Generate docs from job=validate_atomics_generate_docs branch=master
This commit is contained in:
parent
38f7dce9d8
commit
8f72e4f710
@@ -670,7 +670,7 @@ collection,T1114.001,Local Email Collection,1,Email Collection with PowerShell G
|
||||
collection,T1113,Screen Capture,1,Screencapture,0f47ceb1-720f-4275-96b8-21f0562217ac,bash
|
||||
collection,T1113,Screen Capture,2,Screencapture (silent),deb7d358-5fbd-4dc4-aecc-ee0054d2d9a4,bash
|
||||
collection,T1113,Screen Capture,3,X Windows Capture,8206dd0c-faf6-4d74-ba13-7fbe13dce6ac,bash
|
||||
collection,T1113,Screen Capture,4,Import,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash
|
||||
collection,T1113,Screen Capture,4,Capture Linux Desktop using Import Tool,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash
|
||||
exfiltration,T1020,Automated Exfiltration,1,IcedID Botnet HTTP PUT,9c780d3d-3a14-4278-8ee5-faaeb2ccfbe0,powershell
|
||||
exfiltration,T1030,Data Transfer Size Limits,1,Data Transfer Size Limits,ab936c51-10f4-46ce-9144-e02137b2016a,sh
|
||||
exfiltration,T1048,Exfiltration Over Alternative Protocol,1,Exfiltration Over Alternative Protocol - SSH,f6786cc8-beda-4915-a4d6-ac2f193bb988,sh
|
||||
|
||||
|
@@ -142,7 +142,7 @@ collection,T1560.001,Archive via Utility,7,Data Compressed - nix - tar Folder or
|
||||
collection,T1560.001,Archive via Utility,8,Data Encrypted with zip and gpg symmetric,0286eb44-e7ce-41a0-b109-3da516e05a5f,sh
|
||||
collection,T1074.001,Local Data Staging,2,Stage data from Discovery.sh,39ce0303-ae16-4b9e-bb5b-4f53e8262066,bash
|
||||
collection,T1113,Screen Capture,3,X Windows Capture,8206dd0c-faf6-4d74-ba13-7fbe13dce6ac,bash
|
||||
collection,T1113,Screen Capture,4,Import,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash
|
||||
collection,T1113,Screen Capture,4,Capture Linux Desktop using Import Tool,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash
|
||||
execution,T1053.001,At (Linux),1,At - Schedule a job,7266d898-ac82-4ec0-97c7-436075d0d08e,sh
|
||||
execution,T1053.003,Cron,1,Cron - Replace crontab with referenced file,435057fb-74b1-410e-9403-d81baf194f75,bash
|
||||
execution,T1053.003,Cron,2,Cron - Add script to cron folder,b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0,bash
|
||||
|
||||
|
@@ -1241,7 +1241,7 @@
|
||||
- Atomic Test #1: Screencapture [macos]
|
||||
- Atomic Test #2: Screencapture (silent) [macos]
|
||||
- Atomic Test #3: X Windows Capture [linux]
|
||||
- Atomic Test #4: Import [linux]
|
||||
- Atomic Test #4: Capture Linux Desktop using Import Tool [linux]
|
||||
- T1213.002 Sharepoint [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1125 Video Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1056.003 Web Portal Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
|
||||
@@ -456,7 +456,7 @@
|
||||
- T1114.002 Remote Email Collection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- [T1113 Screen Capture](../../T1113/T1113.md)
|
||||
- Atomic Test #3: X Windows Capture [linux]
|
||||
- Atomic Test #4: Import [linux]
|
||||
- Atomic Test #4: Capture Linux Desktop using Import Tool [linux]
|
||||
- T1213.002 Sharepoint [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
- T1056.003 Web Portal Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
|
||||
|
||||
|
||||
@@ -51299,9 +51299,10 @@ collection:
|
||||
|
||||
'
|
||||
name: bash
|
||||
- name: Import
|
||||
- name: Capture Linux Desktop using Import Tool
|
||||
auto_generated_guid: 9cd1cccb-91e4-4550-9139-e20a586fcea1
|
||||
description: 'Use import command to collect a full desktop screenshot
|
||||
description: 'Use import command from ImageMagick to collect a full desktop
|
||||
screenshot
|
||||
|
||||
'
|
||||
supported_platforms:
|
||||
@@ -51311,6 +51312,16 @@ collection:
|
||||
description: Output file path
|
||||
type: Path
|
||||
default: "/tmp/T1113_desktop.png"
|
||||
dependencies:
|
||||
- description: 'ImageMagick must be installed
|
||||
|
||||
'
|
||||
prereq_command: 'if import --version; then exit 0; else exit 1; fi
|
||||
|
||||
'
|
||||
get_prereq_command: 'sudo apt-get install imagemagick
|
||||
|
||||
'
|
||||
executor:
|
||||
command: 'import -window root #{output_file}
|
||||
|
||||
|
||||
+15
-3
@@ -11,7 +11,7 @@
|
||||
|
||||
- [Atomic Test #3 - X Windows Capture](#atomic-test-3---x-windows-capture)
|
||||
|
||||
- [Atomic Test #4 - Import](#atomic-test-4---import)
|
||||
- [Atomic Test #4 - Capture Linux Desktop using Import Tool](#atomic-test-4---capture-linux-desktop-using-import-tool)
|
||||
|
||||
|
||||
<br/>
|
||||
@@ -116,8 +116,8 @@ rm #{output_file}
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #4 - Import
|
||||
Use import command to collect a full desktop screenshot
|
||||
## Atomic Test #4 - Capture Linux Desktop using Import Tool
|
||||
Use import command from ImageMagick to collect a full desktop screenshot
|
||||
|
||||
**Supported Platforms:** Linux
|
||||
|
||||
@@ -144,6 +144,18 @@ rm #{output_file}
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `bash`!
|
||||
##### Description: ImageMagick must be installed
|
||||
##### Check Prereq Commands:
|
||||
```bash
|
||||
if import --version; then exit 0; else exit 1; fi
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```bash
|
||||
sudo apt-get install imagemagick
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
Reference in New Issue
Block a user