SecFrame

https://secframe.com/docs/
Admin
SecFrame provides comprehensive security guidance, best practices, and tooling for cloud...
Tokens:6,996
Snippets:118
Trust Score:7.1
Update:1 month ago
Show doc for...
Tokens:
Raw
### Initialize PAW OU Variables

Source: https://secframe.com/docs/ramp/phase1/paws/paws_admin_ou

Retrieves the current working directory, domain name, and default naming context for use in OU creation scripts.

```powershell
#Get current working directory
$sLocation = Get-Location

$DomainName = (Get-ADDomain).Name
$sDSE = (Get-ADRootDSE).defaultNamingContext

#$sPath = ("OU="+ $DomainName + " Objects," + $($sDSE))
```

--------------------------------

### Create Base Organizational Units

Source: https://secframe.com/docs/ramp/phase1/paws/paws_admin_ou

Commands to create the top-level organizational units for the domain structure.

```powershell
New-ADOrganizationalUnit -Name "Admin" -Path "$sDSE"
```

```powershell
New-ADOrganizationalUnit -Name "Groups" -Path "$sDSE"
```

```powershell
New-ADOrganizationalUnit -Name "Tier 1 Servers" -Path "$sDSE"
```

```powershell
New-ADOrganizationalUnit -Name "Workstations" -Path "$sDSE"
```

```powershell
New-ADOrganizationalUnit -Name "User Accounts" -Path "$sDSE"
```

```powershell
New-ADOrganizationalUnit -Name "Computer Quarantine" -Path "$sDSE"
```

--------------------------------

### Execute BadBlood PowerShell Script

Source: https://secframe.com/docs/badblood/whatisbadblood

Run the primary script from the root of the repository to begin the domain population process.

```powershell
./badblood/invoke-badblood.ps1
```

--------------------------------

### Create Tiered Admin Sub-OUs

Source: https://secframe.com/docs/ramp/phase1/paws/paws_admin_ou

Commands to create nested organizational units under the Admin OU for tiered object management.

```powershell
New-ADOrganizationalUnit -Name "Tier 0" -Path ("OU=Admin,$sDSE")
```

```powershell
New-ADOrganizationalUnit -Name "Tier 1" -Path ("OU=Admin,$sDSE")
```

```powershell
New-ADOrganizationalUnit -Name "Tier 2" -Path ("OU=Admin,$sDSE")
```

--------------------------------

### Configure and Execute SAML-based STS Credentials

Source: https://secframe.com/docs/aws_security/iam/sts_powershell

Load the Get-STSSAMLCred function into memory and execute it to generate temporary credentials. The -sethost parameter applies the credentials to the current PowerShell session.

```powershell
Get-stssamlcred -sethost
```

```powershell
Get-stssamlcred
```

```powershell
Get-STSSAMLCred -ChangeUser
```

--------------------------------

### Query Active Directory Schema Class Attributes

Source: https://secframe.com/docs/ramp/phase1/admin_accts/tier0admins/accountoperators

Use this script to retrieve the auxiliary classes and attribute properties for a specified schema class. Ensure you have the Active Directory module loaded.

```powershell
$schemaclass = “user”

$s = Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -Filter {name -like "$schemaclass"} -Properties MayContain,SystemMayContain

$s.auxiliaryclass

$s.maycontain

$s.systemmaycontain
```

--------------------------------

### Export Schema Objects

Source: https://secframe.com/docs/ramp/phase1/admin_accts/tier0admins/accountoperators

Retrieves all schema objects from the domain and stores them in a variable for subsequent analysis.

```PowerShell
#get schema root path with this
$schemaPath = (Get-ADRootDSE)
#Export all schema objects (and their properties) and store it as $schemaobjects
$schemaobjects = Get-ADObject -SearchBase ($schemaPath.SchemaNamingContext) -LDAPFilter ` "(schemaidguid=*)" -Properties *
#The above code should store around ~5000 objects into the $schemaobjects variable
```

--------------------------------

### Query User Subclasses

Source: https://secframe.com/docs/ramp/phase1/admin_accts/tier0admins/accountoperators

Filters the previously exported schema objects to find all objects that are subclasses of 'user'.

```PowerShell
$usersubclass = $schemaobjects |Where-Object -Property subclassof -eq 'user'|select cn,subclassof

$usersubclass
```

--------------------------------

### Check Subclass Relationships

Source: https://secframe.com/docs/ramp/phase1/admin_accts/tier0admins/accountoperators

Identifies the parent classes for 'user' and 'group' objects within the schema.

```PowerShell
$ObjsToCheck = @('user','group')

foreach($obj in $ObjsToCheck){

$schemaobjects |where-Object -Property CN -eq $obj|select cn,subclassof }
```

--------------------------------

### Retrieve S3 Bucket Owner Display Names

Source: https://secframe.com/docs/aws_security/iam/startingwithroot

Uses Boto3 to list S3 buckets and retrieve the display name of the owner for each bucket via ACLs.

```python
import boto3  
  
session = boto3.Session(profile_name='ariancho')  
s3_client = session.client('s3')  
  
display_name = s3_client.list_buckets()['Owner']['DisplayName']  
print(display_name)  
  
for bucket in s3_client.list_buckets()['Buckets']:  
 print(s3_client.get_bucket_acl(Bucket=bucket['Name'])['Owner']['DisplayName'])
```

--------------------------------

### Update Active Directory Schema for LAPS

Source: https://secframe.com/docs/ramp/phase1/laps/install_laps

A PowerShell function to copy LAPS modules and templates, import the module, update the schema, and set computer self-permissions.

```powershell
function Get-ScriptDirectory {
    Split-Path -Parent $PSCommandPath
}
$scriptPath = Get-ScriptDirectory

copy-item -path ($scriptpath + "\admpwd.ps") -destination "C:\Windows\System32\WindowsPowerShell\v1.0\Modules"
get-childitem -path ($scriptpath + "\admpwd.ps") -recurse |Foreach-object {
    Copy-item -literalpath $_.fullname -destination "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\admpwd.ps"
}
copy-item -path ($scriptpath + "\AdmPwd.admx") -destination "C:\Windows\PolicyDefinitions"
copy-item -path ($scriptpath + "\AdmPwd.adml") -destination "C:\Windows\PolicyDefinitions\en-US"

Import-Module ADMPwd.ps
Update-AdmPwdADSchema
Set-AdmPwdComputerSelfPermission -OrgUnit (Get-ADDomain).distinguishedname
```

--------------------------------

### Find AWS Canonical User ID

Source: https://secframe.com/docs/aws_security/iam/startingwithroot

Retrieves the unique owner ID for S3 objects across all buckets in a specified region using PowerShell.

```powershell
$buckets = get-s3bucket
$region = 'us-east-1'
$objects = $buckets| %{Get-S3Object -BucketName $_.bucketName -region $region}
($objects |select-object -property owner -unique).owner.id
```
Tokens:
Raw