diff --git a/Vagrant/resources/GPO/disable_windows_defender/manifest.xml b/Vagrant/resources/GPO/disable_windows_defender/manifest.xml
deleted file mode 100755
index 2382df2a9..000000000
--- a/Vagrant/resources/GPO/disable_windows_defender/manifest.xml
+++ /dev/null
@@ -1 +0,0 @@
-
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/Backup.xml b/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/Backup.xml
deleted file mode 100755
index d5b772ce7..000000000
--- a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/Backup.xml
+++ /dev/null
@@ -1,18 +0,0 @@
-
- 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ab 78 eb 1f 41 dd b6 6b 45 1f 31 0d e8 03 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ab 78 eb 1f 41 dd b6 6b 45 1f 31 0d 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ab 78 eb 1f 41 dd b6 6b 45 1f 31 0d 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/registry.pol b/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/registry.pol
deleted file mode 100755
index 08a48aaaf..000000000
Binary files a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/registry.pol and /dev/null differ
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/bkupInfo.xml b/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/bkupInfo.xml
deleted file mode 100755
index 0e7c0a5ed..000000000
--- a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/bkupInfo.xml
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml
new file mode 100644
index 000000000..b376e3d03
--- /dev/null
+++ b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml
@@ -0,0 +1,18 @@
+
+ 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 8b 9d fe a6 56 fa 03 32 ec ac 2c 5e e8 03 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 8b 9d fe a6 56 fa 03 32 ec ac 2c 5e 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 8b 9d fe a6 56 fa 03 32 ec ac 2c 5e 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
new file mode 100644
index 000000000..2f2034cd8
--- /dev/null
+++ b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
@@ -0,0 +1,3 @@
+
+
+
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/comment.cmtx b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/comment.cmtx
old mode 100755
new mode 100644
similarity index 100%
rename from Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/comment.cmtx
rename to Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/comment.cmtx
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/registry.pol b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/registry.pol
new file mode 100644
index 000000000..dc337571f
Binary files /dev/null and b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/registry.pol differ
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml
new file mode 100644
index 000000000..6d0643d04
--- /dev/null
+++ b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml
@@ -0,0 +1 @@
+
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/gpreport.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/gpreport.xml
old mode 100755
new mode 100644
similarity index 53%
rename from Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/gpreport.xml
rename to Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/gpreport.xml
index 9a2740adc..86dd38461
Binary files a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/gpreport.xml and b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/gpreport.xml differ
diff --git a/Vagrant/resources/windows/Microsoft.PowerShell_profile.ps1 b/Vagrant/resources/windows/Microsoft.PowerShell_profile.ps1
index 0da238869..5d6b30db7 100644
--- a/Vagrant/resources/windows/Microsoft.PowerShell_profile.ps1
+++ b/Vagrant/resources/windows/Microsoft.PowerShell_profile.ps1
@@ -1,5 +1,3 @@
-Write-Host "Invoke-AtomicTest has been loaded."
-Write-Host "Learn more about atomic tests here: https://git.io/Jed0L"
-Write-Host ""
Import-Module "C:\Tools\Atomic Red Team\atomic-red-team-master\execution-frameworks\Invoke-AtomicRedTeam\Invoke-AtomicRedTeam\Invoke-AtomicRedTeam.psm1"
-$PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\Tools\Atomic Red Team\atomic-red-team-master\atomics"}
\ No newline at end of file
+$PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\Tools\Atomic Red Team\atomic-red-team-master\atomics"}
+$env:Path += ";c:\Program Files\osquery"
\ No newline at end of file
diff --git a/Vagrant/scripts/configure-disable-windows-defender-gpo.ps1 b/Vagrant/scripts/configure-disable-windows-defender-gpo.ps1
index fd5cf8470..793974288 100644
--- a/Vagrant/scripts/configure-disable-windows-defender-gpo.ps1
+++ b/Vagrant/scripts/configure-disable-windows-defender-gpo.ps1
@@ -1,4 +1,4 @@
-# Purpose: Install the GPO that disables Windows Defender
+# Purpose: Install the GPO that disables Windows Defender and AMSI
Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Importing the GPO to disable Windows Defender..."
Import-GPO -BackupGpoName 'Disable Windows Defender' -Path "c:\vagrant\resources\GPO\disable_windows_defender" -TargetName 'Disable Windows Defender' -CreateIfNeeded
diff --git a/Vagrant/scripts/install-evtx-attack-samples.ps1 b/Vagrant/scripts/install-evtx-attack-samples.ps1
index 71d987036..ef1734db1 100644
--- a/Vagrant/scripts/install-evtx-attack-samples.ps1
+++ b/Vagrant/scripts/install-evtx-attack-samples.ps1
@@ -67,7 +67,7 @@ sourcetype = preprocess-winevt'
} Catch {
Start-Sleep 10
Stop-Service -Name SplunkForwarder -Force
- Start-Service -Name SplunkForwarder -Force
+ Start-Service -Name SplunkForwarder
}
Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Done! Look in 'index=EVTX-ATTACK-SAMPLES' in Splunk to query these samples."
}
diff --git a/Vagrant/scripts/install-splunkuf.ps1 b/Vagrant/scripts/install-splunkuf.ps1
index ed9f15f5b..10659e044 100755
--- a/Vagrant/scripts/install-splunkuf.ps1
+++ b/Vagrant/scripts/install-splunkuf.ps1
@@ -2,17 +2,17 @@
If (-not (Test-Path "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe")) {
Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Downloading Splunk Universal Forwarder..."
- $msiFile = $env:Temp + "\splunkforwarder-7.1.0-2e75b3406c5b-x64-release.msi"
+ $msiFile = $env:Temp + "\splunkforwarder-8.1.0.1-24fd52428b5a-x64-release.msi"
Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Installing & Starting Splunk"
[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"
- (New-Object System.Net.WebClient).DownloadFile('https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=windows&version=7.1.0&product=universalforwarder&filename=splunkforwarder-7.1.0-2e75b3406c5b-x64-release.msi&wget=true', $msiFile)
- Start-Process -FilePath "c:\windows\system32\msiexec.exe" -ArgumentList '/i', "$msiFile", 'RECEIVING_INDEXER="192.168.38.105:9997" WINEVENTLOG_SEC_ENABLE=0 WINEVENTLOG_SYS_ENABLE=0 WINEVENTLOG_APP_ENABLE=0 AGREETOLICENSE=Yes SERVICESTARTTYPE=1 LAUNCHSPLUNK=1 SPLUNKPASSWORD=changeme /quiet' -Wait
-} Else {
+ (New-Object System.Net.WebClient).DownloadFile('https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=windows&version=8.1.0.1&product=universalforwarder&filename=splunkforwarder-8.1.0.1-24fd52428b5a-x64-release.msi&wget=true', $msiFile)
+ Start-Process -FilePath "c:\windows\system32\msiexec.exe" -ArgumentList '/i', "$msiFile", 'RECEIVING_INDEXER="192.168.38.105:9997" WINEVENTLOG_SEC_ENABLE=0 WINEVENTLOG_SYS_ENABLE=0 WINEVENTLOG_APP_ENABLE=0 AGREETOLICENSE=Yes SERVICESTARTTYPE=AUTO LAUNCHSPLUNK=1 SPLUNKPASSWORD=changeme /quiet' -Wait
+}
+Else {
Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Splunk is already installed. Moving on."
}
-If ((Get-Service -name splunkforwarder).Status -ne "Running")
-{
+If ((Get-Service -name splunkforwarder).Status -ne "Running") {
throw "Splunk forwarder service not running"
}
Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Splunk installation complete!"