureString | Out-File "#{cred_file}"

GUID8ebe494f-b609-4361-b30c-6230040e3c29

14 Domain Password Policy Check: No Lowercase Character in Password windows PowerShell — 1 —

Input arguments

Name	Type	Default	Description
cred_file	path	$env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt	A file containing the password of the current user
new_password	string	UPPER-LONG-SPECIAL-333	The password to set for the current domain user (default is long and has and upper case and special character and number but no lowercase)

Attack command

$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $newPassword = ConvertTo-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 86) {
            Write-Host -ForegroundColor Yellow "The stored password for the current user is incorrect. Please run the prereq commands to set the correct credentials"
            Remove-Item $credFile
        }
        exit $errCode
    }
    Write-Host -ForegroundColor Cyan "Successfully changed the password to #{new_password}"
    $newCred = New-Object System.Management.Automation.PSCredential ($env:USERNAME, $(ConvertTo-SecureString "#{new_password}" -AsPlainText -Force))
    $newCred.Password | ConvertFrom-SecureString | Out-File $credFile
}
else {
    Write-Host -ForegroundColor Yellow "You must store the password of the current user by running the prerequisite commands first"
}

Prerequisite

Password for current user must be stored in a credential file

Check

if (Test-Path #{cred_file}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{cred_file}") -ErrorAction Ignore | Out-Null
$cred = Get-Credential -UserName  $env:USERNAME -message "Enter password for $env:USERNAME to use during password change attempt"
$cred.Password | ConvertFrom-SecureString | Out-File "#{cred_file}"

GUID442e40f7-f2a6-4df7-9906-762673e69014

15 Domain Password Policy Check: Only Two Character Classes windows PowerShell — 1 —

Input arguments

Name	Type	Default	Description
cred_file	path	$env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt	A file containing the password of the current user
new_password	string	onlyUPandLowChars	The password to set for the current domain user (default has only upper and lower case characters)

Attack command

$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $newPassword = ConvertTo-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 86) {
            Write-Host -ForegroundColor Yellow "The stored password for the current user is incorrect. Please run the prereq commands to set the correct credentials"
            Remove-Item $credFile
        }
        exit $errCode
    }
    Write-Host -ForegroundColor Cyan "Successfully changed the password to #{new_password}"
    $newCred = New-Object System.Management.Automation.PSCredential ($env:USERNAME, $(ConvertTo-SecureString "#{new_password}" -AsPlainText -Force))
    $newCred.Password | ConvertFrom-SecureString | Out-File $credFile
}
else {
    Write-Host -ForegroundColor Yellow "You must store the password of the current user by running the prerequisite commands first"
}

Prerequisite

Password for current user must be stored in a credential file

Check

if (Test-Path #{cred_file}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{cred_file}") -ErrorAction Ignore | Out-Null
$cred = Get-Credential -UserName  $env:USERNAME -message "Enter password for $env:USERNAME to use during password change attempt"
$cred.Password | ConvertFrom-SecureString | Out-File "#{cred_file}"

GUIDdded6b78-31b4-4459-b5e2-2785e78028dd

16 Domain Password Policy Check: Common Password Use windows PowerShell — 1 —

Input arguments

Name	Type	Default	Description
cred_file	path	$env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt	A file containing the password of the current user
new_password	string	Spring$((Get-Date).Year)!	The password to set for the current domain user (default is Season and current year combo)

Attack command

$credFile = "#{cred_file}"
if (Test-Path $credFile) {
    $cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $env:USERNAME, (Get-Content $credFile | ConvertTo-SecureString)
    if($cred.GetNetworkCredential().Password -eq "#{new_password}"){
      Write-Host -ForegroundColor Yellow "The new password is the same as the password stored in the credential file. Please specify a different new password."; exit -1
    }
    try {
        $newPassword = ConvertTo-SecureString #{new_password} -AsPlainText -Force
        Set-ADAccountPassword -Identity $env:USERNAME -OldPassword $cred.password -NewPassword $newPassword
    }
    catch { 
        $_.Exception
        $errCode = $_.Exception.ErrorCode
        Write-Host "Error code: $errCode"
        if ($errCode -eq 86) {
            Write-Host -ForegroundColor Yellow "The stored password for the current user is incorrect. Please run the prereq commands to set the correct credentials"
            Remove-Item $credFile
        }
        exit $errCode
    }
    Write-Host -ForegroundColor Cyan "Successfully changed the password to #{new_password}"
    $newCred = New-Object System.Management.Automation.PSCredential ($env:USERNAME, $(ConvertTo-SecureString "#{new_password}" -AsPlainText -Force))
    $newCred.Password | ConvertFrom-SecureString | Out-File $credFile
}
else {
    Write-Host -ForegroundColor Yellow "You must store the password of the current user by running the prerequisite commands first"
}

Prerequisite

Password for current user must be stored in a credential file

Check

if (Test-Path #{cred_file}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{cred_file}") -ErrorAction Ignore | Out-Null
$cred = Get-Credential -UserName  $env:USERNAME -message "Enter password for $env:USERNAME to use during password change attempt"
$cred.Password | ConvertFrom-SecureString | Out-File "#{cred_file}"

GUIDa363f536-2c78-46dc-be07-9485e6f72a93

17 GCP - Delete Service Account Key iaas:gcp sh — 4 Yes

This Atomic will: - Create a service account - Create a service account key, - Store the result of retrieving a single key for that service account as a variable - Pass that variable for deletion - Delete the service account The idea for this Atomic came from a Rule published by the Elastic team. Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP). Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly. Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml

Input arguments

Name	Type	Default	Description
project_id	string	atomic-test-1	ID of the GCP Project you to execute the command against.
service_name	string	atomic-service-account	The name of the service account.

Attack command

gcloud config set project #{project_id}
KEY=`gcloud iam service-accounts keys list --iam-account=#{service_name}@#{project_id}.iam.gserviceaccount.com --format="value(KEY_ID)" --limit=1`
gcloud iam service-accounts keys delete $KEY --iam-account=#{service_name}@#{project_id}.iam.gserviceaccount.com --quiet

Cleanup command

cd "$PathToAtomicsFolder/T1098/src/T1098-17/"
terraform state rm google_service_account_key.key
terraform destroy -auto-approve

Prerequisite

Requires gcloud

Check

if [ -x "$(command -v gcloud)" ]; then exit 0; else exit 1; fi;

Satisfy

echo "Please Install Google Cloud SDK before running this atomic test : https://cloud.google.com/sdk/docs/install"

Prerequisite

Check if user is logged in

Check

gcloud config get-value account

Satisfy

gcloud auth login --no-launch-browser

Prerequisite

Check if terraform is installed.

Check

terraform version

Satisfy

echo Please install the terraform.

Prerequisite

Create dependency resources using terraform

Check

stat "$PathToAtomicsFolder/T1098/src/T1098-17/terraform.tfstate"

Satisfy

cd "$PathToAtomicsFolder/T1098/src/T1098-17/"
terraform init
terraform apply -auto-approve

GUIDee1af72a-6688-4acd-be46-346329273e4b

Tests from Atomic Red Team (MIT licence) · technique definition

Account Manipulation detections T1098

64 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 3%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs