Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
This commit is contained in:
CircleCI Atomic Red Team doc generator
parent
b74fd6246c
commit
22f3da4960
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -354,6 +354,7 @@ defense-evasion,T1222.002,Linux and Mac File and Directory Permissions Modificat
|
||||
defense-evasion,T1078.003,Local Accounts,1,Create local account with admin priviliges,a524ce99-86de-4db6-b4f9-e08f35a47a15,command_prompt
|
||||
defense-evasion,T1127.001,MSBuild,1,MSBuild Bypass Using Inline Tasks (C#),58742c0f-cb01-44cd-a60b-fb26e8871c93,command_prompt
|
||||
defense-evasion,T1127.001,MSBuild,2,MSBuild Bypass Using Inline Tasks (VB),ab042179-c0c5-402f-9bc8-42741f5ce359,command_prompt
|
||||
defense-evasion,T1553.005,Mark-of-the-Web Bypass,1,Mount ISO image,002cca30-4778-4891-878a-aaffcfa502fa,powershell
|
||||
defense-evasion,T1036.004,Masquerade Task or Service,1,Creating W32Time similar named service using schtasks,f9f2fe59-96f7-4a7d-ba9f-a9783200d4c9,command_prompt
|
||||
defense-evasion,T1036.004,Masquerade Task or Service,2,Creating W32Time similar named service using sc,b721c6ef-472c-4263-a0d9-37f1f4ecff66,command_prompt
|
||||
defense-evasion,T1036,Masquerading,1,System File Copied to Unusual Location,51005ac7-52e2-45e0-bdab-d17c6d4916cd,command_prompt
|
||||
|
||||
|
@@ -233,6 +233,7 @@ defense-evasion,T1218.004,InstallUtil,8,InstallUtil evasive invocation,559e6d06-
|
||||
defense-evasion,T1078.003,Local Accounts,1,Create local account with admin priviliges,a524ce99-86de-4db6-b4f9-e08f35a47a15,command_prompt
|
||||
defense-evasion,T1127.001,MSBuild,1,MSBuild Bypass Using Inline Tasks (C#),58742c0f-cb01-44cd-a60b-fb26e8871c93,command_prompt
|
||||
defense-evasion,T1127.001,MSBuild,2,MSBuild Bypass Using Inline Tasks (VB),ab042179-c0c5-402f-9bc8-42741f5ce359,command_prompt
|
||||
defense-evasion,T1553.005,Mark-of-the-Web Bypass,1,Mount ISO image,002cca30-4778-4891-878a-aaffcfa502fa,powershell
|
||||
defense-evasion,T1036.004,Masquerade Task or Service,1,Creating W32Time similar named service using schtasks,f9f2fe59-96f7-4a7d-ba9f-a9783200d4c9,command_prompt
|
||||
defense-evasion,T1036.004,Masquerade Task or Service,2,Creating W32Time similar named service using sc,b721c6ef-472c-4263-a0d9-37f1f4ecff66,command_prompt
|
||||
defense-evasion,T1036,Masquerading,1,System File Copied to Unusual Location,51005ac7-52e2-45e0-bdab-d17c6d4916cd,command_prompt
|
||||
|
||||
|
@@ -622,7 +622,8 @@
|
||||
- Atomic Test #1: MSBuild Bypass Using Inline Tasks (C#) [windows]
|
||||
- Atomic Test #2: MSBuild Bypass Using Inline Tasks (VB) [windows]
|
||||
- T1134.003 Make and Impersonate Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1553.005 Mark-of-the-Web Bypass [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1553.005 Mark-of-the-Web Bypass](../../T1553.005/T1553.005.md)
|
||||
- Atomic Test #1: Mount ISO image [windows]
|
||||
- [T1036.004 Masquerade Task or Service](../../T1036.004/T1036.004.md)
|
||||
- Atomic Test #1: Creating W32Time similar named service using schtasks [windows]
|
||||
- Atomic Test #2: Creating W32Time similar named service using sc [windows]
|
||||
|
||||
@@ -439,7 +439,8 @@
|
||||
- Atomic Test #1: MSBuild Bypass Using Inline Tasks (C#) [windows]
|
||||
- Atomic Test #2: MSBuild Bypass Using Inline Tasks (VB) [windows]
|
||||
- T1134.003 Make and Impersonate Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1553.005 Mark-of-the-Web Bypass [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1553.005 Mark-of-the-Web Bypass](../../T1553.005/T1553.005.md)
|
||||
- Atomic Test #1: Mount ISO image [windows]
|
||||
- [T1036.004 Masquerade Task or Service](../../T1036.004/T1036.004.md)
|
||||
- Atomic Test #1: Creating W32Time similar named service using schtasks [windows]
|
||||
- Atomic Test #2: Creating W32Time similar named service using sc [windows]
|
||||
|
||||
@@ -76,7 +76,7 @@
|
||||
| | | Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Scheduled Task](../../T1053.005/T1053.005.md) | [Local Accounts](../../T1078.003/T1078.003.md) | | | | | | | |
|
||||
| | | [Port Monitors](../../T1547.010/T1547.010.md) | Scheduled Task/Job [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [MSBuild](../../T1127.001/T1127.001.md) | | | | | | | |
|
||||
| | | [PowerShell Profile](../../T1546.013/T1546.013.md) | [Screensaver](../../T1546.002/T1546.002.md) | Make and Impersonate Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | | |
|
||||
| | | Pre-OS Boot [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Security Support Provider](../../T1547.005/T1547.005.md) | Mark-of-the-Web Bypass [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | | |
|
||||
| | | Pre-OS Boot [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Security Support Provider](../../T1547.005/T1547.005.md) | [Mark-of-the-Web Bypass](../../T1553.005/T1553.005.md) | | | | | | | |
|
||||
| | | Print Processors [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Services File Permissions Weakness [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Masquerade Task or Service](../../T1036.004/T1036.004.md) | | | | | | | |
|
||||
| | | [RC Scripts](../../T1037.004/T1037.004.md) | [Services Registry Permissions Weakness](../../T1574.011/T1574.011.md) | [Masquerading](../../T1036/T1036.md) | | | | | | | |
|
||||
| | | ROMMONkit [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Setuid and Setgid](../../T1548.001/T1548.001.md) | Match Legitimate Name or Location [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | | |
|
||||
|
||||
@@ -57,7 +57,7 @@
|
||||
| | | [Port Monitors](../../T1547.010/T1547.010.md) | [Scheduled Task](../../T1053.005/T1053.005.md) | [Local Accounts](../../T1078.003/T1078.003.md) | | | | | | | |
|
||||
| | | [PowerShell Profile](../../T1546.013/T1546.013.md) | Scheduled Task/Job [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [MSBuild](../../T1127.001/T1127.001.md) | | | | | | | |
|
||||
| | | Pre-OS Boot [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Screensaver](../../T1546.002/T1546.002.md) | Make and Impersonate Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | | |
|
||||
| | | Print Processors [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Security Support Provider](../../T1547.005/T1547.005.md) | Mark-of-the-Web Bypass [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | | |
|
||||
| | | Print Processors [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Security Support Provider](../../T1547.005/T1547.005.md) | [Mark-of-the-Web Bypass](../../T1553.005/T1553.005.md) | | | | | | | |
|
||||
| | | Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Services File Permissions Weakness [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Masquerade Task or Service](../../T1036.004/T1036.004.md) | | | | | | | |
|
||||
| | | [Registry Run Keys / Startup Folder](../../T1547.001/T1547.001.md) | [Services Registry Permissions Weakness](../../T1574.011/T1574.011.md) | [Masquerading](../../T1036/T1036.md) | | | | | | | |
|
||||
| | | SQL Stored Procedures [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Shortcut Modification](../../T1547.009/T1547.009.md) | Match Legitimate Name or Location [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | | |
|
||||
|
||||
@@ -27216,7 +27216,42 @@ defense-evasion:
|
||||
x_mitre_version: '1.0'
|
||||
x_mitre_defense_bypassed:
|
||||
- Anti-virus, Application control
|
||||
atomic_tests: []
|
||||
identifier: T1553.005
|
||||
atomic_tests:
|
||||
- name: Mount ISO image
|
||||
auto_generated_guid: 002cca30-4778-4891-878a-aaffcfa502fa
|
||||
description: 'Mounts ISO image downloaded from internet to evade Mark-of-the-Web.
|
||||
Upon successful execution, powershell will download the .iso from the Atomic
|
||||
Red Team repo, and mount the image. The provided sample ISO simply has a Reports
|
||||
shortcut file in it. Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
path_of_iso:
|
||||
description: Path to ISO file
|
||||
type: path
|
||||
default: PathToAtomicsFolder\T1553.005\src\T1553.005.iso
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'T1553.005.iso must exist on disk at specified location (#{path_of_iso})
|
||||
|
||||
'
|
||||
prereq_command: 'if (Test-Path #{path_of_iso}) {exit 0} else {exit 1}
|
||||
|
||||
'
|
||||
get_prereq_command: |
|
||||
New-Item -Type Directory (split-path #{path_of_iso}) -ErrorAction ignore | Out-Null
|
||||
Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/src/T1553.005.iso -OutFile "#{path_of_iso}"
|
||||
executor:
|
||||
command: 'Mount-DiskImage -ImagePath "#{path_of_iso}"
|
||||
|
||||
'
|
||||
cleanup_command: 'Dismount-DiskImage -ImagePath "#{path_of_iso}"
|
||||
|
||||
'
|
||||
name: powershell
|
||||
T1036.004:
|
||||
technique:
|
||||
external_references:
|
||||
|
||||
@@ -1,10 +1,12 @@
|
||||
# T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass
|
||||
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1553/005/)
|
||||
<blockquote>Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.</blockquote>
|
||||
# T1553.005 - Mark-of-the-Web Bypass
|
||||
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1553/005)
|
||||
<blockquote>Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named <code>Zone.Identifier</code> with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file in not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)
|
||||
|
||||
Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)</blockquote>
|
||||
|
||||
## Atomic Tests
|
||||
|
||||
- [Atomic Test #1 - Mount ISO image](#atomic-test-1---mount-iso-image---)
|
||||
- [Atomic Test #1 - Mount ISO image](#atomic-test-1---mount-iso-image)
|
||||
|
||||
|
||||
<br/>
|
||||
@@ -26,21 +28,25 @@ Mounts ISO image downloaded from internet to evade Mark-of-the-Web. Upon success
|
||||
#### Attack Commands: Run with `powershell`!
|
||||
|
||||
|
||||
``` Mount-DiskImage -ImagePath "#{path_of_iso}"```
|
||||
```powershell
|
||||
Mount-DiskImage -ImagePath "#{path_of_iso}"
|
||||
```
|
||||
|
||||
#### Cleanup Commands:
|
||||
``` Dismount-DiskImage -ImagePath "#{path_of_iso}"```
|
||||
```powershell
|
||||
Dismount-DiskImage -ImagePath "#{path_of_iso}"
|
||||
```
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `powershell`!
|
||||
##### Description: T1553.005.iso must exist on disk at specified location (#{path_of_iso})
|
||||
##### Check Prereq Commands:
|
||||
```
|
||||
```powershell
|
||||
if (Test-Path #{path_of_iso}) {exit 0} else {exit 1}
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```
|
||||
```powershell
|
||||
New-Item -Type Directory (split-path #{path_of_iso}) -ErrorAction ignore | Out-Null
|
||||
Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/src/T1553.005.iso -OutFile "#{path_of_iso}"
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user