Generated docs from job=generate-docs branch=master [ci skip]
This commit is contained in:
Atomic Red Team doc generator
@@ -2,7 +2,7 @@
|
||||
|
||||
# Atomic Red Team
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
Atomic Red Team™ is a library of tests mapped to the
|
||||
[MITRE ATT&CK®](https://attack.mitre.org/) framework. Security teams can use
|
||||
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -1896,6 +1896,7 @@ impact,T1486,Data Encrypted for Impact,6,Encrypt files using 7z utility - macOS,
|
||||
impact,T1486,Data Encrypted for Impact,7,Encrypt files using openssl utility - macOS,1a01f6b8-b1e8-418e-bbe3-78a6f822759e,sh
|
||||
impact,T1486,Data Encrypted for Impact,8,Data Encrypted with GPG4Win,4541e2c2-33c8-44b1-be79-9161440f1718,powershell
|
||||
impact,T1486,Data Encrypted for Impact,9,Data Encrypt Using DiskCryptor,44b68e11-9da2-4d45-a0d9-893dabd60f30,command_prompt
|
||||
impact,T1486,Data Encrypted for Impact,10,Akira Ransomware drop Files with .akira Extension and Ransomnote,ab3f793f-2dcc-4da5-9c71-34988307263f,powershell
|
||||
impact,T1496,Resource Hijacking,1,FreeBSD/macOS/Linux - Simulate CPU Load with Yes,904a5a0e-fb02-490d-9f8d-0e256eb37549,sh
|
||||
impact,T1485,Data Destruction,1,Windows - Overwrite file with SysInternals SDelete,476419b5-aebf-4366-a131-ae3e8dae5fc2,powershell
|
||||
impact,T1485,Data Destruction,2,FreeBSD/macOS/Linux - Overwrite file with DD,38deee99-fd65-4031-bec8-bfa4f9f26146,sh
|
||||
|
||||
|
@@ -1263,6 +1263,7 @@ impact,T1531,Account Access Removal,3,Remove Account From Domain Admin Group,43f
|
||||
impact,T1486,Data Encrypted for Impact,5,PureLocker Ransom Note,649349c7-9abf-493b-a7a2-b1aa4d141528,command_prompt
|
||||
impact,T1486,Data Encrypted for Impact,8,Data Encrypted with GPG4Win,4541e2c2-33c8-44b1-be79-9161440f1718,powershell
|
||||
impact,T1486,Data Encrypted for Impact,9,Data Encrypt Using DiskCryptor,44b68e11-9da2-4d45-a0d9-893dabd60f30,command_prompt
|
||||
impact,T1486,Data Encrypted for Impact,10,Akira Ransomware drop Files with .akira Extension and Ransomnote,ab3f793f-2dcc-4da5-9c71-34988307263f,powershell
|
||||
impact,T1485,Data Destruction,1,Windows - Overwrite file with SysInternals SDelete,476419b5-aebf-4366-a131-ae3e8dae5fc2,powershell
|
||||
impact,T1485,Data Destruction,3,Overwrite deleted data on C drive,321fd25e-0007-417f-adec-33232252be19,command_prompt
|
||||
impact,T1490,Inhibit System Recovery,1,Windows - Delete Volume Shadow Copies,43819286-91a9-4369-90ed-d31fb4da2c01,command_prompt
|
||||
|
||||
|
@@ -2700,6 +2700,7 @@
|
||||
- Atomic Test #7: Encrypt files using openssl utility - macOS [macos]
|
||||
- Atomic Test #8: Data Encrypted with GPG4Win [windows]
|
||||
- Atomic Test #9: Data Encrypt Using DiskCryptor [windows]
|
||||
- Atomic Test #10: Akira Ransomware drop Files with .akira Extension and Ransomnote [windows]
|
||||
- T1499 Endpoint Denial of Service [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1496 Resource Hijacking](../../T1496/T1496.md)
|
||||
- Atomic Test #1: FreeBSD/macOS/Linux - Simulate CPU Load with Yes [linux, macos]
|
||||
|
||||
@@ -1816,6 +1816,7 @@
|
||||
- Atomic Test #5: PureLocker Ransom Note [windows]
|
||||
- Atomic Test #8: Data Encrypted with GPG4Win [windows]
|
||||
- Atomic Test #9: Data Encrypt Using DiskCryptor [windows]
|
||||
- Atomic Test #10: Akira Ransomware drop Files with .akira Extension and Ransomnote [windows]
|
||||
- T1499 Endpoint Denial of Service [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1496 Resource Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1565.002 Transmitted Data Manipulation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
|
||||
@@ -112332,6 +112332,40 @@ impact:
|
||||
command: '""%PROGRAMFILES%\dcrypt"\#{dcrypt_exe}"
|
||||
|
||||
'
|
||||
- name: Akira Ransomware drop Files with .akira Extension and Ransomnote
|
||||
auto_generated_guid: ab3f793f-2dcc-4da5-9c71-34988307263f
|
||||
description: 'Dropping 100 files with random content and .akira File Extension
|
||||
and the Akira Ransomnote to c:\
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- windows
|
||||
executor:
|
||||
name: powershell
|
||||
elevation_required: true
|
||||
command: |
|
||||
1..100 | ForEach-Object { $out = new-object byte[] 1073741; (new-object Random).NextBytes($out); [IO.File]::WriteAllBytes("c:\test.$_.akira", $out) }
|
||||
echo "Hi friends" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "Whatever who you are and what your title is if you' re reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment. you have to know: " >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. [f you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them — in this case we won't be able to help. " >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we' ve managed to detect and used in order to get into. identify backup solutions and upload your data." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes — generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "Then all of this will be published in our blog -" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "If you' re indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "2. Paste this link — https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "3. Use this code - - to log into our chat." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "Keep in mind that the faster you will get in touch, the less damage we cause" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
cleanup_command: "del $env:Userprofile\\Desktop\\akira_readme.txt \ndel c:\\test.*.akira\n"
|
||||
T1499:
|
||||
technique:
|
||||
modified: '2023-05-09T14:00:00.188Z'
|
||||
|
||||
@@ -92903,6 +92903,40 @@ impact:
|
||||
command: '""%PROGRAMFILES%\dcrypt"\#{dcrypt_exe}"
|
||||
|
||||
'
|
||||
- name: Akira Ransomware drop Files with .akira Extension and Ransomnote
|
||||
auto_generated_guid: ab3f793f-2dcc-4da5-9c71-34988307263f
|
||||
description: 'Dropping 100 files with random content and .akira File Extension
|
||||
and the Akira Ransomnote to c:\
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- windows
|
||||
executor:
|
||||
name: powershell
|
||||
elevation_required: true
|
||||
command: |
|
||||
1..100 | ForEach-Object { $out = new-object byte[] 1073741; (new-object Random).NextBytes($out); [IO.File]::WriteAllBytes("c:\test.$_.akira", $out) }
|
||||
echo "Hi friends" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "Whatever who you are and what your title is if you' re reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment. you have to know: " >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. [f you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them — in this case we won't be able to help. " >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we' ve managed to detect and used in order to get into. identify backup solutions and upload your data." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes — generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "Then all of this will be published in our blog -" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "If you' re indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "2. Paste this link — https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "3. Use this code - - to log into our chat." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "Keep in mind that the faster you will get in touch, the less damage we cause" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
cleanup_command: "del $env:Userprofile\\Desktop\\akira_readme.txt \ndel c:\\test.*.akira\n"
|
||||
T1499:
|
||||
technique:
|
||||
modified: '2023-05-09T14:00:00.188Z'
|
||||
|
||||
@@ -28,6 +28,8 @@ In cloud environments, storage objects within compromised accounts may also be e
|
||||
|
||||
- [Atomic Test #9 - Data Encrypt Using DiskCryptor](#atomic-test-9---data-encrypt-using-diskcryptor)
|
||||
|
||||
- [Atomic Test #10 - Akira Ransomware drop Files with .akira Extension and Ransomnote](#atomic-test-10---akira-ransomware-drop-files-with-akira-extension-and-ransomnote)
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
@@ -468,4 +470,57 @@ Start-Process "PathToAtomicsFolder\..\ExternalPayloads\dcrypt_setup_1.1.846.118.
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #10 - Akira Ransomware drop Files with .akira Extension and Ransomnote
|
||||
Dropping 100 files with random content and .akira File Extension and the Akira Ransomnote to c:\
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** ab3f793f-2dcc-4da5-9c71-34988307263f
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)
|
||||
|
||||
|
||||
```powershell
|
||||
1..100 | ForEach-Object { $out = new-object byte[] 1073741; (new-object Random).NextBytes($out); [IO.File]::WriteAllBytes("c:\test.$_.akira", $out) }
|
||||
echo "Hi friends" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "Whatever who you are and what your title is if you' re reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment. you have to know: " >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. [f you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them — in this case we won't be able to help. " >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we' ve managed to detect and used in order to get into. identify backup solutions and upload your data." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes — generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "Then all of this will be published in our blog -" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "If you' re indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "2. Paste this link — https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "3. Use this code - - to log into our chat." >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
echo "Keep in mind that the faster you will get in touch, the less damage we cause" >> $env:Userprofile\Desktop\akira_readme.txt
|
||||
```
|
||||
|
||||
#### Cleanup Commands:
|
||||
```powershell
|
||||
del $env:Userprofile\Desktop\akira_readme.txt
|
||||
del c:\test.*.akira
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
@@ -307,6 +307,7 @@ atomic_tests:
|
||||
""%PROGRAMFILES%\dcrypt"\#{dcrypt_exe}"
|
||||
|
||||
- name: Akira Ransomware drop Files with .akira Extension and Ransomnote
|
||||
auto_generated_guid: ab3f793f-2dcc-4da5-9c71-34988307263f
|
||||
description: |
|
||||
Dropping 100 files with random content and .akira File Extension and the Akira Ransomnote to c:\
|
||||
supported_platforms:
|
||||
|
||||
@@ -1621,3 +1621,4 @@ ecbd533e-b45d-4239-aeff-b857c6f6d68b
|
||||
8a7f56ee-10e7-444c-a139-0109438288eb
|
||||
7bcf83bf-f5ef-425c-9d9a-71618ad9ed12
|
||||
0fd14730-6226-4f5e-8d67-43c65f1be940
|
||||
ab3f793f-2dcc-4da5-9c71-34988307263f
|
||||
|
||||
Reference in New Issue
Block a user