attack_technique: T1562.006
display_name: 'Impair Defenses: Indicator Blocking'
atomic_tests:
- name: 'Auditing Configuration Changes on Linux Host'
  auto_generated_guid: 212cfbcf-4770-4980-bc21-303e37abd0e3
  description: |
    Emulates modification of auditd configuration files
  supported_platforms:
  - linux
  input_arguments:
    audisp_config_file_name:
      description: The name of the audispd configuration file to be changed
      type: String
      default: audispd.conf
    auditd_config_file_name:
      description: The name of the auditd configuration file to be changed
      type: String
      default: auditd.conf
    libaudit_config_file_name:
      description: The name of the libaudit configuration file to be changed
      type: String
      default: libaudit.conf
  executor:
    command: |
      sed -i '$ a #art_test_1562_006_1' /etc/audisp/#{audisp_config_file_name}
      if [ -f "/etc/#{auditd_config_file_name}" ];
      then sed -i '$ a #art_test_1562_006_1' /etc/#{auditd_config_file_name}
      else sed -i '$ a #art_test_1562_006_1' /etc/audit/#{auditd_config_file_name}
      fi 
      sed -i '$ a #art_test_1562_006_1' /etc/#{libaudit_config_file_name}
    cleanup_command: |
      sed -i '$ d' /etc/audisp/#{audisp_config_file_name}
      if [ -f "/etc/#{auditd_config_file_name}" ];
      then sed -i '$ d' /etc/#{auditd_config_file_name}
      else sed -i '$ d' /etc/audit/#{auditd_config_file_name}
      fi
      sed -i '$ d' /etc/#{libaudit_config_file_name}
    name: bash
    elevation_required: true
- name: 'Logging Configuration Changes on Linux Host'
  auto_generated_guid: 7d40bc58-94c7-4fbb-88d9-ebce9fcdb60c
  description: |
    Emulates modification of syslog configuration.
  supported_platforms:
  - linux
  input_arguments:
    syslog_config_file_name:
      description: The name of the syslog configuration file to be changed
      type: String
      default: syslog.conf
    rsyslog_config_file_name:
      description: The name of the rsyslog configuration file to be changed
      type: String
      default: rsyslog.conf
    syslog_ng_config_file_name:
      description: The name of the syslog-ng configuration file to be changed
      type: String
      default: syslog-ng.conf
  executor:
    command: |
      if [ -f "/etc/#{syslog_config_file_name}" ];
      then sed -i '$ a #art_test_1562_006_2' /etc/#{syslog_config_file_name}
      fi
      if [ -f "/etc/#{rsyslog_config_file_name}" ];
      then sed -i '$ a #art_test_1562_006_2' /etc/#{rsyslog_config_file_name}
      fi
      if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
      then sed -i '$ a #art_test_1562_006_2' /etc/syslog-ng/#{syslog_ng_config_file_name}
      fi
    cleanup_command: |
      if [ -f "/etc/#{syslog_config_file_name}" ];
      then sed -i '$ d' /etc/#{syslog_config_file_name}
      fi
      if [ -f "/etc/#{rsyslog_config_file_name}" ];
      then sed -i '$ d' /etc/#{rsyslog_config_file_name}
      fi
      if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
      then sed -i '$ d' /etc/syslog-ng/#{syslog_ng_config_file_name}
      fi
    name: bash
    elevation_required: true
