T1098 Account Manipulation — Attack Simulation

DC0066 collection page — Enable Audit Directory Service Changes with appropriate object SACLs on lab DCs; retain 5136 attribute/value and correlation context.

Providers and collection configuration

• Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.
• Active Directory domain controllers: Directory changes and authentication records; collect from the relevant controllers, not only endpoints.

• Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
• For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
• Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: object_dn, attribute, before, after.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0066",
  "collector": "illustrative-lab-collector",
  "observation": {
    "object_dn": "CN=LabUser,OU=Lab,DC=example,DC=test",
    "attribute": "description",
    "before": "Lab account",
    "after": "Lab account reviewed"
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

DC0061 collection page — Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: path, attribute, before, after.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0061",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "C:\\Lab\\demo.txt",
    "attribute": "content_hash",
    "before": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "after": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0010 collection page — Enable Audit User Account Management and retain the changed attributes and target account; correlate approved administrative requests.

Providers and collection configuration

• Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.
• Active Directory domain controllers: Directory changes and authentication records; collect from the relevant controllers, not only endpoints.

• Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
• For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
• Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: target_account, attribute, before, after.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0010",
  "collector": "illustrative-lab-collector",
  "observation": {
    "target_account": "lab-temp",
    "attribute": "enabled",
    "before": false,
    "after": true
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

MITRE detection strategy

31 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Bitbucket Global Permission Changed — test; product: bitbucket; service: audit; definition: Requirements: "Advance" log level is required to receive these audit events..
• AWS IAM Backdoor Users Keys — test; product: aws; service: cloudtrail.
• AWS Route 53 Domain Transfer Lock Disabled — test; product: aws; service: cloudtrail.
• AWS Route 53 Domain Transferred to Another Account — test; product: aws; service: cloudtrail.
• AWS User Login Profile Was Modified — test; product: aws; service: cloudtrail.
• Number Of Resource Creation Or Deployment Activities — test; product: azure; service: activitylogs.
• Change to Authentication Method — test; product: azure; service: auditlogs.
• Bulk Deletion Changes To Privileged Account Permissions — test; product: azure; service: auditlogs.
• Anomalous User Activity — test; product: azure; service: riskdetection.
• GCP Access Policy Deleted — test; product: gcp; service: gcp.audit.
• Google Workspace Granted Domain API Access — test; product: gcp; service: google_workspace.admin.
• Google Workspace User Granted Admin Privileges — test; product: gcp; service: google_workspace.admin.
• Privileged User Has Been Created — test; product: linux; definition: /var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work.
• ESXi Admin Permission Assigned To Account Via ESXCLI — test; category: process_creation; product: linux.
• Cisco Local Accounts — test; product: cisco; service: aaa.
• A Member Was Added to a Security-Enabled Global Group — stable; product: windows; service: security.
• A Member Was Removed From a Security-Enabled Global Group — stable; product: windows; service: security.
• A Security-Enabled Global Group Was Deleted — stable; product: windows; service: security.
• Powerview Add-DomainObjectAcl DCSync AD Extend Right — test; product: windows; service: security; definition: Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule).
• Enabled User Right in AD to Control User Objects — test; product: windows; service: security; definition: Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authorization Policy Change.
• Active Directory User Backdoors — test; product: windows; service: security; definition: Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes.
• A New Trust Was Created To A Domain — stable; product: windows; service: security.
• Password Change on Directory Service Restore Mode (DSRM) Account — stable; product: windows; service: security.
• User Added to Local Administrator Group — stable; product: windows; service: security.
• DMSA Service Account Created in Specific OUs - PowerShell — experimental; category: ps_script; product: windows.
• Powershell LocalAccount Manipulation — test; product: windows; category: ps_script; definition: Requirements: Script Block Logging must be enabled.
• DMSA Link Attributes Modified — experimental; category: ps_script; product: windows.
• New DMSA Service Account Created in Specific OUs — experimental; category: process_creation; product: windows.
• User Added to Local Administrators Group — test; category: process_creation; product: windows.
• User Added To Highly Privileged Group — test; category: process_creation; product: windows.
• Password Set to Never Expire via WMI — experimental; category: process_creation; product: windows.

• S0002 Mimikatz — tool.

  The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The <code>LSADUMP::ChangeNTLM</code> and <code>LSADUMP::SetNTLM</code> modules can also manipulate the password hash of an account without knowing the clear text value.[Adsecurity Mimikatz Guide][Metcalf 2015]

  Exact relationship: relationship--6e641c36-188b-480e-b177-e412cd000b34
• S0274 Calisto — malware.

  Calisto adds permissions and remote logins to all users.[Symantec Calisto July 2018]

  Exact relationship: relationship--fe56443a-5f0b-4120-9d27-d4d98aae69b8
• S9008 Shai-Hulud — malware.

  Shai-Hulud has modified GitHub account settings for private repositories and changed them to public.[Aikido Shai-Hulud September 2025][Netskope Shai-Hulud November 2025][Wiz Shai-Hulud September 2025][Microsoft Shai-Hulud December 2025]

  Exact relationship: relationship--98aa284c-7c8b-4577-9aed-5eaee1f1c787

The adversaries want to add user to some Azure AD role. Threat actor
may be interested primarily in highly privileged roles, e.g. Global Administrator, Application Administrator,
Privileged Authentication Administrator (this role can reset Global Administrator password!).
By default, the role Global Reader is assigned to the user principal in this test.

The account you use to run the PowerShell command should have Privileged Role Administrator or Global Administrator role in your Azure AD.

Detection hint - check Activity "Add member to role" in Azure AD Audit Logs. In targer you will also see User as a type.

Pinned Atomic procedure · 0e65ae27-5385-46b4-98ac-607a8ee82261 · azure-ad · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• username: Azure AD username (type string; source default jonh@contoso.com)
• password: Azure AD password (type string; source default p4sswd)
• user_principal_name: Display Name, or User Principal Name, of the targeted user principal (type string; source default SuperUser)
• role_name: Name of the targeted Azure AD role (type string; source default Global Reader)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• AzureAD module must be installed.

The adversaries want to add user to some Azure role, also called Azure resource role. Threat actor
may be interested primarily in highly privileged roles, e.g. Owner, Contributor.
By default, the role Reader is assigned to user in this test.

New-AzRoleAssignment cmdlet could be also use to assign user/service principal to resource, resource group and management group.

The account you use to run the PowerShell command must have Microsoft.Authorization/roleAssignments/write
(e.g. such as User Access Administrator or Owner) and the Azure Active Directory Graph Directory.Read.All
and Microsoft Graph Directory.Read.All permissions.

Detection hint - check Operation Name "Create role assignment" in subscriptions Activity Logs.

Pinned Atomic procedure · 1a94b3fc-b080-450a-b3d8-6d9b57b472ea · iaas:azure · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• username: Azure AD username (type string; source default jonh@contoso.com)
• password: Azure AD password (type string; source default p4sswd)
• user_principal_name: Display Name, or User Principal Name, of the targeted user principal (type string; source default SuperUser)
• role_name: Name of the targeted Azure role (type string; source default Reader)
• subscription: Name of the targeted subscription (type string; source default Azure subscription 1)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Az.Resources module must be installed.

Manipulate Admin Account Name

Pinned Atomic procedure · 5598f7cb-cf43-455e-883a-f6008c5d46af · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was.

Pinned Atomic procedure · 68190529-069b-4ffc-a942-919704158065 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• new_password: The password to set for the current domain user (default is long and has upper and lower case and special character but no number) (type string; source default UpperLowerLong-special)
• cred_file: A file containing the password of the current user (type path; source default $env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Password for current user must be stored in a credential file

Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was.

Pinned Atomic procedure · 784d1349-5a26-4d20-af5e-d6af53bae460 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• new_password: The password to set for the current domain user (default has only upper and lower case characters) (type string; source default onlyUPandLowChars)
• cred_file: A file containing the password of the current user (type path; source default $env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Password for current user must be stored in a credential file

Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was.

Pinned Atomic procedure · 7d984ef2-2db2-4cec-b090-e637e1698f61 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• new_password: The password to set for the current domain user (default is long and has upper and lower case and number but no special character) (type string; source default UpperLowerLong333noSpecialChar)
• cred_file: A file containing the password of the current user (type path; source default $env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Password for current user must be stored in a credential file

This Atomic will:
- Create a service account
- Create a service account key,
- Store the result of retrieving a single key for that service account as a variable
- Pass that variable for deletion
- Delete the service account

The idea for this Atomic came from a Rule published by the Elastic team.

Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP).
Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate.
If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly.

Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml

Pinned Atomic procedure · 7ece1dea-49f1-4d62-bdcc-5801e3292510 · iaas:gcp · sh.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• project_id: ID of the GCP Project you to execute the command against. (type string; source default atomic-test-1)
• service_name: The name of the service account. (type string; source default atomic-service-account)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

4 prerequisite definitions:

• Requires gcloud
• Check if user is logged in
• Check if terraform is installed.
• Create dependency resources using terraform

Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was.

Pinned Atomic procedure · 81959d03-c51f-49a1-bb24-23f1ec885578 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• new_password: The password to set for the current domain user (default is Season and current year combo) (type string; source default Spring$((Get-Date).Year)!)
• cred_file: A file containing the password of the current user (type path; source default $env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Password for current user must be stored in a credential file

Adversaries create AWS group, add users to specific to that group to elevate their privileges to gain more accesss

Pinned Atomic procedure · 8822c3b0-d9f9-4daf-a043-49f110a31122 · iaas:aws · sh.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• username: Name of the AWS group to create (type string; source default atomicredteam)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Check if the user exists, we can only add a user to a group if the user exists.

The adversaries want to add service principal to some Azure AD role. Threat actor
may be interested primarily in highly privileged roles, e.g. Global Administrator, Application Administrator,
Privileged Authentication Administrator (this role can reset Global Administrator password!).
By default, the role Global Reader is assigned to service principal in this test.

The account you use to run the PowerShell command should have Privileged Role Administrator or Global Administrator role in your Azure AD.

Detection hint - check Activity "Add member to role" in Azure AD Audit Logs. In targer you will also see Service Principal as a type.

Pinned Atomic procedure · 92c40b3f-c406-4d1f-8d2b-c039bf5009e4 · azure-ad · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• username: Azure AD username (type string; source default jonh@contoso.com)
• password: Azure AD password (type string; source default p4sswd)
• service_principal_name: Name of the service principal (type string; source default SuperSP)
• role_name: Name of the targeted Azure AD role (type string; source default Global Reader)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• AzureAD module must be installed.

Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was.

Pinned Atomic procedure · 945da11e-977e-4dab-85d2-f394d03c5887 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• new_password: The password to set for the current domain user (default is long and has and upper case and special character and number but no lowercase) (type string; source default UPPER-LONG-SPECIAL-333)
• cred_file: A file containing the password of the current user (type path; source default $env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Password for current user must be stored in a credential file

The adversaries want to add permission to newly created application. Application could be then used for persistence or for further operation in the attacked infrastructure. Permissions like AppRoleAssignment.ReadWrite.All or RoleManagement.ReadWrite.Directory in particular can be a valuable target for a threat actor.
This technique will create a new app, with the provided name, and give it the provided permission. But if you prefer to add credentials to an existing app, replace in the code: "Get-AzureADApplication" instead of "New-AzureADServicePrincipal".
The DirectoryRecommendations.Read.All permissions has been selected as the default.

The account you use to run the PowerShell command should have Global Administrator/Application Administrator/Cloud Application Administrator role in your Azure AD.

Detection hint - check Operation Name "Add app role assignment to service principal" in subscriptions Activity Logs.
You can also take a look at the materials:
https://learnsentinel.blog/2022/01/04/azuread-privesc-sentinel/
https://github.com/reprise99/Sentinel-Queries
https://docs.google.com/presentation/d/1AWx1w0Xcq8ENvOmSjAJswEgEio-il09QWZlGg9PbHqE/edit#slide=id.g10460eb209c_0_2766
https://gist.github.com/andyrobbins/7c3dd62e6ed8678c97df9565ff3523fb

Pinned Atomic procedure · 94ea9cc3-81f9-4111-8dde-3fb54f36af4b · azure-ad · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• username: Azure AD username (type string; source default jonh@contoso.com)
• password: Azure AD password (type string; source default p4sswd)
• application_name: Name of the targeted application that will be created (type string; source default test_app)
• application_permission: Permission from Microsoft Graph Resource API that will be added to application (type string; source default DirectoryRecommendations.Read.All)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• AzureAD module must be installed.

Create a random atr-nnnnnnnn account and add it to a domain group (by default, Domain Admins).

The quickest way to run it is against a domain controller, using `-Session` of `Invoke-AtomicTest`. Alternatively,
you need to install PS Module ActiveDirectory (in prereqs) and run the script with appropriare AD privileges to
create the user and alter the group. Automatic installation of the dependency requires an elevated session,
and is unlikely to work with Powershell Core (untested).

If you consider running this test against a production Active Directory, the good practise is to create a dedicated
service account whose delegation is given onto a dedicated OU for user creation and deletion, as well as delegated
as group manager of the target group.

Example: `Invoke-AtomicTest -Session $session 'T1098' -TestNames "Domain Account and Group Manipulate" -InputArgs @{"group" = "DNSAdmins" }`

Pinned Atomic procedure · a55a22e9-a3d3-42ce-bd48-2653adb8f7a9 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• account_prefix: Prefix string of the random username (by default, atr-). Because the cleanup deletes such account based on a match `(&(samaccountname=#{account_prefix}-*)(givenName=Test))`, if you are to change it, be careful. (type string; source default atr-)
• group: Name of the group to alter (type string; source default Domain Admins)
• create_args: Additional string appended to New-ADUser call (type string; source default )

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• PS Module ActiveDirectory

Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was.

Pinned Atomic procedure · b299c120-44a7-4d68-b8e2-8ba5a28511ec · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• new_password: The password to set for the current domain user (default is long and has and lower case and special character and number but no uppercase) (type string; source default lower-long-special-333)
• cred_file: A file containing the password of the current user (type path; source default $env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Password for current user must be stored in a credential file

The adversaries want to add service principal to some Azure role, also called Azure resource role. Threat actor
may be interested primarily in highly privileged roles, e.g. Owner, Contributor.
By default, the role Reader is assigned to service principal in this test.

New-AzRoleAssignment cmdlet could be also use to assign user/service principal to resource, resource group and management group.

The account you use to run the PowerShell command must have Microsoft.Authorization/roleAssignments/write
(e.g. such as User Access Administrator or Owner) and the Azure Active Directory Graph Directory.Read.All
and Microsoft Graph Directory.Read.All permissions.

Detection hint - check Operation Name "Create role assignment" in subscriptions Activity Logs.

Pinned Atomic procedure · c8f4bc29-a151-48da-b3be-4680af56f404 · iaas:azure · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• username: Azure AD username (type string; source default jonh@contoso.com)
• password: Azure AD password (type string; source default p4sswd)
• service_principal_name: Name of the service principal (type string; source default SuperSP)
• role_name: Name of the targeted Azure role (type string; source default Reader)
• subscription: Name of the targeted subscription (type string; source default Azure subscription 1)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Az.Resources module must be installed.

Change the password on the Directory Service Restore Mode (DSRM) account using ntdsutil by syncing to existing account

Pinned Atomic procedure · d5b886d9-d1c7-4b6e-a7b0-460041bf2823 · windows · command_prompt.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• sync_account: Account to sync password from (type string; source default %username%)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.
If the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the
password policy will likely prevent you from setting the password back to what it was.

Pinned Atomic procedure · fc5f9414-bd67-4f5f-a08e-e5381e29cbd1 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• new_password: The password to set for the current domain user (default value is 7 characters) (type string; source default Uplow-1)
• cred_file: A file containing the password of the current user (type path; source default $env:LOCALAPPDATA\AtomicRedTeam\$env:USERNAME.txt)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Password for current user must be stored in a credential file

• M1018 User Account Management

  Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies.

• M1022 Restrict File and Directory Permissions

  Restrict access to potentially sensitive files that deal with authentication and/or authorization.

• M1026 Privileged Account Management

  Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

• M1028 Operating System Configuration

  Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.

• M1030 Network Segmentation

  Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.

• M1032 Multi-factor Authentication

  Use multi-factor authentication for user and privileged accounts.

• M1042 Disable or Remove Feature or Program

  Remove unnecessary and potentially abusable authentication and authorization mechanisms where possible.