GitHub Repo

Atomic Red Team

Date: 2020-10-09 ID: cc9b25e2-efc9-11eb-926b-550bf0943fbb Author: Patrick Bareiss Environment: attack_range Directory: atomic_red_team

Description

Atomic Test Results: Return value unclear for test T1136.001-3 Create a new user in a command prompt Successful Execution of test T1136.001-4 Create a new user in PowerShell Successful Execution of test T1136.001-6 Create a new Windows admin user

MITRE ATT&CK Techniques

ID Technique Tactic
T1136.001 Local Account Persistence

Environment Details

Field Value
Environment attack_range
Directory atomic_red_team
Test Date 2020-10-09

Datasets

The following datasets were collected during this attack simulation:

Windows-Xml

  • Path: /datasets/attack_techniques/T1136.001/atomic_red_team/windows-xml.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Security

Windows-Sysmon-Esxadmins

  • Path: /datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-esxadmins.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

Windows-Sysmon

  • Path: /datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

Windows-Powershell-Esxadmins

  • Path: /datasets/attack_techniques/T1136.001/atomic_red_team/windows-powershell-esxadmins.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational

Xml-Windows-Security

  • Path: /datasets/attack_techniques/T1136.001/atomic_red_team/xml-windows-security.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Security

Windows-Security-Esxadmins

  • Path: /datasets/attack_techniques/T1136.001/atomic_red_team/windows-security-esxadmins.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Security

The following detections in our security content repository use this attack data for testing:

Detection Name Type Source MITRE ATT&CK Analytic Story
Windows ESX Admins Group Creation Security Event TTP Endpoint T1136.001, T1136.002 VMware ESXi AD Integration Authentication Bypass CVE-2024-37085
Windows Privileged Group Modification TTP Endpoint T1136.001, T1136.002 VMware ESXi AD Integration Authentication Bypass CVE-2024-37085, Scattered Lapsus$ Hunters
Detect New Local Admin account TTP Endpoint T1136.001 DHS Report TA18-074A, HAFNIUM Group, CISA AA22-257A, CISA AA24-241A, Scattered Lapsus$ Hunters
Short Lived Windows Accounts TTP Endpoint T1078.003, T1136.001 Active Directory Lateral Movement, GhostRedirector IIS Module and Rungan Backdoor
Windows Create Local Administrator Account Via Net Anomaly Endpoint T1136.001 DHS Report TA18-074A, CISA AA22-257A, Medusa Ransomware, CISA AA24-241A, Azorult, DarkGate Malware, GhostRedirector IIS Module and Rungan Backdoor, Scattered Lapsus$ Hunters
Windows Create Local Account Anomaly Endpoint T1136.001 Active Directory Password Spraying, CISA AA24-241A, GhostRedirector IIS Module and Rungan Backdoor, Scattered Lapsus$ Hunters
Windows ESX Admins Group Creation via PowerShell TTP Endpoint T1136.002, T1136.001 VMware ESXi AD Integration Authentication Bypass CVE-2024-37085
Windows ESX Admins Group Creation via Net TTP Endpoint T1136.002, T1136.001 VMware ESXi AD Integration Authentication Bypass CVE-2024-37085

Usage Instructions

Replay with Splunk Attack Data

Replay attack data with replay.py from Splunk Attack Data.

1python replay.py --dataset /datasets/attack_techniques/T1136.001/atomic_red_team/windows-xml.log --index attack_data

Manual Import

  1. Download the dataset files from the paths listed above
  2. Configure your Splunk instance with the appropriate sourcetypes
  3. Import the logs using the Splunk Add Data wizard

Related Content

Find more detections and analytics for this attack technique in our security content repository.

Source: GitHub | Version: 1.0