diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index 99820e1c..df30d489 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -670,7 +670,7 @@ collection,T1114.001,Local Email Collection,1,Email Collection with PowerShell G collection,T1113,Screen Capture,1,Screencapture,0f47ceb1-720f-4275-96b8-21f0562217ac,bash collection,T1113,Screen Capture,2,Screencapture (silent),deb7d358-5fbd-4dc4-aecc-ee0054d2d9a4,bash collection,T1113,Screen Capture,3,X Windows Capture,8206dd0c-faf6-4d74-ba13-7fbe13dce6ac,bash -collection,T1113,Screen Capture,4,Import,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash +collection,T1113,Screen Capture,4,Capture Linux Desktop using Import Tool,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash exfiltration,T1020,Automated Exfiltration,1,IcedID Botnet HTTP PUT,9c780d3d-3a14-4278-8ee5-faaeb2ccfbe0,powershell exfiltration,T1030,Data Transfer Size Limits,1,Data Transfer Size Limits,ab936c51-10f4-46ce-9144-e02137b2016a,sh exfiltration,T1048,Exfiltration Over Alternative Protocol,1,Exfiltration Over Alternative Protocol - SSH,f6786cc8-beda-4915-a4d6-ac2f193bb988,sh diff --git a/atomics/Indexes/Indexes-CSV/linux-index.csv b/atomics/Indexes/Indexes-CSV/linux-index.csv index c3cbab9c..c01f0ea1 100644 --- a/atomics/Indexes/Indexes-CSV/linux-index.csv +++ b/atomics/Indexes/Indexes-CSV/linux-index.csv @@ -142,7 +142,7 @@ collection,T1560.001,Archive via Utility,7,Data Compressed - nix - tar Folder or collection,T1560.001,Archive via Utility,8,Data Encrypted with zip and gpg symmetric,0286eb44-e7ce-41a0-b109-3da516e05a5f,sh collection,T1074.001,Local Data Staging,2,Stage data from Discovery.sh,39ce0303-ae16-4b9e-bb5b-4f53e8262066,bash collection,T1113,Screen Capture,3,X Windows Capture,8206dd0c-faf6-4d74-ba13-7fbe13dce6ac,bash -collection,T1113,Screen Capture,4,Import,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash +collection,T1113,Screen Capture,4,Capture Linux Desktop using Import Tool,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash execution,T1053.001,At (Linux),1,At - Schedule a job,7266d898-ac82-4ec0-97c7-436075d0d08e,sh execution,T1053.003,Cron,1,Cron - Replace crontab with referenced file,435057fb-74b1-410e-9403-d81baf194f75,bash execution,T1053.003,Cron,2,Cron - Add script to cron folder,b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0,bash diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index d1a11c51..c3805661 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -1241,7 +1241,7 @@ - Atomic Test #1: Screencapture [macos] - Atomic Test #2: Screencapture (silent) [macos] - Atomic Test #3: X Windows Capture [linux] - - Atomic Test #4: Import [linux] + - Atomic Test #4: Capture Linux Desktop using Import Tool [linux] - T1213.002 Sharepoint [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1125 Video Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1056.003 Web Portal Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) diff --git a/atomics/Indexes/Indexes-Markdown/linux-index.md b/atomics/Indexes/Indexes-Markdown/linux-index.md index 310e310e..509a0a9e 100644 --- a/atomics/Indexes/Indexes-Markdown/linux-index.md +++ b/atomics/Indexes/Indexes-Markdown/linux-index.md @@ -456,7 +456,7 @@ - T1114.002 Remote Email Collection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - [T1113 Screen Capture](../../T1113/T1113.md) - Atomic Test #3: X Windows Capture [linux] - - Atomic Test #4: Import [linux] + - Atomic Test #4: Capture Linux Desktop using Import Tool [linux] - T1213.002 Sharepoint [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1056.003 Web Portal Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 0c589775..210f22c5 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -51299,9 +51299,10 @@ collection: ' name: bash - - name: Import + - name: Capture Linux Desktop using Import Tool auto_generated_guid: 9cd1cccb-91e4-4550-9139-e20a586fcea1 - description: 'Use import command to collect a full desktop screenshot + description: 'Use import command from ImageMagick to collect a full desktop + screenshot ' supported_platforms: @@ -51311,6 +51312,16 @@ collection: description: Output file path type: Path default: "/tmp/T1113_desktop.png" + dependencies: + - description: 'ImageMagick must be installed + +' + prereq_command: 'if import --version; then exit 0; else exit 1; fi + +' + get_prereq_command: 'sudo apt-get install imagemagick + +' executor: command: 'import -window root #{output_file} diff --git a/atomics/T1113/T1113.md b/atomics/T1113/T1113.md index 62aea3c3..b5ffb66a 100644 --- a/atomics/T1113/T1113.md +++ b/atomics/T1113/T1113.md @@ -11,7 +11,7 @@ - [Atomic Test #3 - X Windows Capture](#atomic-test-3---x-windows-capture) -- [Atomic Test #4 - Import](#atomic-test-4---import) +- [Atomic Test #4 - Capture Linux Desktop using Import Tool](#atomic-test-4---capture-linux-desktop-using-import-tool)
@@ -116,8 +116,8 @@ rm #{output_file}

-## Atomic Test #4 - Import -Use import command to collect a full desktop screenshot +## Atomic Test #4 - Capture Linux Desktop using Import Tool +Use import command from ImageMagick to collect a full desktop screenshot **Supported Platforms:** Linux @@ -144,6 +144,18 @@ rm #{output_file} +#### Dependencies: Run with `bash`! +##### Description: ImageMagick must be installed +##### Check Prereq Commands: +```bash +if import --version; then exit 0; else exit 1; fi +``` +##### Get Prereq Commands: +```bash +sudo apt-get install imagemagick +``` + +