diff --git a/atomics/atomic_doc_template.md.erb b/atomics/atomic_doc_template.md.erb
index 011d9af1..19d77c95 100644
--- a/atomics/atomic_doc_template.md.erb
+++ b/atomics/atomic_doc_template.md.erb
@@ -10,6 +10,7 @@ MITRE ATT&CK Technique: [<%= technique['identifier'] %>](https://attack.mitre.or
<% atomic_yaml['atomic_tests'].each_with_index do |test, test_number| -%>
+
## Atomic Test #<%= test_number+1 %> - <%= test['name'] %>
<%= test['description'] -%>
diff --git a/atomics/t1046/t1046.md b/atomics/t1046/t1046.md
index f70d246e..bfcda16c 100644
--- a/atomics/t1046/t1046.md
+++ b/atomics/t1046/t1046.md
@@ -6,6 +6,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - Scan a bunch of ports to see if they are open
xxx
diff --git a/atomics/t1087/t1087.md b/atomics/t1087/t1087.md
index 12380b59..dac65401 100644
--- a/atomics/t1087/t1087.md
+++ b/atomics/t1087/t1087.md
@@ -14,6 +14,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - List all accounts
xxx
@@ -32,6 +33,7 @@ cat /etc/passwd > #{output_file}
```
+
## Atomic Test #2 - View sudoers access
xxx (requires root)
@@ -50,6 +52,7 @@ cat /etc/sudoers > #{output_file}
```
+
## Atomic Test #3 - View accounts with UID 0
xxx
@@ -68,6 +71,7 @@ grep 'x:0:' /etc/passwd > #{output_file}
```
+
## Atomic Test #4 - List opened files by user
xxx
@@ -81,6 +85,7 @@ username=$(echo $HOME | awk -F'/' '{print $3}') && lsof -u $username
```
+
## Atomic Test #5 - Show if a user account has ever logger in remotely
xxx
diff --git a/atomics/t1089/t1089.md b/atomics/t1089/t1089.md
index 4bbf2a0d..f2c14f74 100644
--- a/atomics/t1089/t1089.md
+++ b/atomics/t1089/t1089.md
@@ -12,6 +12,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - Disable iptables firewall
Disables the iptables firewall
@@ -34,6 +35,7 @@ fi
```
+
## Atomic Test #2 - Disable syslog
Disables syslog collection
@@ -54,6 +56,7 @@ fi
```
+
## Atomic Test #3 - Disable Cb Response
Disable the Cb Response service
@@ -74,6 +77,7 @@ fi
```
+
## Atomic Test #4 - Disable SELinux
Disables SELinux enforcement
diff --git a/atomics/t1099/t1099.md b/atomics/t1099/t1099.md
index 5d5110f8..3bf22e68 100644
--- a/atomics/t1099/t1099.md
+++ b/atomics/t1099/t1099.md
@@ -10,6 +10,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - Set a file's access timestamp
Stomps on the access timestamp of a file
@@ -28,6 +29,7 @@ touch -a -t 197001010000.00 #{target_filename}
```
+
## Atomic Test #2 - Set a file's modification timestamp
Stomps on the modification timestamp of a file
@@ -46,6 +48,7 @@ touch -m -t 197001010000.00 #{target_filename}
```
+
## Atomic Test #3 - Set a file's creation timestamp
Stomps on the create timestamp of a file
diff --git a/atomics/t1105/t1105.md b/atomics/t1105/t1105.md
index f8f0426c..9fe456a1 100644
--- a/atomics/t1105/t1105.md
+++ b/atomics/t1105/t1105.md
@@ -6,6 +6,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - xxxx
xxxx
diff --git a/atomics/t1123/t1123.md b/atomics/t1123/t1123.md
index 87c6ae79..065e0467 100644
--- a/atomics/t1123/t1123.md
+++ b/atomics/t1123/t1123.md
@@ -8,6 +8,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - SourceRecorder via Windows command prompt
Create a file called test.wma, with the duration of 30 seconds
@@ -27,6 +28,7 @@ SoundRecorder /FILE #{output_file} /DURATION #{duration_hms}
```
+
## Atomic Test #2 - PowerShell Cmdlet via Windows command prompt
[AudioDeviceCmdlets](https://github.com/cdhunt/WindowsAudioDevice-Powershell-Cmdlet)
diff --git a/atomics/t1130/t1130.md b/atomics/t1130/t1130.md
index 3e2f7046..136e61e9 100644
--- a/atomics/t1130/t1130.md
+++ b/atomics/t1130/t1130.md
@@ -6,6 +6,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - Install root CA on CentOS/RHEL
Creates a root CA with openssl
diff --git a/atomics/t1136/t1136.md b/atomics/t1136/t1136.md
index d59ed8d0..b93c00a7 100644
--- a/atomics/t1136/t1136.md
+++ b/atomics/t1136/t1136.md
@@ -8,6 +8,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - Create a user account on a Linux system
Create a user via useradd
@@ -27,6 +28,7 @@ useradd -M -N -r -s /bin/bash -c "#{comment}" #{username}
```
+
## Atomic Test #2 - Create a user account on a MacOS system
Creates a user on a MacOS system with dscl
diff --git a/atomics/t1139/t1139.md b/atomics/t1139/t1139.md
index 6c524596..72b02e3a 100644
--- a/atomics/t1139/t1139.md
+++ b/atomics/t1139/t1139.md
@@ -6,6 +6,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - xxxx
xxxx
diff --git a/atomics/t1146/t1146.md b/atomics/t1146/t1146.md
index 0dc33475..eda6825d 100644
--- a/atomics/t1146/t1146.md
+++ b/atomics/t1146/t1146.md
@@ -16,6 +16,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - Clear Bash history (rm)
Clears bash history via rm
@@ -29,6 +30,7 @@ rm ~/.bash_history
```
+
## Atomic Test #2 - Clear Bash history (echo)
Clears bash history via rm
@@ -42,6 +44,7 @@ echo "" > ~/.bash_history
```
+
## Atomic Test #3 - Clear Bash history (cat dev/null)
Clears bash history via cat /dev/null
@@ -55,6 +58,7 @@ cat /dev/null > ~/.bash_history
```
+
## Atomic Test #4 - Clear Bash history (ln dev/null)
Clears bash history via a symlink to /dev/null
@@ -68,6 +72,7 @@ ln -sf /dev/null ~/.bash_history
```
+
## Atomic Test #5 - Clear Bash history (truncate)
Clears bash history via truncate
@@ -81,6 +86,7 @@ truncate -s0 ~/.bash_history
```
+
## Atomic Test #6 - Clear history of a bunch of shells
Clears the history of a bunch of different shell types by setting the history size to zero
diff --git a/atomics/t1148/t1148.md b/atomics/t1148/t1148.md
index 053fc805..a617308f 100644
--- a/atomics/t1148/t1148.md
+++ b/atomics/t1148/t1148.md
@@ -6,6 +6,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - Disable history collection
Disables history collection in shells
diff --git a/atomics/t1158/t1158.md b/atomics/t1158/t1158.md
index 5dc724bd..58a57ef0 100644
--- a/atomics/t1158/t1158.md
+++ b/atomics/t1158/t1158.md
@@ -6,6 +6,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - Create a hidden file in a hidden directory
Creates a hidden file inside a hidden directory
diff --git a/atomics/t1176/t1176.md b/atomics/t1176/t1176.md
index 87a0cbd4..c993abc3 100644
--- a/atomics/t1176/t1176.md
+++ b/atomics/t1176/t1176.md
@@ -10,6 +10,7 @@ MITRE ATT&CK Technique: [T1234](https://attack.mitre.org/wiki/Technique/T1234)
+
## Atomic Test #1 - Chrome (Developer Mode)
xxx
@@ -28,6 +29,7 @@ tick 'Developer Mode'.
+
## Atomic Test #2 - Chrome (Chrome Web Store)
xxx
@@ -43,6 +45,7 @@ in Chrome
+
## Atomic Test #3 - Firefox
Create a file called test.wma, with the duration of 30 seconds