security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generate docs from job=validate_atomics_generate_docs branch=master

Browse Source
This commit is contained in:
CircleCI Atomic Red Team doc generator
2020-01-06 21:02:26 +00:00
parent b2d25ea9bc
commit 60a8bb70ba
4 changed files with 13 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1074/T1074.md
+5 -5
View File
@@ -10,7 +10,7 @@ Interactive command shells may be used, and common functionality within [cmd](ht
- [Atomic Test #2 - Stage data from Discovery.sh](#atomic-test-2---stage-data-from-discoverysh)
- [Atomic Test #3 - Zip a Folder with PowerShell](#atomic-test-3---zip-a-folder-with-powershell)
- [Atomic Test #3 - Zip a Folder with PowerShell for Staging in Temp](#atomic-test-3---zip-a-folder-with-powershell-for-staging-in-temp)
<br/>
@@ -47,21 +47,21 @@ curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ato
<br/>
<br/>
## Atomic Test #3 - Zip a Folder with PowerShell
use living off the land tools to encrypt and zip a file for exfiltration
## Atomic Test #3 - Zip a Folder with PowerShell for Staging in Temp
Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration.
**Supported Platforms:** Windows
#### Run it with `powershell`!
```
Compress-Archive -Path $PathToAtomicsFolder\T1074\bin\Folder_to_encrypt -DestinationPath $env:TEMP\Folder_to_encrypt.zip
Compress-Archive -Path $PathToAtomicsFolder\T1074\bin\Folder_to_zip -DestinationPath $env:TEMP\Folder_to_zip.zip
```
#### Cleanup Commands:
```
Remove-Item -Path $env:TEMP\Folder_to_encrypt.zip
Remove-Item -Path $env:TEMP\Folder_to_zip.zip
```
<br/>
atomics/index.md
+1 -1
View File
@@ -886,7 +886,7 @@
- [T1074 Data Staged](./T1074/T1074.md)
- Atomic Test #1: Stage data from Discovery.bat [windows]
- Atomic Test #2: Stage data from Discovery.sh [linux, macos]
- Atomic Test #3: Zip a Folder with PowerShell [windows]
- Atomic Test #3: Zip a Folder with PowerShell for Staging in Temp [windows]
- T1530 Data from Cloud Storage Object [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1213 Data from Information Repositories [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1005 Data from Local System](./T1005/T1005.md)
atomics/index.yaml
+6 -5
View File
@@ -25644,8 +25644,9 @@ collection:
| bash -s > /tmp/discovery.log
'
- name: Zip a Folder with PowerShell
description: 'use living off the land tools to encrypt and zip a file for exfiltration
- name: Zip a Folder with PowerShell for Staging in Temp
description: 'Use living off the land tools to zip a file and stage it in the
Windows temporary folder for later exfiltration.
'
supported_platforms:
@@ -25653,11 +25654,11 @@ collection:
executor:
name: powershell
elevation_required: false
command: 'Compress-Archive -Path $PathToAtomicsFolder\T1074\bin\Folder_to_encrypt
-DestinationPath $env:TEMP\Folder_to_encrypt.zip
command: 'Compress-Archive -Path $PathToAtomicsFolder\T1074\bin\Folder_to_zip
-DestinationPath $env:TEMP\Folder_to_zip.zip
'
cleanup_command: 'Remove-Item -Path $env:TEMP\Folder_to_encrypt.zip
cleanup_command: 'Remove-Item -Path $env:TEMP\Folder_to_zip.zip
'
'':
atomics/windows-index.md
+1 -1
View File
@@ -556,7 +556,7 @@
- Atomic Test #2: PowerShell [windows]
- [T1074 Data Staged](./T1074/T1074.md)
- Atomic Test #1: Stage data from Discovery.bat [windows]
- Atomic Test #3: Zip a Folder with PowerShell [windows]
- Atomic Test #3: Zip a Folder with PowerShell for Staging in Temp [windows]
- T1213 Data from Information Repositories [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1005 Data from Local System](./T1005/T1005.md)
- T1039 Data from Network Shared Drive [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)