From 0e616b34b3102278aedcd2193d975013bf5cd87e Mon Sep 17 00:00:00 2001 From: CircleCI Atomic Red Team doc generator Date: Wed, 2 Mar 2022 22:00:09 +0000 Subject: [PATCH] Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] --- atomics/Indexes/Indexes-CSV/index.csv | 3 + atomics/Indexes/Indexes-CSV/windows-index.csv | 3 + atomics/Indexes/Indexes-Markdown/index.md | 3 + .../Indexes/Indexes-Markdown/windows-index.md | 3 + atomics/Indexes/index.yaml | 66 +++++++++++++++++++ atomics/T1053.005/T1053.005.md | 45 +++++++++++++ 6 files changed, 123 insertions(+) diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index 4c06d175..7f43ff3c 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -243,6 +243,7 @@ privilege-escalation,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-3 privilege-escalation,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell privilege-escalation,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell privilege-escalation,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell +privilege-escalation,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt privilege-escalation,T1546.002,Screensaver,1,Set Arbitrary Binary as Screensaver,281201e7-de41-4dc9-b73d-f288938cbb64,command_prompt privilege-escalation,T1547.005,Security Support Provider,1,Modify SSP configuration in registry,afdfd7e3-8a0b-409f-85f7-886fdf249c9e,powershell privilege-escalation,T1574.011,Services Registry Permissions Weakness,1,Service Registry Permissions Weakness,f7536d63-7fd4-466f-89da-7e48d550752a,powershell @@ -699,6 +700,7 @@ persistence,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88- persistence,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell persistence,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell persistence,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell +persistence,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt persistence,T1546.002,Screensaver,1,Set Arbitrary Binary as Screensaver,281201e7-de41-4dc9-b73d-f288938cbb64,command_prompt persistence,T1547.005,Security Support Provider,1,Modify SSP configuration in registry,afdfd7e3-8a0b-409f-85f7-886fdf249c9e,powershell persistence,T1574.011,Services Registry Permissions Weakness,1,Service Registry Permissions Weakness,f7536d63-7fd4-466f-89da-7e48d550752a,powershell @@ -951,6 +953,7 @@ execution,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88-a0 execution,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell execution,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell execution,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell +execution,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt execution,T1569.002,Service Execution,1,Execute a Command as a Service,2382dee2-a75f-49aa-9378-f52df6ed3fb1,command_prompt execution,T1569.002,Service Execution,2,Use PsExec to execute a command on a remote host,873106b7-cfed-454b-8680-fa9f6400431c,command_prompt execution,T1072,Software Deployment Tools,1,Radmin Viewer Utility,b4988cad-6ed2-434d-ace5-ea2670782129,command_prompt diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv index 44dcf0e7..68768806 100644 --- a/atomics/Indexes/Indexes-CSV/windows-index.csv +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -165,6 +165,7 @@ privilege-escalation,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-3 privilege-escalation,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell privilege-escalation,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell privilege-escalation,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell +privilege-escalation,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt privilege-escalation,T1546.002,Screensaver,1,Set Arbitrary Binary as Screensaver,281201e7-de41-4dc9-b73d-f288938cbb64,command_prompt privilege-escalation,T1547.005,Security Support Provider,1,Modify SSP configuration in registry,afdfd7e3-8a0b-409f-85f7-886fdf249c9e,powershell privilege-escalation,T1574.011,Services Registry Permissions Weakness,1,Service Registry Permissions Weakness,f7536d63-7fd4-466f-89da-7e48d550752a,powershell @@ -469,6 +470,7 @@ persistence,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88- persistence,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell persistence,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell persistence,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell +persistence,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt persistence,T1546.002,Screensaver,1,Set Arbitrary Binary as Screensaver,281201e7-de41-4dc9-b73d-f288938cbb64,command_prompt persistence,T1547.005,Security Support Provider,1,Modify SSP configuration in registry,afdfd7e3-8a0b-409f-85f7-886fdf249c9e,powershell persistence,T1574.011,Services Registry Permissions Weakness,1,Service Registry Permissions Weakness,f7536d63-7fd4-466f-89da-7e48d550752a,powershell @@ -674,6 +676,7 @@ execution,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88-a0 execution,T1053.005,Scheduled Task,4,Powershell Cmdlet Scheduled Task,af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd,powershell execution,T1053.005,Scheduled Task,5,Task Scheduler via VBA,ecd3fa21-7792-41a2-8726-2c5c673414d3,powershell execution,T1053.005,Scheduled Task,6,WMI Invoke-CimMethod Scheduled Task,e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b,powershell +execution,T1053.005,Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt execution,T1569.002,Service Execution,1,Execute a Command as a Service,2382dee2-a75f-49aa-9378-f52df6ed3fb1,command_prompt execution,T1569.002,Service Execution,2,Use PsExec to execute a command on a remote host,873106b7-cfed-454b-8680-fa9f6400431c,command_prompt execution,T1072,Software Deployment Tools,1,Radmin Viewer Utility,b4988cad-6ed2-434d-ace5-ea2670782129,command_prompt diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index 9203737d..23251a3a 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -411,6 +411,7 @@ - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] - Atomic Test #5: Task Scheduler via VBA [windows] - Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows] + - Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows] - T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1546.002 Screensaver](../../T1546.002/T1546.002.md) - Atomic Test #1: Set Arbitrary Binary as Screensaver [windows] @@ -1137,6 +1138,7 @@ - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] - Atomic Test #5: Task Scheduler via VBA [windows] - Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows] + - Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows] - T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1546.002 Screensaver](../../T1546.002/T1546.002.md) - Atomic Test #1: Set Arbitrary Binary as Screensaver [windows] @@ -1591,6 +1593,7 @@ - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] - Atomic Test #5: Task Scheduler via VBA [windows] - Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows] + - Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows] - T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1064 Scripting [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1569.002 Service Execution](../../T1569.002/T1569.002.md) diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md index 0c3fa110..63f0ddce 100644 --- a/atomics/Indexes/Indexes-Markdown/windows-index.md +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -299,6 +299,7 @@ - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] - Atomic Test #5: Task Scheduler via VBA [windows] - Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows] + - Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows] - T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1546.002 Screensaver](../../T1546.002/T1546.002.md) - Atomic Test #1: Set Arbitrary Binary as Screensaver [windows] @@ -801,6 +802,7 @@ - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] - Atomic Test #5: Task Scheduler via VBA [windows] - Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows] + - Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows] - T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1546.002 Screensaver](../../T1546.002/T1546.002.md) - Atomic Test #1: Set Arbitrary Binary as Screensaver [windows] @@ -1144,6 +1146,7 @@ - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] - Atomic Test #5: Task Scheduler via VBA [windows] - Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows] + - Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows] - T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1064 Scripting [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1569.002 Service Execution](../../T1569.002/T1569.002.md) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index d0d7b8ba..f46f0ba2 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -18418,6 +18418,28 @@ privilege-escalation: >$null 2>&1 ' + - name: Scheduled Task Executing Base64 Encoded Commands From Registry + auto_generated_guid: e895677d-4f06-49ab-91b6-ae3742d0a2ba + description: "A Base64 Encoded command will be stored in the registry (ping + 127.0.0.1) and then a scheduled task will be created.\nThe scheduled task + will launch powershell to decode and run the command in the rgistry daily.\nThis + is a persistence mechanism recently seen in use by Qakbot. \n\n[Additiona + Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)\n" + supported_platforms: + - windows + input_arguments: + time: + description: Daily scheduled task execution time + type: string + default: 27900 + executor: + command: | + reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f + schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time} + cleanup_command: | + schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1 + reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1 + name: command_prompt T1053: technique: id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9 @@ -49110,6 +49132,28 @@ persistence: >$null 2>&1 ' + - name: Scheduled Task Executing Base64 Encoded Commands From Registry + auto_generated_guid: e895677d-4f06-49ab-91b6-ae3742d0a2ba + description: "A Base64 Encoded command will be stored in the registry (ping + 127.0.0.1) and then a scheduled task will be created.\nThe scheduled task + will launch powershell to decode and run the command in the rgistry daily.\nThis + is a persistence mechanism recently seen in use by Qakbot. \n\n[Additiona + Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)\n" + supported_platforms: + - windows + input_arguments: + time: + description: Daily scheduled task execution time + type: string + default: 27900 + executor: + command: | + reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f + schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time} + cleanup_command: | + schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1 + reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1 + name: command_prompt T1053: technique: id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9 @@ -65462,6 +65506,28 @@ execution: >$null 2>&1 ' + - name: Scheduled Task Executing Base64 Encoded Commands From Registry + auto_generated_guid: e895677d-4f06-49ab-91b6-ae3742d0a2ba + description: "A Base64 Encoded command will be stored in the registry (ping + 127.0.0.1) and then a scheduled task will be created.\nThe scheduled task + will launch powershell to decode and run the command in the rgistry daily.\nThis + is a persistence mechanism recently seen in use by Qakbot. \n\n[Additiona + Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)\n" + supported_platforms: + - windows + input_arguments: + time: + description: Daily scheduled task execution time + type: string + default: 27900 + executor: + command: | + reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f + schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time} + cleanup_command: | + schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1 + reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1 + name: command_prompt T1053: technique: id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9 diff --git a/atomics/T1053.005/T1053.005.md b/atomics/T1053.005/T1053.005.md index 7af72a57..20ffb6d1 100644 --- a/atomics/T1053.005/T1053.005.md +++ b/atomics/T1053.005/T1053.005.md @@ -20,6 +20,8 @@ An adversary may use Windows Task Scheduler to execute programs at system startu - [Atomic Test #6 - WMI Invoke-CimMethod Scheduled Task](#atomic-test-6---wmi-invoke-cimmethod-scheduled-task) +- [Atomic Test #7 - Scheduled Task Executing Base64 Encoded Commands From Registry](#atomic-test-7---scheduled-task-executing-base64-encoded-commands-from-registry) +
@@ -261,4 +263,47 @@ Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false >$null 2>&1 +
+
+ +## Atomic Test #7 - Scheduled Task Executing Base64 Encoded Commands From Registry +A Base64 Encoded command will be stored in the registry (ping 127.0.0.1) and then a scheduled task will be created. +The scheduled task will launch powershell to decode and run the command in the rgistry daily. +This is a persistence mechanism recently seen in use by Qakbot. + +[Additiona Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/) + +**Supported Platforms:** Windows + + +**auto_generated_guid:** e895677d-4f06-49ab-91b6-ae3742d0a2ba + + + + + +#### Inputs: +| Name | Description | Type | Default Value | +|------|-------------|------|---------------| +| time | Daily scheduled task execution time | string | 27900| + + +#### Attack Commands: Run with `command_prompt`! + + +```cmd +reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f +schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time} +``` + +#### Cleanup Commands: +```cmd +schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1 +reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1 +``` + + + + +