diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index 80cf0183..4c06d175 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -765,6 +765,7 @@ discovery,T1217,Browser Bookmark Discovery,4,List Google Chrome / Opera Bookmark discovery,T1217,Browser Bookmark Discovery,5,List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt,76f71e2f-480e-4bed-b61e-398fe17499d5,command_prompt discovery,T1217,Browser Bookmark Discovery,6,List Mozilla Firefox bookmarks on Windows with command prompt,4312cdbc-79fc-4a9c-becc-53d49c734bc5,command_prompt discovery,T1217,Browser Bookmark Discovery,7,List Internet Explorer Bookmarks using the command prompt,727dbcdb-e495-4ab1-a6c4-80c7f77aef85,command_prompt +discovery,T1217,Browser Bookmark Discovery,8,List Safari Bookmarks on MacOS,5fc528dd-79de-47f5-8188-25572b7fafe0,sh discovery,T1087.002,Domain Account,1,Enumerate all accounts (Domain),6fbc9e68-5ad7-444a-bd11-8bf3136c477e,command_prompt discovery,T1087.002,Domain Account,2,Enumerate all accounts via PowerShell (Domain),8b8a6449-be98-4f42-afd2-dedddc7453b2,powershell discovery,T1087.002,Domain Account,3,Enumerate logged on users via CMD (Domain),161dcd85-d014-4f5e-900c-d3eaae82a0f7,command_prompt diff --git a/atomics/Indexes/Indexes-CSV/macos-index.csv b/atomics/Indexes/Indexes-CSV/macos-index.csv index cdfef5e3..17088c71 100644 --- a/atomics/Indexes/Indexes-CSV/macos-index.csv +++ b/atomics/Indexes/Indexes-CSV/macos-index.csv @@ -107,6 +107,7 @@ impact,T1529,System Shutdown/Reboot,4,Shutdown System via `shutdown` - macOS/Lin impact,T1529,System Shutdown/Reboot,5,Restart System via `reboot` - macOS/Linux,47d0b042-a918-40ab-8cf9-150ffe919027,bash discovery,T1217,Browser Bookmark Discovery,2,List Mozilla Firefox Bookmark Database Files on macOS,1ca1f9c7-44bc-46bb-8c85-c50e2e94267b,sh discovery,T1217,Browser Bookmark Discovery,3,List Google Chrome Bookmark JSON Files on macOS,b789d341-154b-4a42-a071-9111588be9bc,sh +discovery,T1217,Browser Bookmark Discovery,8,List Safari Bookmarks on MacOS,5fc528dd-79de-47f5-8188-25572b7fafe0,sh discovery,T1083,File and Directory Discovery,3,Nix File and Directory Discovery,ffc8b249-372a-4b74-adcd-e4c0430842de,sh discovery,T1083,File and Directory Discovery,4,Nix File and Directory Discovery 2,13c5e1ae-605b-46c4-a79f-db28c77ff24e,sh discovery,T1087.001,Local Account,2,View sudoers access,fed9be70-0186-4bde-9f8a-20945f9370c2,sh diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index 78690dc2..9203737d 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -1259,6 +1259,7 @@ - Atomic Test #5: List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt [windows] - Atomic Test #6: List Mozilla Firefox bookmarks on Windows with command prompt [windows] - Atomic Test #7: List Internet Explorer Bookmarks using the command prompt [windows] + - Atomic Test #8: List Safari Bookmarks on MacOS [macos] - T1087.004 Cloud Account [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1069.003 Cloud Groups [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1580 Cloud Infrastructure Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) diff --git a/atomics/Indexes/Indexes-Markdown/macos-index.md b/atomics/Indexes/Indexes-Markdown/macos-index.md index 5a45baaa..dae827e6 100644 --- a/atomics/Indexes/Indexes-Markdown/macos-index.md +++ b/atomics/Indexes/Indexes-Markdown/macos-index.md @@ -294,6 +294,7 @@ - [T1217 Browser Bookmark Discovery](../../T1217/T1217.md) - Atomic Test #2: List Mozilla Firefox Bookmark Database Files on macOS [macos] - Atomic Test #3: List Google Chrome Bookmark JSON Files on macOS [macos] + - Atomic Test #8: List Safari Bookmarks on MacOS [macos] - T1087.002 Domain Account [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1069.002 Domain Groups [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1083 File and Directory Discovery](../../T1083/T1083.md) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index fcf72dfa..d0d7b8ba 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -54232,6 +54232,26 @@ discovery: ' name: command_prompt + - name: List Safari Bookmarks on MacOS + auto_generated_guid: 5fc528dd-79de-47f5-8188-25572b7fafe0 + description: 'This test searches for Safari''s Bookmarks file (on macOS) and + lists any found instances to a text file. + +' + supported_platforms: + - macos + input_arguments: + output_file: + description: Path where captured results will be placed. + type: Path + default: "/tmp/T1217-Safari.txt" + executor: + command: "find / -path \"*/Safari/Bookmarks.plist\" 2>/dev/null >> #{output_file} + \ncat #{output_file} \n" + cleanup_command: 'rm -f #{output_file} 2>/dev/null + +' + name: sh T1087.004: technique: external_references: diff --git a/atomics/T1217/T1217.md b/atomics/T1217/T1217.md index c7797b3b..1ee766a4 100644 --- a/atomics/T1217/T1217.md +++ b/atomics/T1217/T1217.md @@ -22,6 +22,8 @@ Specific storage locations vary based on platform and/or application, but browse - [Atomic Test #7 - List Internet Explorer Bookmarks using the command prompt](#atomic-test-7---list-internet-explorer-bookmarks-using-the-command-prompt) +- [Atomic Test #8 - List Safari Bookmarks on MacOS](#atomic-test-8---list-safari-bookmarks-on-macos) +
@@ -251,4 +253,42 @@ dir /s /b %USERPROFILE%\Favorites +
+
+ +## Atomic Test #8 - List Safari Bookmarks on MacOS +This test searches for Safari's Bookmarks file (on macOS) and lists any found instances to a text file. + +**Supported Platforms:** macOS + + +**auto_generated_guid:** 5fc528dd-79de-47f5-8188-25572b7fafe0 + + + + + +#### Inputs: +| Name | Description | Type | Default Value | +|------|-------------|------|---------------| +| output_file | Path where captured results will be placed. | Path | /tmp/T1217-Safari.txt| + + +#### Attack Commands: Run with `sh`! + + +```sh +find / -path "*/Safari/Bookmarks.plist" 2>/dev/null >> #{output_file} +cat #{output_file} +``` + +#### Cleanup Commands: +```sh +rm -f #{output_file} 2>/dev/null +``` + + + + +