diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv
index 5769344d..24ddf938 100644
--- a/atomics/Indexes/Indexes-CSV/index.csv
+++ b/atomics/Indexes/Indexes-CSV/index.csv
@@ -269,22 +269,23 @@ defense-evasion,T1562.001,Disable or Modify Tools,4,Stop Crowdstrike Falcon on L
defense-evasion,T1562.001,Disable or Modify Tools,5,Disable Carbon Black Response,8fba7766-2d11-4b4a-979a-1e3d9cc9a88c,sh
defense-evasion,T1562.001,Disable or Modify Tools,6,Disable LittleSnitch,62155dd8-bb3d-4f32-b31c-6532ff3ac6a3,sh
defense-evasion,T1562.001,Disable or Modify Tools,7,Disable OpenDNS Umbrella,07f43b33-1e15-4e99-be70-bc094157c849,sh
-defense-evasion,T1562.001,Disable or Modify Tools,8,Stop and unload Crowdstrike Falcon on macOS,b3e7510c-2d4c-4249-a33f-591a2bc83eef,sh
-defense-evasion,T1562.001,Disable or Modify Tools,9,Unload Sysmon Filter Driver,811b3e76-c41b-430c-ac0d-e2380bfaa164,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,10,Uninstall Sysmon,a316fb2e-5344-470d-91c1-23e15c374edc,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,11,AMSI Bypass - AMSI InitFailed,695eed40-e949-40e5-b306-b4031e4154bd,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,12,AMSI Bypass - Remove AMSI Provider Reg Key,13f09b91-c953-438e-845b-b585e51cac9b,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,13,Disable Arbitrary Security Windows Service,a1230893-56ac-4c81-b644-2108e982f8f5,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,14,Tamper with Windows Defender ATP PowerShell,6b8df440-51ec-4d53-bf83-899591c9b5d7,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,15,Tamper with Windows Defender Command Prompt,aa875ed4-8935-47e2-b2c5-6ec00ab220d2,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,16,Tamper with Windows Defender Registry,1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,17,Disable Microsoft Office Security Features,6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,18,Remove Windows Defender Definition Files,3d47daaa-2f56-43e0-94cc-caf5d8d52a68,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,19,Stop and Remove Arbitrary Security Windows Service,ae753dda-0f15-4af6-a168-b9ba16143143,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,20,Uninstall Crowdstrike Falcon on Windows,b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,21,Tamper with Windows Defender Evade Scanning -Folder,0b19f4ee-de90-4059-88cb-63c800c683ed,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,22,Tamper with Windows Defender Evade Scanning -Extension,315f4be6-2240-4552-b3e1-d1047f5eecea,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,23,Tamper with Windows Defender Evade Scanning -Process,a123ce6a-3916-45d6-ba9c-7d4081315c27,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,8,Disable macOS Gatekeeper,2a821573-fb3f-4e71-92c3-daac7432f053,sh
+defense-evasion,T1562.001,Disable or Modify Tools,9,Stop and unload Crowdstrike Falcon on macOS,b3e7510c-2d4c-4249-a33f-591a2bc83eef,sh
+defense-evasion,T1562.001,Disable or Modify Tools,10,Unload Sysmon Filter Driver,811b3e76-c41b-430c-ac0d-e2380bfaa164,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,11,Uninstall Sysmon,a316fb2e-5344-470d-91c1-23e15c374edc,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,12,AMSI Bypass - AMSI InitFailed,695eed40-e949-40e5-b306-b4031e4154bd,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,13,AMSI Bypass - Remove AMSI Provider Reg Key,13f09b91-c953-438e-845b-b585e51cac9b,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,14,Disable Arbitrary Security Windows Service,a1230893-56ac-4c81-b644-2108e982f8f5,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,15,Tamper with Windows Defender ATP PowerShell,6b8df440-51ec-4d53-bf83-899591c9b5d7,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,16,Tamper with Windows Defender Command Prompt,aa875ed4-8935-47e2-b2c5-6ec00ab220d2,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,17,Tamper with Windows Defender Registry,1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,18,Disable Microsoft Office Security Features,6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,19,Remove Windows Defender Definition Files,3d47daaa-2f56-43e0-94cc-caf5d8d52a68,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,20,Stop and Remove Arbitrary Security Windows Service,ae753dda-0f15-4af6-a168-b9ba16143143,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,21,Uninstall Crowdstrike Falcon on Windows,b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,22,Tamper with Windows Defender Evade Scanning -Folder,0b19f4ee-de90-4059-88cb-63c800c683ed,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,23,Tamper with Windows Defender Evade Scanning -Extension,315f4be6-2240-4552-b3e1-d1047f5eecea,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,24,Tamper with Windows Defender Evade Scanning -Process,a123ce6a-3916-45d6-ba9c-7d4081315c27,powershell
defense-evasion,T1070.004,File Deletion,1,Delete a single file - Linux/macOS,562d737f-2fc6-4b09-8c2a-7f8ff0828480,sh
defense-evasion,T1070.004,File Deletion,2,Delete an entire folder - Linux/macOS,a415f17e-ce8d-4ce2-a8b4-83b674e7017e,sh
defense-evasion,T1070.004,File Deletion,3,Overwrite and delete a file with shred,039b4b10-2900-404b-b67f-4b6d49aa6499,sh
diff --git a/atomics/Indexes/Indexes-CSV/macos-index.csv b/atomics/Indexes/Indexes-CSV/macos-index.csv
index 2668978b..9576da65 100644
--- a/atomics/Indexes/Indexes-CSV/macos-index.csv
+++ b/atomics/Indexes/Indexes-CSV/macos-index.csv
@@ -52,7 +52,8 @@ defense-evasion,T1070.002,Clear Linux or Mac System Logs,1,rm -rf,989cc1b1-3642-
defense-evasion,T1562.001,Disable or Modify Tools,5,Disable Carbon Black Response,8fba7766-2d11-4b4a-979a-1e3d9cc9a88c,sh
defense-evasion,T1562.001,Disable or Modify Tools,6,Disable LittleSnitch,62155dd8-bb3d-4f32-b31c-6532ff3ac6a3,sh
defense-evasion,T1562.001,Disable or Modify Tools,7,Disable OpenDNS Umbrella,07f43b33-1e15-4e99-be70-bc094157c849,sh
-defense-evasion,T1562.001,Disable or Modify Tools,8,Stop and unload Crowdstrike Falcon on macOS,b3e7510c-2d4c-4249-a33f-591a2bc83eef,sh
+defense-evasion,T1562.001,Disable or Modify Tools,8,Disable macOS Gatekeeper,2a821573-fb3f-4e71-92c3-daac7432f053,sh
+defense-evasion,T1562.001,Disable or Modify Tools,9,Stop and unload Crowdstrike Falcon on macOS,b3e7510c-2d4c-4249-a33f-591a2bc83eef,sh
defense-evasion,T1070.004,File Deletion,1,Delete a single file - Linux/macOS,562d737f-2fc6-4b09-8c2a-7f8ff0828480,sh
defense-evasion,T1070.004,File Deletion,2,Delete an entire folder - Linux/macOS,a415f17e-ce8d-4ce2-a8b4-83b674e7017e,sh
defense-evasion,T1553.001,Gatekeeper Bypass,1,Gatekeeper Bypass,fb3d46c6-9480-4803-8d7d-ce676e1f1a9b,sh
diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv
index 652477a7..0a1f7506 100644
--- a/atomics/Indexes/Indexes-CSV/windows-index.csv
+++ b/atomics/Indexes/Indexes-CSV/windows-index.csv
@@ -90,21 +90,21 @@ defense-evasion,T1562.004,Disable or Modify System Firewall,3,Allow SMB and RDP
defense-evasion,T1562.004,Disable or Modify System Firewall,4,Opening ports for proxy - HARDRAIN,15e57006-79dd-46df-9bf9-31bc24fb5a80,command_prompt
defense-evasion,T1562.004,Disable or Modify System Firewall,5,Open a local port through Windows Firewall to any profile,9636dd6e-7599-40d2-8eee-ac16434f35ed,powershell
defense-evasion,T1562.004,Disable or Modify System Firewall,6,Allow Executable Through Firewall Located in Non-Standard Location,6f5822d2-d38d-4f48-9bfc-916607ff6b8c,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,9,Unload Sysmon Filter Driver,811b3e76-c41b-430c-ac0d-e2380bfaa164,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,10,Uninstall Sysmon,a316fb2e-5344-470d-91c1-23e15c374edc,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,11,AMSI Bypass - AMSI InitFailed,695eed40-e949-40e5-b306-b4031e4154bd,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,12,AMSI Bypass - Remove AMSI Provider Reg Key,13f09b91-c953-438e-845b-b585e51cac9b,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,13,Disable Arbitrary Security Windows Service,a1230893-56ac-4c81-b644-2108e982f8f5,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,14,Tamper with Windows Defender ATP PowerShell,6b8df440-51ec-4d53-bf83-899591c9b5d7,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,15,Tamper with Windows Defender Command Prompt,aa875ed4-8935-47e2-b2c5-6ec00ab220d2,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,16,Tamper with Windows Defender Registry,1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,17,Disable Microsoft Office Security Features,6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,18,Remove Windows Defender Definition Files,3d47daaa-2f56-43e0-94cc-caf5d8d52a68,command_prompt
-defense-evasion,T1562.001,Disable or Modify Tools,19,Stop and Remove Arbitrary Security Windows Service,ae753dda-0f15-4af6-a168-b9ba16143143,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,20,Uninstall Crowdstrike Falcon on Windows,b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,21,Tamper with Windows Defender Evade Scanning -Folder,0b19f4ee-de90-4059-88cb-63c800c683ed,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,22,Tamper with Windows Defender Evade Scanning -Extension,315f4be6-2240-4552-b3e1-d1047f5eecea,powershell
-defense-evasion,T1562.001,Disable or Modify Tools,23,Tamper with Windows Defender Evade Scanning -Process,a123ce6a-3916-45d6-ba9c-7d4081315c27,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,10,Unload Sysmon Filter Driver,811b3e76-c41b-430c-ac0d-e2380bfaa164,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,11,Uninstall Sysmon,a316fb2e-5344-470d-91c1-23e15c374edc,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,12,AMSI Bypass - AMSI InitFailed,695eed40-e949-40e5-b306-b4031e4154bd,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,13,AMSI Bypass - Remove AMSI Provider Reg Key,13f09b91-c953-438e-845b-b585e51cac9b,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,14,Disable Arbitrary Security Windows Service,a1230893-56ac-4c81-b644-2108e982f8f5,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,15,Tamper with Windows Defender ATP PowerShell,6b8df440-51ec-4d53-bf83-899591c9b5d7,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,16,Tamper with Windows Defender Command Prompt,aa875ed4-8935-47e2-b2c5-6ec00ab220d2,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,17,Tamper with Windows Defender Registry,1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,18,Disable Microsoft Office Security Features,6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,19,Remove Windows Defender Definition Files,3d47daaa-2f56-43e0-94cc-caf5d8d52a68,command_prompt
+defense-evasion,T1562.001,Disable or Modify Tools,20,Stop and Remove Arbitrary Security Windows Service,ae753dda-0f15-4af6-a168-b9ba16143143,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,21,Uninstall Crowdstrike Falcon on Windows,b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,22,Tamper with Windows Defender Evade Scanning -Folder,0b19f4ee-de90-4059-88cb-63c800c683ed,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,23,Tamper with Windows Defender Evade Scanning -Extension,315f4be6-2240-4552-b3e1-d1047f5eecea,powershell
+defense-evasion,T1562.001,Disable or Modify Tools,24,Tamper with Windows Defender Evade Scanning -Process,a123ce6a-3916-45d6-ba9c-7d4081315c27,powershell
defense-evasion,T1070.004,File Deletion,4,Delete a single file - Windows cmd,861ea0b4-708a-4d17-848d-186c9c7f17e3,command_prompt
defense-evasion,T1070.004,File Deletion,5,Delete an entire folder - Windows cmd,ded937c4-2add-42f7-9c2c-c742b7a98698,command_prompt
defense-evasion,T1070.004,File Deletion,6,Delete a single file - Windows PowerShell,9dee89bd-9a98-4c4f-9e2d-4256690b0e72,powershell
diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md
index 2d5ef521..3ea7b223 100644
--- a/atomics/Indexes/Indexes-Markdown/index.md
+++ b/atomics/Indexes/Indexes-Markdown/index.md
@@ -538,22 +538,23 @@
- Atomic Test #5: Disable Carbon Black Response [macos]
- Atomic Test #6: Disable LittleSnitch [macos]
- Atomic Test #7: Disable OpenDNS Umbrella [macos]
- - Atomic Test #8: Stop and unload Crowdstrike Falcon on macOS [macos]
- - Atomic Test #9: Unload Sysmon Filter Driver [windows]
- - Atomic Test #10: Uninstall Sysmon [windows]
- - Atomic Test #11: AMSI Bypass - AMSI InitFailed [windows]
- - Atomic Test #12: AMSI Bypass - Remove AMSI Provider Reg Key [windows]
- - Atomic Test #13: Disable Arbitrary Security Windows Service [windows]
- - Atomic Test #14: Tamper with Windows Defender ATP PowerShell [windows]
- - Atomic Test #15: Tamper with Windows Defender Command Prompt [windows]
- - Atomic Test #16: Tamper with Windows Defender Registry [windows]
- - Atomic Test #17: Disable Microsoft Office Security Features [windows]
- - Atomic Test #18: Remove Windows Defender Definition Files [windows]
- - Atomic Test #19: Stop and Remove Arbitrary Security Windows Service [windows]
- - Atomic Test #20: Uninstall Crowdstrike Falcon on Windows [windows]
- - Atomic Test #21: Tamper with Windows Defender Evade Scanning -Folder [windows]
- - Atomic Test #22: Tamper with Windows Defender Evade Scanning -Extension [windows]
- - Atomic Test #23: Tamper with Windows Defender Evade Scanning -Process [windows]
+ - Atomic Test #8: Disable macOS Gatekeeper [macos]
+ - Atomic Test #9: Stop and unload Crowdstrike Falcon on macOS [macos]
+ - Atomic Test #10: Unload Sysmon Filter Driver [windows]
+ - Atomic Test #11: Uninstall Sysmon [windows]
+ - Atomic Test #12: AMSI Bypass - AMSI InitFailed [windows]
+ - Atomic Test #13: AMSI Bypass - Remove AMSI Provider Reg Key [windows]
+ - Atomic Test #14: Disable Arbitrary Security Windows Service [windows]
+ - Atomic Test #15: Tamper with Windows Defender ATP PowerShell [windows]
+ - Atomic Test #16: Tamper with Windows Defender Command Prompt [windows]
+ - Atomic Test #17: Tamper with Windows Defender Registry [windows]
+ - Atomic Test #18: Disable Microsoft Office Security Features [windows]
+ - Atomic Test #19: Remove Windows Defender Definition Files [windows]
+ - Atomic Test #20: Stop and Remove Arbitrary Security Windows Service [windows]
+ - Atomic Test #21: Uninstall Crowdstrike Falcon on Windows [windows]
+ - Atomic Test #22: Tamper with Windows Defender Evade Scanning -Folder [windows]
+ - Atomic Test #23: Tamper with Windows Defender Evade Scanning -Extension [windows]
+ - Atomic Test #24: Tamper with Windows Defender Evade Scanning -Process [windows]
- T1078.002 Domain Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1556.001 Domain Controller Authentication [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1574.004 Dylib Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
diff --git a/atomics/Indexes/Indexes-Markdown/macos-index.md b/atomics/Indexes/Indexes-Markdown/macos-index.md
index 971550db..0ea9e2a4 100644
--- a/atomics/Indexes/Indexes-Markdown/macos-index.md
+++ b/atomics/Indexes/Indexes-Markdown/macos-index.md
@@ -135,7 +135,8 @@
- Atomic Test #5: Disable Carbon Black Response [macos]
- Atomic Test #6: Disable LittleSnitch [macos]
- Atomic Test #7: Disable OpenDNS Umbrella [macos]
- - Atomic Test #8: Stop and unload Crowdstrike Falcon on macOS [macos]
+ - Atomic Test #8: Disable macOS Gatekeeper [macos]
+ - Atomic Test #9: Stop and unload Crowdstrike Falcon on macOS [macos]
- T1078.002 Domain Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1574.004 Dylib Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1548.004 Elevated Execution with Prompt [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md
index 0b46a626..758aa19c 100644
--- a/atomics/Indexes/Indexes-Markdown/windows-index.md
+++ b/atomics/Indexes/Indexes-Markdown/windows-index.md
@@ -180,21 +180,21 @@
- Atomic Test #5: Open a local port through Windows Firewall to any profile [windows]
- Atomic Test #6: Allow Executable Through Firewall Located in Non-Standard Location [windows]
- [T1562.001 Disable or Modify Tools](../../T1562.001/T1562.001.md)
- - Atomic Test #9: Unload Sysmon Filter Driver [windows]
- - Atomic Test #10: Uninstall Sysmon [windows]
- - Atomic Test #11: AMSI Bypass - AMSI InitFailed [windows]
- - Atomic Test #12: AMSI Bypass - Remove AMSI Provider Reg Key [windows]
- - Atomic Test #13: Disable Arbitrary Security Windows Service [windows]
- - Atomic Test #14: Tamper with Windows Defender ATP PowerShell [windows]
- - Atomic Test #15: Tamper with Windows Defender Command Prompt [windows]
- - Atomic Test #16: Tamper with Windows Defender Registry [windows]
- - Atomic Test #17: Disable Microsoft Office Security Features [windows]
- - Atomic Test #18: Remove Windows Defender Definition Files [windows]
- - Atomic Test #19: Stop and Remove Arbitrary Security Windows Service [windows]
- - Atomic Test #20: Uninstall Crowdstrike Falcon on Windows [windows]
- - Atomic Test #21: Tamper with Windows Defender Evade Scanning -Folder [windows]
- - Atomic Test #22: Tamper with Windows Defender Evade Scanning -Extension [windows]
- - Atomic Test #23: Tamper with Windows Defender Evade Scanning -Process [windows]
+ - Atomic Test #10: Unload Sysmon Filter Driver [windows]
+ - Atomic Test #11: Uninstall Sysmon [windows]
+ - Atomic Test #12: AMSI Bypass - AMSI InitFailed [windows]
+ - Atomic Test #13: AMSI Bypass - Remove AMSI Provider Reg Key [windows]
+ - Atomic Test #14: Disable Arbitrary Security Windows Service [windows]
+ - Atomic Test #15: Tamper with Windows Defender ATP PowerShell [windows]
+ - Atomic Test #16: Tamper with Windows Defender Command Prompt [windows]
+ - Atomic Test #17: Tamper with Windows Defender Registry [windows]
+ - Atomic Test #18: Disable Microsoft Office Security Features [windows]
+ - Atomic Test #19: Remove Windows Defender Definition Files [windows]
+ - Atomic Test #20: Stop and Remove Arbitrary Security Windows Service [windows]
+ - Atomic Test #21: Uninstall Crowdstrike Falcon on Windows [windows]
+ - Atomic Test #22: Tamper with Windows Defender Evade Scanning -Folder [windows]
+ - Atomic Test #23: Tamper with Windows Defender Evade Scanning -Extension [windows]
+ - Atomic Test #24: Tamper with Windows Defender Evade Scanning -Process [windows]
- T1078.002 Domain Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1556.001 Domain Controller Authentication [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1055.001 Dynamic-link Library Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
index f8a8d228..b5f9ad61 100644
--- a/atomics/Indexes/index.yaml
+++ b/atomics/Indexes/index.yaml
@@ -24253,10 +24253,14 @@ defense-evasion:
supported_platforms:
- macos
executor:
- command: 'sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
-
-'
+ command: |
+ sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
+ sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
+ cleanup_command: |
+ sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist
+ sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
name: sh
+ elevation_required: true
- name: Disable LittleSnitch
auto_generated_guid: 62155dd8-bb3d-4f32-b31c-6532ff3ac6a3
description: 'Disables LittleSnitch
@@ -24267,8 +24271,12 @@ defense-evasion:
executor:
command: 'sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
+'
+ cleanup_command: 'sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
+
'
name: sh
+ elevation_required: true
- name: Disable OpenDNS Umbrella
auto_generated_guid: 07f43b33-1e15-4e99-be70-bc094157c849
description: 'Disables OpenDNS Umbrella
@@ -24279,8 +24287,28 @@ defense-evasion:
executor:
command: 'sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
+'
+ cleanup_command: 'sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
+
'
name: sh
+ elevation_required: true
+ - name: Disable macOS Gatekeeper
+ auto_generated_guid: 2a821573-fb3f-4e71-92c3-daac7432f053
+ description: 'Disables macOS Gatekeeper
+
+'
+ supported_platforms:
+ - macos
+ executor:
+ command: 'sudo spctl --master-disable
+
+'
+ cleanup_command: 'sudo spctl --master-enable
+
+'
+ name: sh
+ elevation_required: true
- name: Stop and unload Crowdstrike Falcon on macOS
auto_generated_guid: b3e7510c-2d4c-4249-a33f-591a2bc83eef
description: 'Stop and unload Crowdstrike Falcon daemons falcond and userdaemon
@@ -24302,6 +24330,9 @@ defense-evasion:
command: |
sudo launchctl unload #{falcond_plist}
sudo launchctl unload #{userdaemon_plist}
+ cleanup_command: |
+ sudo launchctl load -w #{falcond_plist}
+ sudo launchctl load -w #{userdaemon_plist}
name: sh
elevation_required: true
- name: Unload Sysmon Filter Driver
@@ -25772,9 +25803,9 @@ defense-evasion:
type: Path
default: myapp.app
executor:
- command: |
- sudo xattr -r -d com.apple.quarantine #{app_path}
- sudo spctl --master-disable
+ command: 'sudo xattr -d com.apple.quarantine #{app_path}
+
+'
elevation_required: true
name: sh
T1484:
diff --git a/atomics/T1553.001/T1553.001.md b/atomics/T1553.001/T1553.001.md
index 93b9084f..61546a31 100644
--- a/atomics/T1553.001/T1553.001.md
+++ b/atomics/T1553.001/T1553.001.md
@@ -31,8 +31,7 @@ Gatekeeper Bypass via command line
```sh
-sudo xattr -r -d com.apple.quarantine #{app_path}
-sudo spctl --master-disable
+sudo xattr -d com.apple.quarantine #{app_path}
```
diff --git a/atomics/T1562.001/T1562.001.md b/atomics/T1562.001/T1562.001.md
index 57adacc4..95a917d2 100644
--- a/atomics/T1562.001/T1562.001.md
+++ b/atomics/T1562.001/T1562.001.md
@@ -18,37 +18,39 @@
- [Atomic Test #7 - Disable OpenDNS Umbrella](#atomic-test-7---disable-opendns-umbrella)
-- [Atomic Test #8 - Stop and unload Crowdstrike Falcon on macOS](#atomic-test-8---stop-and-unload-crowdstrike-falcon-on-macos)
+- [Atomic Test #8 - Disable macOS Gatekeeper](#atomic-test-8---disable-macos-gatekeeper)
-- [Atomic Test #9 - Unload Sysmon Filter Driver](#atomic-test-9---unload-sysmon-filter-driver)
+- [Atomic Test #9 - Stop and unload Crowdstrike Falcon on macOS](#atomic-test-9---stop-and-unload-crowdstrike-falcon-on-macos)
-- [Atomic Test #10 - Uninstall Sysmon](#atomic-test-10---uninstall-sysmon)
+- [Atomic Test #10 - Unload Sysmon Filter Driver](#atomic-test-10---unload-sysmon-filter-driver)
-- [Atomic Test #11 - AMSI Bypass - AMSI InitFailed](#atomic-test-11---amsi-bypass---amsi-initfailed)
+- [Atomic Test #11 - Uninstall Sysmon](#atomic-test-11---uninstall-sysmon)
-- [Atomic Test #12 - AMSI Bypass - Remove AMSI Provider Reg Key](#atomic-test-12---amsi-bypass---remove-amsi-provider-reg-key)
+- [Atomic Test #12 - AMSI Bypass - AMSI InitFailed](#atomic-test-12---amsi-bypass---amsi-initfailed)
-- [Atomic Test #13 - Disable Arbitrary Security Windows Service](#atomic-test-13---disable-arbitrary-security-windows-service)
+- [Atomic Test #13 - AMSI Bypass - Remove AMSI Provider Reg Key](#atomic-test-13---amsi-bypass---remove-amsi-provider-reg-key)
-- [Atomic Test #14 - Tamper with Windows Defender ATP PowerShell](#atomic-test-14---tamper-with-windows-defender-atp-powershell)
+- [Atomic Test #14 - Disable Arbitrary Security Windows Service](#atomic-test-14---disable-arbitrary-security-windows-service)
-- [Atomic Test #15 - Tamper with Windows Defender Command Prompt](#atomic-test-15---tamper-with-windows-defender-command-prompt)
+- [Atomic Test #15 - Tamper with Windows Defender ATP PowerShell](#atomic-test-15---tamper-with-windows-defender-atp-powershell)
-- [Atomic Test #16 - Tamper with Windows Defender Registry](#atomic-test-16---tamper-with-windows-defender-registry)
+- [Atomic Test #16 - Tamper with Windows Defender Command Prompt](#atomic-test-16---tamper-with-windows-defender-command-prompt)
-- [Atomic Test #17 - Disable Microsoft Office Security Features](#atomic-test-17---disable-microsoft-office-security-features)
+- [Atomic Test #17 - Tamper with Windows Defender Registry](#atomic-test-17---tamper-with-windows-defender-registry)
-- [Atomic Test #18 - Remove Windows Defender Definition Files](#atomic-test-18---remove-windows-defender-definition-files)
+- [Atomic Test #18 - Disable Microsoft Office Security Features](#atomic-test-18---disable-microsoft-office-security-features)
-- [Atomic Test #19 - Stop and Remove Arbitrary Security Windows Service](#atomic-test-19---stop-and-remove-arbitrary-security-windows-service)
+- [Atomic Test #19 - Remove Windows Defender Definition Files](#atomic-test-19---remove-windows-defender-definition-files)
-- [Atomic Test #20 - Uninstall Crowdstrike Falcon on Windows](#atomic-test-20---uninstall-crowdstrike-falcon-on-windows)
+- [Atomic Test #20 - Stop and Remove Arbitrary Security Windows Service](#atomic-test-20---stop-and-remove-arbitrary-security-windows-service)
-- [Atomic Test #21 - Tamper with Windows Defender Evade Scanning -Folder](#atomic-test-21---tamper-with-windows-defender-evade-scanning--folder)
+- [Atomic Test #21 - Uninstall Crowdstrike Falcon on Windows](#atomic-test-21---uninstall-crowdstrike-falcon-on-windows)
-- [Atomic Test #22 - Tamper with Windows Defender Evade Scanning -Extension](#atomic-test-22---tamper-with-windows-defender-evade-scanning--extension)
+- [Atomic Test #22 - Tamper with Windows Defender Evade Scanning -Folder](#atomic-test-22---tamper-with-windows-defender-evade-scanning--folder)
-- [Atomic Test #23 - Tamper with Windows Defender Evade Scanning -Process](#atomic-test-23---tamper-with-windows-defender-evade-scanning--process)
+- [Atomic Test #23 - Tamper with Windows Defender Evade Scanning -Extension](#atomic-test-23---tamper-with-windows-defender-evade-scanning--extension)
+
+- [Atomic Test #24 - Tamper with Windows Defender Evade Scanning -Process](#atomic-test-24---tamper-with-windows-defender-evade-scanning--process)
@@ -178,13 +180,19 @@ Disables Carbon Black Response
-#### Attack Commands: Run with `sh`!
+#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)
```sh
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
+sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
```
+#### Cleanup Commands:
+```sh
+sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist
+sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
+```
@@ -202,13 +210,17 @@ Disables LittleSnitch
-#### Attack Commands: Run with `sh`!
+#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)
```sh
sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
```
+#### Cleanup Commands:
+```sh
+sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
+```
@@ -226,13 +238,17 @@ Disables OpenDNS Umbrella
-#### Attack Commands: Run with `sh`!
+#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)
```sh
sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
```
+#### Cleanup Commands:
+```sh
+sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
+```
@@ -241,7 +257,35 @@ sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfig
-## Atomic Test #8 - Stop and unload Crowdstrike Falcon on macOS
+## Atomic Test #8 - Disable macOS Gatekeeper
+Disables macOS Gatekeeper
+
+**Supported Platforms:** macOS
+
+
+
+
+
+#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)
+
+
+```sh
+sudo spctl --master-disable
+```
+
+#### Cleanup Commands:
+```sh
+sudo spctl --master-enable
+```
+
+
+
+
+
+
+
+
+## Atomic Test #9 - Stop and unload Crowdstrike Falcon on macOS
Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS
**Supported Platforms:** macOS
@@ -264,6 +308,11 @@ sudo launchctl unload #{falcond_plist}
sudo launchctl unload #{userdaemon_plist}
```
+#### Cleanup Commands:
+```sh
+sudo launchctl load -w #{falcond_plist}
+sudo launchctl load -w #{userdaemon_plist}
+```
@@ -272,7 +321,7 @@ sudo launchctl unload #{userdaemon_plist}
-## Atomic Test #9 - Unload Sysmon Filter Driver
+## Atomic Test #10 - Unload Sysmon Filter Driver
Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution, o verify successful execution,
run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".
@@ -343,7 +392,7 @@ sysmon -accepteula -i
-## Atomic Test #10 - Uninstall Sysmon
+## Atomic Test #11 - Uninstall Sysmon
Uninstall Sysinternals Sysmon for Defense Evasion
**Supported Platforms:** Windows
@@ -401,7 +450,7 @@ cmd /c sysmon -i -accepteula
-## Atomic Test #11 - AMSI Bypass - AMSI InitFailed
+## Atomic Test #12 - AMSI Bypass - AMSI InitFailed
Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true.
Upon execution, no output is displayed.
@@ -432,7 +481,7 @@ https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
-## Atomic Test #12 - AMSI Bypass - Remove AMSI Provider Reg Key
+## Atomic Test #13 - AMSI Bypass - Remove AMSI Provider Reg Key
With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.
@@ -462,7 +511,7 @@ New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" -Name "{2781761E-28E0-4
-## Atomic Test #13 - Disable Arbitrary Security Windows Service
+## Atomic Test #14 - Disable Arbitrary Security Windows Service
With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
To verify that the service has stopped, run "sc query McAfeeDLPAgentService"
@@ -499,7 +548,7 @@ net.exe start #{service_name} >nul 2>&1
-## Atomic Test #14 - Tamper with Windows Defender ATP PowerShell
+## Atomic Test #15 - Tamper with Windows Defender ATP PowerShell
Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
@@ -534,7 +583,7 @@ Set-MpPreference -DisableBlockAtFirstSeen 0
-## Atomic Test #15 - Tamper with Windows Defender Command Prompt
+## Atomic Test #16 - Tamper with Windows Defender Command Prompt
Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
will be displayed twice and the WinDefend service status will be displayed.
@@ -567,7 +616,7 @@ sc config WinDefend start=enabled >nul 2>&1
-## Atomic Test #16 - Tamper with Windows Defender Registry
+## Atomic Test #17 - Tamper with Windows Defender Registry
Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be
grayed out and have no info.
@@ -596,7 +645,7 @@ Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name Disa
-## Atomic Test #17 - Disable Microsoft Office Security Features
+## Atomic Test #18 - Disable Microsoft Office Security Features
Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not
show any warning before editing the document.
@@ -635,7 +684,7 @@ Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\Protected
-## Atomic Test #18 - Remove Windows Defender Definition Files
+## Atomic Test #19 - Remove Windows Defender Definition Files
Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments.
On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the
command will say completed.
@@ -663,7 +712,7 @@ https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-
-## Atomic Test #19 - Stop and Remove Arbitrary Security Windows Service
+## Atomic Test #20 - Stop and Remove Arbitrary Security Windows Service
Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.
**Supported Platforms:** Windows
@@ -693,7 +742,7 @@ Remove-Service -Name #{service_name}
-## Atomic Test #20 - Uninstall Crowdstrike Falcon on Windows
+## Atomic Test #21 - Uninstall Crowdstrike Falcon on Windows
Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.
**Supported Platforms:** Windows
@@ -722,7 +771,7 @@ if (Test-Path "#{falcond_path}") {. "#{falcond_path}" /repair /uninstall /quiet
-## Atomic Test #21 - Tamper with Windows Defender Evade Scanning -Folder
+## Atomic Test #22 - Tamper with Windows Defender Evade Scanning -Folder
Malware can exclude a specific path from being scanned and evading detection.
Upon successul execution, the file provided should be on the list of excluded path.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath
@@ -759,7 +808,7 @@ Remove-MpPreference -ExclusionPath $excludedpath
-## Atomic Test #22 - Tamper with Windows Defender Evade Scanning -Extension
+## Atomic Test #23 - Tamper with Windows Defender Evade Scanning -Extension
Malware can exclude specific extensions from being scanned and evading detection.
Upon successful execution, the extension(s) should be on the list of excluded extensions.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionExtension.
@@ -796,7 +845,7 @@ Remove-MpPreference -ExclusionExtension $excludedExts
-## Atomic Test #23 - Tamper with Windows Defender Evade Scanning -Process
+## Atomic Test #24 - Tamper with Windows Defender Evade Scanning -Process
Malware can exclude specific processes from being scanned and evading detection.
Upon successful execution, the process(es) should be on the list of excluded processes.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionProcess."
diff --git a/atomics/T1562.001/T1562.001.yaml b/atomics/T1562.001/T1562.001.yaml
index a9148abc..00e377db 100644
--- a/atomics/T1562.001/T1562.001.yaml
+++ b/atomics/T1562.001/T1562.001.yaml
@@ -102,6 +102,7 @@ atomic_tests:
name: sh
elevation_required: true
- name: Disable macOS Gatekeeper
+ auto_generated_guid: 2a821573-fb3f-4e71-92c3-daac7432f053
description: |
Disables macOS Gatekeeper
supported_platforms:
diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt
index 66e89d2d..063796f4 100644
--- a/atomics/used_guids.txt
+++ b/atomics/used_guids.txt
@@ -586,3 +586,4 @@ dc7726d2-8ccb-4cc6-af22-0d5afb53a548
cf3391e0-b482-4b02-87fc-ca8362269b29
c3e35b58-fe1c-480b-b540-7600fb612563
de87ed7b-52c3-43fd-9554-730f695e7f31
+2a821573-fb3f-4e71-92c3-daac7432f053