diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index da645364..c2ba1b23 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -197,6 +197,10 @@ defense-evasion,T1112,Modify Registry,31,Windows Modify Show Compress Color And defense-evasion,T1112,Modify Registry,32,Windows Powershell Logging Disabled,95b25212-91a7-42ff-9613-124aca6845a8,command_prompt defense-evasion,T1112,Modify Registry,33,Windows Add Registry Value to Load Service in Safe Mode without Network,1dd59fb3-1cb3-4828-805d-cf80b4c3bbb5,command_prompt defense-evasion,T1112,Modify Registry,34,Windows Add Registry Value to Load Service in Safe Mode with Network,c173c948-65e5-499c-afbe-433722ed5bd4,command_prompt +defense-evasion,T1112,Modify Registry,35,Disable Windows Toast Notifications,003f466a-6010-4b15-803a-cbb478a314d7,command_prompt +defense-evasion,T1112,Modify Registry,36,Disable Windows Security Center Notifications,45914594-8df6-4ea9-b3cc-7eb9321a807e,command_prompt +defense-evasion,T1112,Modify Registry,37,Suppress Win Defender Notifications,c30dada3-7777-4590-b970-dc890b8cf113,command_prompt +defense-evasion,T1112,Modify Registry,38,Allow RDP Remote Assistance Feature,86677d0e-0b5e-4a2b-b302-454175f9aa9e,command_prompt defense-evasion,T1027.001,Binary Padding,1,Pad Binary to Change Hash - Linux/macOS dd,ffe2346c-abd5-4b45-a713-bf5f1ebd573a,sh defense-evasion,T1078.001,Default Accounts,1,Enable Guest account with RDP capability and admin privileges,99747561-ed8d-47f2-9c91-1e5fde1ed6e0,command_prompt defense-evasion,T1078.001,Default Accounts,2,Activate Guest Account,aa6cb8c4-b582-4f8e-b677-37733914abda,command_prompt diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv index 3e1590a2..6967ae8f 100644 --- a/atomics/Indexes/Indexes-CSV/windows-index.csv +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -147,6 +147,10 @@ defense-evasion,T1112,Modify Registry,31,Windows Modify Show Compress Color And defense-evasion,T1112,Modify Registry,32,Windows Powershell Logging Disabled,95b25212-91a7-42ff-9613-124aca6845a8,command_prompt defense-evasion,T1112,Modify Registry,33,Windows Add Registry Value to Load Service in Safe Mode without Network,1dd59fb3-1cb3-4828-805d-cf80b4c3bbb5,command_prompt defense-evasion,T1112,Modify Registry,34,Windows Add Registry Value to Load Service in Safe Mode with Network,c173c948-65e5-499c-afbe-433722ed5bd4,command_prompt +defense-evasion,T1112,Modify Registry,35,Disable Windows Toast Notifications,003f466a-6010-4b15-803a-cbb478a314d7,command_prompt +defense-evasion,T1112,Modify Registry,36,Disable Windows Security Center Notifications,45914594-8df6-4ea9-b3cc-7eb9321a807e,command_prompt +defense-evasion,T1112,Modify Registry,37,Suppress Win Defender Notifications,c30dada3-7777-4590-b970-dc890b8cf113,command_prompt +defense-evasion,T1112,Modify Registry,38,Allow RDP Remote Assistance Feature,86677d0e-0b5e-4a2b-b302-454175f9aa9e,command_prompt defense-evasion,T1078.001,Default Accounts,1,Enable Guest account with RDP capability and admin privileges,99747561-ed8d-47f2-9c91-1e5fde1ed6e0,command_prompt defense-evasion,T1078.001,Default Accounts,2,Activate Guest Account,aa6cb8c4-b582-4f8e-b677-37733914abda,command_prompt defense-evasion,T1070.001,Clear Windows Event Logs,1,Clear Logs,e6abb60e-26b8-41da-8aae-0c35174b0967,command_prompt diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index 67da98c6..b18ab96f 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -272,6 +272,10 @@ - Atomic Test #32: Windows Powershell Logging Disabled [windows] - Atomic Test #33: Windows Add Registry Value to Load Service in Safe Mode without Network [windows] - Atomic Test #34: Windows Add Registry Value to Load Service in Safe Mode with Network [windows] + - Atomic Test #35: Disable Windows Toast Notifications [windows] + - Atomic Test #36: Disable Windows Security Center Notifications [windows] + - Atomic Test #37: Suppress Win Defender Notifications [windows] + - Atomic Test #38: Allow RDP Remote Assistance Feature [windows] - T1574.008 Path Interception by Search Order Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1535 Unused/Unsupported Cloud Regions [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1027.001 Binary Padding](../../T1027.001/T1027.001.md) diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md index 9ac99d6d..8d45c717 100644 --- a/atomics/Indexes/Indexes-Markdown/windows-index.md +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -205,6 +205,10 @@ - Atomic Test #32: Windows Powershell Logging Disabled [windows] - Atomic Test #33: Windows Add Registry Value to Load Service in Safe Mode without Network [windows] - Atomic Test #34: Windows Add Registry Value to Load Service in Safe Mode with Network [windows] + - Atomic Test #35: Disable Windows Toast Notifications [windows] + - Atomic Test #36: Disable Windows Security Center Notifications [windows] + - Atomic Test #37: Suppress Win Defender Notifications [windows] + - Atomic Test #38: Allow RDP Remote Assistance Feature [windows] - T1574.008 Path Interception by Search Order Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1027.001 Binary Padding [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1484.001 Group Policy Modification [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 970505e6..6655f1ee 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -10482,6 +10482,79 @@ defense-evasion: ' name: command_prompt elevation_required: true + - name: Disable Windows Toast Notifications + auto_generated_guid: 003f466a-6010-4b15-803a-cbb478a314d7 + description: | + Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows toast notification. + See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + supported_platforms: + - windows + executor: + command: 'reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications + /v ToastEnabled /t REG_DWORD /d 0 /f + + ' + cleanup_command: 'reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications + /v ToastEnabled /f >nul 2>&1 + + ' + name: command_prompt + elevation_required: true + - name: Disable Windows Security Center Notifications + auto_generated_guid: 45914594-8df6-4ea9-b3cc-7eb9321a807e + description: | + Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows security center notification. + See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + supported_platforms: + - windows + executor: + command: 'reg add HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ImmersiveShell + /v UseActionCenterExperience /t REG_DWORD /d 0 /f + + ' + cleanup_command: 'reg delete HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ImmersiveShell + /v UseActionCenterExperience /f >nul 2>&1 + + ' + name: command_prompt + elevation_required: true + - name: Suppress Win Defender Notifications + auto_generated_guid: c30dada3-7777-4590-b970-dc890b8cf113 + description: | + Modify the registry of the currently logged in user using reg.exe via cmd console to suppress the windows defender notification. + See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + supported_platforms: + - windows + executor: + command: 'reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration + /v Notification_Suppress /t REG_DWORD /d 1 /f + + ' + cleanup_command: 'reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX + Configuration /v Notification_Suppress /f >nul 2>&1 + + ' + name: command_prompt + elevation_required: true + - name: Allow RDP Remote Assistance Feature + auto_generated_guid: 86677d0e-0b5e-4a2b-b302-454175f9aa9e + description: | + Modify the registry of the currently logged in user using reg.exe via cmd console to allow rdp remote assistance feature. This feature allow specific + user to rdp connect on the targeted machine. + See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + supported_platforms: + - windows + executor: + command: 'reg add HKLM\System\CurrentControlSet\Control\Terminal Server /v + fAllowToGetHelp /t REG_DWORD /d 1 /f + + ' + cleanup_command: 'reg delete HKLM\System\CurrentControlSet\Control\Terminal + Server /v fAllowToGetHelp /f >nul 2>&1 + + ' + name: command_prompt + elevation_required: true T1574.008: technique: x_mitre_platforms: diff --git a/atomics/T1112/T1112.md b/atomics/T1112/T1112.md index 94fbe07e..6b0a8033 100644 --- a/atomics/T1112/T1112.md +++ b/atomics/T1112/T1112.md @@ -78,6 +78,14 @@ The Registry of a remote system may be modified to aid in execution of files as - [Atomic Test #34 - Windows Add Registry Value to Load Service in Safe Mode with Network](#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network) +- [Atomic Test #35 - Disable Windows Toast Notifications](#atomic-test-35---disable-windows-toast-notifications) + +- [Atomic Test #36 - Disable Windows Security Center Notifications](#atomic-test-36---disable-windows-security-center-notifications) + +- [Atomic Test #37 - Suppress Win Defender Notifications](#atomic-test-37---suppress-win-defender-notifications) + +- [Atomic Test #38 - Allow RDP Remote Assistance Feature](#atomic-test-38---allow-rdp-remote-assistance-feature) +
@@ -1273,4 +1281,137 @@ reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AtomicSafeMod +
+
+ +## Atomic Test #35 - Disable Windows Toast Notifications +Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows toast notification. +See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + +**Supported Platforms:** Windows + + +**auto_generated_guid:** 003f466a-6010-4b15-803a-cbb478a314d7 + + + + + + +#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin) + + +```cmd +reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications /v ToastEnabled /t REG_DWORD /d 0 /f +``` + +#### Cleanup Commands: +```cmd +reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications /v ToastEnabled /f >nul 2>&1 +``` + + + + + +
+
+ +## Atomic Test #36 - Disable Windows Security Center Notifications +Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows security center notification. +See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + +**Supported Platforms:** Windows + + +**auto_generated_guid:** 45914594-8df6-4ea9-b3cc-7eb9321a807e + + + + + + +#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin) + + +```cmd +reg add HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ImmersiveShell /v UseActionCenterExperience /t REG_DWORD /d 0 /f +``` + +#### Cleanup Commands: +```cmd +reg delete HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ImmersiveShell /v UseActionCenterExperience /f >nul 2>&1 +``` + + + + + +
+
+ +## Atomic Test #37 - Suppress Win Defender Notifications +Modify the registry of the currently logged in user using reg.exe via cmd console to suppress the windows defender notification. +See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + +**Supported Platforms:** Windows + + +**auto_generated_guid:** c30dada3-7777-4590-b970-dc890b8cf113 + + + + + + +#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin) + + +```cmd +reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration /v Notification_Suppress /t REG_DWORD /d 1 /f +``` + +#### Cleanup Commands: +```cmd +reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration /v Notification_Suppress /f >nul 2>&1 +``` + + + + + +
+
+ +## Atomic Test #38 - Allow RDP Remote Assistance Feature +Modify the registry of the currently logged in user using reg.exe via cmd console to allow rdp remote assistance feature. This feature allow specific +user to rdp connect on the targeted machine. +See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + +**Supported Platforms:** Windows + + +**auto_generated_guid:** 86677d0e-0b5e-4a2b-b302-454175f9aa9e + + + + + + +#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin) + + +```cmd +reg add HKLM\System\CurrentControlSet\Control\Terminal Server /v fAllowToGetHelp /t REG_DWORD /d 1 /f +``` + +#### Cleanup Commands: +```cmd +reg delete HKLM\System\CurrentControlSet\Control\Terminal Server /v fAllowToGetHelp /f >nul 2>&1 +``` + + + + +