Generated docs from job=generate-docs branch=master [ci skip]
This commit is contained in:
Atomic Red Team doc generator
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -735,6 +735,11 @@ execution,T1059.004,Command and Scripting Interpreter: Bash,8,Command line scrip
|
||||
execution,T1059.004,Command and Scripting Interpreter: Bash,9,Obfuscated command line scripts,5bec4cc8-f41e-437b-b417-33ff60acf9af,sh
|
||||
execution,T1059.004,Command and Scripting Interpreter: Bash,10,Change login shell,c7ac59cb-13cc-4622-81dc-6d2fee9bfac7,bash
|
||||
execution,T1059.004,Command and Scripting Interpreter: Bash,11,Environment variable scripts,bdaebd56-368b-4970-a523-f905ff4a8a51,bash
|
||||
execution,T1559,Inter-Process Communication,1,Cobalt Strike Artifact Kit pipe,bd13b9fc-b758-496a-b81a-397462f82c72,command_prompt
|
||||
execution,T1559,Inter-Process Communication,2,Cobalt Strike Lateral Movement (psexec_psh) pipe,830c8b6c-7a70-4f40-b975-8bbe74558acd,command_prompt
|
||||
execution,T1559,Inter-Process Communication,3,Cobalt Strike SSH (postex_ssh) pipe,d1f72fa0-5bc2-4b4b-bd1e-43b6e8cfb2e6,command_prompt
|
||||
execution,T1559,Inter-Process Communication,4,Cobalt Strike post-exploitation pipe (4.2 and later),7a48f482-246f-4aeb-9837-21c271ebf244,command_prompt
|
||||
execution,T1559,Inter-Process Communication,5,Cobalt Strike post-exploitation pipe (before 4.2),8dbfc15c-527b-4ab0-a272-019f469d367f,command_prompt
|
||||
execution,T1059.006,Command and Scripting Interpreter: Python,1,Execute shell script via python's command mode arguement,3a95cdb2-c6ea-4761-b24e-02b71889b8bb,sh
|
||||
execution,T1059.006,Command and Scripting Interpreter: Python,2,Execute Python via scripts (Linux),6c4d1dcb-33c7-4c36-a8df-c6cfd0408be8,sh
|
||||
execution,T1059.006,Command and Scripting Interpreter: Python,3,Execute Python via Python executables (Linux),0b44d79b-570a-4b27-a31f-3bf2156e5eaa,sh
|
||||
|
||||
|
@@ -534,6 +534,11 @@ execution,T1059.001,Command and Scripting Interpreter: PowerShell,19,PowerShell
|
||||
execution,T1059.001,Command and Scripting Interpreter: PowerShell,20,PowerShell Invoke Known Malicious Cmdlets,49eb9404-5e0f-4031-a179-b40f7be385e3,powershell
|
||||
execution,T1059.001,Command and Scripting Interpreter: PowerShell,21,PowerUp Invoke-AllChecks,1289f78d-22d2-4590-ac76-166737e1811b,powershell
|
||||
execution,T1059.001,Command and Scripting Interpreter: PowerShell,22,Abuse Nslookup with DNS Records,999bff6d-dc15-44c9-9f5c-e1051bfc86e1,powershell
|
||||
execution,T1559,Inter-Process Communication,1,Cobalt Strike Artifact Kit pipe,bd13b9fc-b758-496a-b81a-397462f82c72,command_prompt
|
||||
execution,T1559,Inter-Process Communication,2,Cobalt Strike Lateral Movement (psexec_psh) pipe,830c8b6c-7a70-4f40-b975-8bbe74558acd,command_prompt
|
||||
execution,T1559,Inter-Process Communication,3,Cobalt Strike SSH (postex_ssh) pipe,d1f72fa0-5bc2-4b4b-bd1e-43b6e8cfb2e6,command_prompt
|
||||
execution,T1559,Inter-Process Communication,4,Cobalt Strike post-exploitation pipe (4.2 and later),7a48f482-246f-4aeb-9837-21c271ebf244,command_prompt
|
||||
execution,T1559,Inter-Process Communication,5,Cobalt Strike post-exploitation pipe (before 4.2),8dbfc15c-527b-4ab0-a272-019f469d367f,command_prompt
|
||||
execution,T1059.003,Command and Scripting Interpreter: Windows Command Shell,1,Create and Execute Batch Script,9e8894c0-50bd-4525-a96c-d4ac78ece388,powershell
|
||||
execution,T1059.003,Command and Scripting Interpreter: Windows Command Shell,2,Writes text to a file and displays it.,127b4afe-2346-4192-815c-69042bec570e,command_prompt
|
||||
execution,T1059.003,Command and Scripting Interpreter: Windows Command Shell,3,Suspicious Execution via Windows Command Shell,d0eb3597-a1b3-4d65-b33b-2cda8d397f20,command_prompt
|
||||
|
||||
|
@@ -1119,7 +1119,12 @@
|
||||
- Atomic Test #9: Obfuscated command line scripts [linux]
|
||||
- Atomic Test #10: Change login shell [linux]
|
||||
- Atomic Test #11: Environment variable scripts [linux]
|
||||
- T1559 Inter-Process Communication [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1559 Inter-Process Communication](../../T1559/T1559.md)
|
||||
- Atomic Test #1: Cobalt Strike Artifact Kit pipe [windows]
|
||||
- Atomic Test #2: Cobalt Strike Lateral Movement (psexec_psh) pipe [windows]
|
||||
- Atomic Test #3: Cobalt Strike SSH (postex_ssh) pipe [windows]
|
||||
- Atomic Test #4: Cobalt Strike post-exploitation pipe (4.2 and later) [windows]
|
||||
- Atomic Test #5: Cobalt Strike post-exploitation pipe (before 4.2) [windows]
|
||||
- T1204.003 Malicious Image [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1154 Trap [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
|
||||
@@ -815,7 +815,12 @@
|
||||
- Atomic Test #22: Abuse Nslookup with DNS Records [windows]
|
||||
- T1170 Mshta [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1061 Graphical User Interface [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1559 Inter-Process Communication [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1559 Inter-Process Communication](../../T1559/T1559.md)
|
||||
- Atomic Test #1: Cobalt Strike Artifact Kit pipe [windows]
|
||||
- Atomic Test #2: Cobalt Strike Lateral Movement (psexec_psh) pipe [windows]
|
||||
- Atomic Test #3: Cobalt Strike SSH (postex_ssh) pipe [windows]
|
||||
- Atomic Test #4: Cobalt Strike post-exploitation pipe (4.2 and later) [windows]
|
||||
- Atomic Test #5: Cobalt Strike post-exploitation pipe (before 4.2) [windows]
|
||||
- T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1028 Windows Remote Management [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1059.006 Command and Scripting Interpreter: Python [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
|
||||
@@ -39,7 +39,7 @@
|
||||
| | [Scheduled Task/Job: Systemd Timers](../../T1053.006/T1053.006.md) | Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Escape to Host](../../T1611/T1611.md) | [Indicator Removal on Host: Clear Linux or Mac System Logs](../../T1070.002/T1070.002.md) | [Brute Force: Password Spraying](../../T1110.003/T1110.003.md) | System Location Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | SNMP (MIB Dump) [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | Uncommonly Used Port [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | Graphical User Interface [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Login Item [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Boot or Logon Autostart Execution: Shortcut Modification](../../T1547.009/T1547.009.md) | [Signed Binary Proxy Execution: InstallUtil](../../T1218.004/T1218.004.md) | Web Portal Capture [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Software Discovery: Security Software Discovery](../../T1518.001/T1518.001.md) | | [Input Capture: Credential API Hooking](../../T1056.004/T1056.004.md) | | Domain Fronting [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | [Command and Scripting Interpreter: Bash](../../T1059.004/T1059.004.md) | [Modify Authentication Process: Password Filter DLL](../../T1556.002/T1556.002.md) | AppCert DLLs [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Disabling Security Tools [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [OS Credential Dumping: Cached Domain Credentials](../../T1003.005/T1003.005.md) | [Cloud Service Discovery](../../T1526/T1526.md) | | | | Data Encoding [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | Inter-Process Communication [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Terminal Services DLL [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Boot or Logon Autostart Execution: Security Support Provider](../../T1547.005/T1547.005.md) | [Hijack Execution Flow: DLL Search Order Hijacking](../../T1574.001/T1574.001.md) | [Steal or Forge Kerberos Tickets: Golden Ticket](../../T1558.001/T1558.001.md) | [Remote System Discovery](../../T1018/T1018.md) | | | | Non-Standard Encoding [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | [Inter-Process Communication](../../T1559/T1559.md) | Terminal Services DLL [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Boot or Logon Autostart Execution: Security Support Provider](../../T1547.005/T1547.005.md) | [Hijack Execution Flow: DLL Search Order Hijacking](../../T1574.001/T1574.001.md) | [Steal or Forge Kerberos Tickets: Golden Ticket](../../T1558.001/T1558.001.md) | [Remote System Discovery](../../T1018/T1018.md) | | | | Non-Standard Encoding [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | Malicious Image [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Browser Extensions](../../T1176/T1176.md) | Extra Window Memory Injection [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Subvert Trust Controls: Gatekeeper Bypass](../../T1553.001/T1553.001.md) | [Unsecured Credentials: Bash History](../../T1552.003/T1552.003.md) | [Network Service Scanning](../../T1046/T1046.md) | | | | [Application Layer Protocol: Web Protocols](../../T1071.001/T1071.001.md) | |
|
||||
| | Trap [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Service Registry Permissions Weakness [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Create or Modify System Process: Launch Daemon](../../T1543.004/T1543.004.md) | Code Signing [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Unsecured Credentials: Credentials In Files](../../T1552.001/T1552.001.md) | [Software Discovery](../../T1518/T1518.md) | | | | [Ingress Tool Transfer](../../T1105/T1105.md) | |
|
||||
| | Exploitation for Client Execution [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Outlook Rules [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Hijack Execution Flow: Path Interception by Search Order Hijacking](../../T1574.008/T1574.008.md) | [File and Directory Permissions Modification: Windows File and Directory Permissions Modification](../../T1222.001/T1222.001.md) | Web Cookies [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Cloud Service Dashboard [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | Steganography [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
|
||||
@@ -24,7 +24,7 @@
|
||||
| [Valid Accounts: Local Accounts](../../T1078.003/T1078.003.md) | [Command and Scripting Interpreter: PowerShell](../../T1059.001/T1059.001.md) | AppInit DLLs [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Thread Execution Hijacking](../../T1055.003/T1055.003.md) | Regsvcs/Regasm [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Private Keys [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Domain Trust Discovery](../../T1482/T1482.md) | Windows Remote Management [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Web Portal Capture [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | Web Service [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Endpoint Denial of Service [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| | Mshta [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Office Application Startup: Add-ins](../../T1137.006/T1137.006.md) | [Event Triggered Execution: Application Shimming](../../T1546.011/T1546.011.md) | [Hide Artifacts](../../T1564/T1564.md) | [Credentials from Password Stores: Credentials from Web Browsers](../../T1555.003/T1555.003.md) | [File and Directory Discovery](../../T1083/T1083.md) | [Remote Service Session Hijacking: RDP Hijacking](../../T1563.002/T1563.002.md) | [Video Capture](../../T1125/T1125.md) | | DNS Calculation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Runtime Data Manipulation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| | Graphical User Interface [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Server Software Component: Transport Agent](../../T1505.002/T1505.002.md) | [Boot or Logon Autostart Execution: Port Monitors](../../T1547.010/T1547.010.md) | Domain Trust Modification [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | DHCP Spoofing [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [System Network Connections Discovery](../../T1049/T1049.md) | [Use Alternate Authentication Material: Pass the Hash](../../T1550.002/T1550.002.md) | Email Collection: Email Forwarding Rule [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | Multi-Stage Channels [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Transmitted Data Manipulation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| | Inter-Process Communication [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Process Injection](../../T1055/T1055.md) | Safe Mode Boot [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Unsecured Credentials: Private Keys](../../T1552.004/T1552.004.md) | Virtualization/Sandbox Evasion [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Remote Services: Remote Desktop Protocol](../../T1021.001/T1021.001.md) | Data Staged [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | Port Knocking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Resource Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| | [Inter-Process Communication](../../T1559/T1559.md) | Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Process Injection](../../T1055/T1055.md) | Safe Mode Boot [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Unsecured Credentials: Private Keys](../../T1552.004/T1552.004.md) | Virtualization/Sandbox Evasion [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Remote Services: Remote Desktop Protocol](../../T1021.001/T1021.001.md) | Data Staged [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | Port Knocking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Resource Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| | Exploitation for Client Execution [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Modify Authentication Process: Password Filter DLL](../../T1556.002/T1556.002.md) | DLL Search Order Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Virtualization/Sandbox Evasion: System Checks](../../T1497.001/T1497.001.md) | [Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay](../../T1557.001/T1557.001.md) | [Process Discovery](../../T1057/T1057.md) | Windows Admin Shares [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Input Capture: GUI Input Capture](../../T1056.002/T1056.002.md) | | Multiband Communication [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Transmitted Data Manipulation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| | Windows Remote Management [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Terminal Services DLL [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | New Service [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Signed Binary Proxy Execution: InstallUtil](../../T1218.004/T1218.004.md) | [OS Credential Dumping: LSASS Memory](../../T1003.001/T1003.001.md) | User Activity Based Checks [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | [Data from Network Shared Drive](../../T1039/T1039.md) | | File Transfer Protocols [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Data Destruction](../../T1485/T1485.md) |
|
||||
| | Command and Scripting Interpreter: Python [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Browser Extensions](../../T1176/T1176.md) | Escape to Host [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Disabling Security Tools [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Hooking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Permission Groups Discovery: Local Groups](../../T1069.001/T1069.001.md) | | Remote Email Collection [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | One-Way Communication [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Network Denial of Service [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
|
||||
@@ -27610,6 +27610,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -27860,6 +27860,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -27522,6 +27522,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -27418,6 +27418,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -27561,6 +27561,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -27596,6 +27596,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -27522,6 +27522,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
+152
-1
@@ -47905,7 +47905,158 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
atomic_tests: []
|
||||
identifier: T1559
|
||||
atomic_tests:
|
||||
- name: Cobalt Strike Artifact Kit pipe
|
||||
auto_generated_guid: bd13b9fc-b758-496a-b81a-397462f82c72
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
1
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
- name: Cobalt Strike Lateral Movement (psexec_psh) pipe
|
||||
auto_generated_guid: 830c8b6c-7a70-4f40-b975-8bbe74558acd
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
2
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
- name: Cobalt Strike SSH (postex_ssh) pipe
|
||||
auto_generated_guid: d1f72fa0-5bc2-4b4b-bd1e-43b6e8cfb2e6
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
3
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
- name: Cobalt Strike post-exploitation pipe (4.2 and later)
|
||||
auto_generated_guid: 7a48f482-246f-4aeb-9837-21c271ebf244
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
4
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
- name: Cobalt Strike post-exploitation pipe (before 4.2)
|
||||
auto_generated_guid: 8dbfc15c-527b-4ab0-a272-019f469d367f
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
5
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
T1204.003:
|
||||
technique:
|
||||
x_mitre_platforms:
|
||||
|
||||
@@ -31105,6 +31105,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -29873,6 +29873,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -27503,6 +27503,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -27418,6 +27418,7 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
identifier: T1559
|
||||
atomic_tests: []
|
||||
T1204.003:
|
||||
technique:
|
||||
|
||||
@@ -42211,7 +42211,158 @@ execution:
|
||||
- User
|
||||
- SYSTEM
|
||||
x_mitre_remote_support: true
|
||||
atomic_tests: []
|
||||
identifier: T1559
|
||||
atomic_tests:
|
||||
- name: Cobalt Strike Artifact Kit pipe
|
||||
auto_generated_guid: bd13b9fc-b758-496a-b81a-397462f82c72
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
1
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
- name: Cobalt Strike Lateral Movement (psexec_psh) pipe
|
||||
auto_generated_guid: 830c8b6c-7a70-4f40-b975-8bbe74558acd
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
2
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
- name: Cobalt Strike SSH (postex_ssh) pipe
|
||||
auto_generated_guid: d1f72fa0-5bc2-4b4b-bd1e-43b6e8cfb2e6
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
3
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
- name: Cobalt Strike post-exploitation pipe (4.2 and later)
|
||||
auto_generated_guid: 7a48f482-246f-4aeb-9837-21c271ebf244
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
4
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
- name: Cobalt Strike post-exploitation pipe (before 4.2)
|
||||
auto_generated_guid: 8dbfc15c-527b-4ab0-a272-019f469d367f
|
||||
description: |
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
supported_platforms:
|
||||
- windows
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Named pipe executors must exist on disk
|
||||
|
||||
'
|
||||
prereq_command: 'if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe)
|
||||
-and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe))
|
||||
{exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe
|
||||
5
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
T1204.003:
|
||||
technique:
|
||||
x_mitre_platforms:
|
||||
|
||||
@@ -0,0 +1,244 @@
|
||||
# T1559 - Inter-Process Communication
|
||||
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1559)
|
||||
<blockquote>Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.
|
||||
|
||||
Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)</blockquote>
|
||||
|
||||
## Atomic Tests
|
||||
|
||||
- [Atomic Test #1 - Cobalt Strike Artifact Kit pipe](#atomic-test-1---cobalt-strike-artifact-kit-pipe)
|
||||
|
||||
- [Atomic Test #2 - Cobalt Strike Lateral Movement (psexec_psh) pipe](#atomic-test-2---cobalt-strike-lateral-movement-psexec_psh-pipe)
|
||||
|
||||
- [Atomic Test #3 - Cobalt Strike SSH (postex_ssh) pipe](#atomic-test-3---cobalt-strike-ssh-postex_ssh-pipe)
|
||||
|
||||
- [Atomic Test #4 - Cobalt Strike post-exploitation pipe (4.2 and later)](#atomic-test-4---cobalt-strike-post-exploitation-pipe-42-and-later)
|
||||
|
||||
- [Atomic Test #5 - Cobalt Strike post-exploitation pipe (before 4.2)](#atomic-test-5---cobalt-strike-post-exploitation-pipe-before-42)
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
## Atomic Test #1 - Cobalt Strike Artifact Kit pipe
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** bd13b9fc-b758-496a-b81a-397462f82c72
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `command_prompt`!
|
||||
|
||||
|
||||
```cmd
|
||||
"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe 1
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `powershell`!
|
||||
##### Description: Named pipe executors must exist on disk
|
||||
##### Check Prereq Commands:
|
||||
```powershell
|
||||
if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe)) {exit 0} else {exit 1}
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```powershell
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #2 - Cobalt Strike Lateral Movement (psexec_psh) pipe
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** 830c8b6c-7a70-4f40-b975-8bbe74558acd
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `command_prompt`!
|
||||
|
||||
|
||||
```cmd
|
||||
"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe 2
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `powershell`!
|
||||
##### Description: Named pipe executors must exist on disk
|
||||
##### Check Prereq Commands:
|
||||
```powershell
|
||||
if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe)) {exit 0} else {exit 1}
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```powershell
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #3 - Cobalt Strike SSH (postex_ssh) pipe
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** d1f72fa0-5bc2-4b4b-bd1e-43b6e8cfb2e6
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `command_prompt`!
|
||||
|
||||
|
||||
```cmd
|
||||
"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe 3
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `powershell`!
|
||||
##### Description: Named pipe executors must exist on disk
|
||||
##### Check Prereq Commands:
|
||||
```powershell
|
||||
if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe)) {exit 0} else {exit 1}
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```powershell
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #4 - Cobalt Strike post-exploitation pipe (4.2 and later)
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** 7a48f482-246f-4aeb-9837-21c271ebf244
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `command_prompt`!
|
||||
|
||||
|
||||
```cmd
|
||||
"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe 4
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `powershell`!
|
||||
##### Description: Named pipe executors must exist on disk
|
||||
##### Check Prereq Commands:
|
||||
```powershell
|
||||
if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe)) {exit 0} else {exit 1}
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```powershell
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #5 - Cobalt Strike post-exploitation pipe (before 4.2)
|
||||
Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
|
||||
|
||||
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** 8dbfc15c-527b-4ab0-a272-019f469d367f
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `command_prompt`!
|
||||
|
||||
|
||||
```cmd
|
||||
"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe 5
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `powershell`!
|
||||
##### Description: Named pipe executors must exist on disk
|
||||
##### Check Prereq Commands:
|
||||
```powershell
|
||||
if ((Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_client.exe) -and (Test-Path PathToAtomicsFolder\T1559\bin\build\namedpipes_server.exe)) {exit 0} else {exit 1}
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```powershell
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
||||
$zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
|
||||
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\T1559\bin"
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
Reference in New Issue
Block a user