Skip to content

Instantly share code, notes, and snippets.

View rc-MikeDevens's full-sized avatar

rc-MikeDevens

View GitHub Profile
@rc-MikeDevens
rc-MikeDevens / adfind-mimi.ps1
Last active August 19, 2022 22:31
PowerShell script to run Atomic Red Team tests for T1018 and T1003.001
# T1018 - Remote System Discovery
# Using AdFind (S0552)
$adfind_path = "$env:LOCALAPPDATA\adfind.exe"
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile $adfind_path
if (Test-Path $adfind_path) {
# Test #10 - Adfind - Enumerate Active Directory Computer Objects
$cmd = "`"$adfind_path`" -f (objectcategory=computer)"
cmd.exe /c $cmd
# Test #11 - Enumerate Active Directory Domain Controller Objects
$cmd = "`"$adfind_path`" -sc dclist"
@rc-MikeDevens
rc-MikeDevens / Windows LOLBAS FW Block.md
Last active September 4, 2022 05:09
Windows firewall rules to block LOLBAS

LOLBAS Firewall Block Rules

Many Windows binaries that can be abused by attackers to make undesired network connections do not need network connectivity for 'normal' functionality. With the Windows firewall, we can therefore create rules to block outbound network connections from these binaries as an additional layer of protection.

Note: Depending on your environment, these firewall rules may cause issues. Test before implementing.

These rules have been in place in my personal network without issue:

New-NetFirewallRule -DisplayName "regsvr32 block 1" -Group "LOLBAS Block" -Direction Outbound -Program "C:\Windows\System32\regsvr32.exe" -Action Block