security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adds prereq for lsof/T1087.001, fixes other broken prereq cmds (#1774)

Browse Source 
- several instances of: `yum -y epel-release rsyslog` missing an `install`
- adds dependency for lsof
This commit is contained in:
glallen
2022-02-10 09:39:32 -05:00
committed by GitHub
parent 5f5b2d23d5
commit a83e73fbe4
7 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1040/T1040.yaml
+2 -2
View File
@@ -21,7 +21,7 @@ atomic_tests:
prereq_command: |
if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi;
get_prereq_command: |
(which yum && yum -y epel-release tcpdump tshark)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)
(which yum && yum -y install epel-release tcpdump tshark)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)
executor:
command: |
tcpdump -c 5 -nnni #{interface}
@@ -48,7 +48,7 @@ atomic_tests:
prereq_command: |
if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi;
get_prereq_command: |
(which yum && yum -y epel-release tcpdump tshark)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)
(which yum && yum -y install epel-release tcpdump tshark)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)
executor:
command: |
sudo tcpdump -c 5 -nnni #{interface}
atomics/T1046/T1046.yaml
+1 -1
View File
@@ -46,7 +46,7 @@ atomic_tests:
prereq_command: |
if [ -x "$(command -v nmap)" ]; then exit 0; else exit 1; fi;
get_prereq_command: |
(which yum && yum -y epel-release nmap)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y nmap)
(which yum && yum -y install epel-release nmap)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y nmap)
executor:
command: |
nmap -sS #{network_range} -p #{port}
atomics/T1087.001/T1087.001.yaml
+8
View File
@@ -69,6 +69,14 @@ atomic_tests:
command: |
username=$(id -u -n) && lsof -u $username
name: sh
dependency_executor_name: sh
dependencies:
- description: |
check if lsof exists
prereq_command: |
which lsof
get_prereq_command: |
(which yum && yum -y install lsof)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y lsof)
- name: Show if a user account has ever logged in remotely
auto_generated_guid: 0f0b6a29-08c3-44ad-a30b-47fd996b2110
description: |
atomics/T1135/T1135.yaml
+1 -1
View File
@@ -32,7 +32,7 @@ atomic_tests:
package_installer:
description: Package installer command. Debian - apt install samba
type: String
default: (which yum && yum -y epel-release samba)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y samba)
default: (which yum && yum -y install epel-release samba)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y samba)
dependency_executor_name: bash
dependencies:
- description: |
atomics/T1486/T1486.yaml
+2 -2
View File
@@ -32,7 +32,7 @@ atomic_tests:
prereq_command: |
which_gpg=`which gpg`
get_prereq_command: |
(which yum && yum -y epel-release gpg)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y gpg)
(which yum && yum -y install epel-release gpg)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y gpg)
executor:
name: bash
elevation_required: false
@@ -110,7 +110,7 @@ atomic_tests:
which_ccdecrypt=`which ccdecrypt`
if [[ $USER == "root" ]]; then cp #{root_input_file_path} #{cped_file_path}; else cp #{user_input_file_path} #{cped_file_path}; fi
get_prereq_command: |
(which yum && yum -y epel-release ccrypt)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y ccrypt)
(which yum && yum -y install epel-release ccrypt)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y ccrypt)
executor:
name: bash
elevation_required: false
atomics/T1560.001/T1560.001.yaml
+2 -2
View File
@@ -175,7 +175,7 @@ atomic_tests:
prereq_command: |
if [ $(ls #{input_files} | wc -l) > 0 ] && [ -x $(which zip) ] ; then exit 0; else exit 1; fi;
get_prereq_command: |
(which yum && yum -y epel-release zip)||(which apt-get && apt-get install -y zip)
(which yum && yum -y install epel-release zip)||(which apt-get && apt-get install -y zip)
echo Please set input_files argument to include files that exist
executor:
name: sh
@@ -263,7 +263,7 @@ atomic_tests:
prereq_command: |
if [ ! -x "$(command -v gpg)" ] || [ ! -x "$(command -v zip)" ]; then exit 1; fi;
get_prereq_command: |
(which yum && yum -y epel-release zip gpg)||(which apt-get && apt-get install -y zip gpg)
(which yum && yum -y install epel-release zip gpg)||(which apt-get && apt-get install -y zip gpg)
executor:
name: sh
elevation_required: false
atomics/T1562.001/T1562.001.yaml
+1 -1
View File
@@ -15,7 +15,7 @@ atomic_tests:
package_installer:
description: Package installer command for linux. Default yum
type: String
default: (which yum && yum -y epel-release rsyslog)||(which apt-get && apt-get install -y rsyslog)
default: (which yum && yum -y install epel-release rsyslog)||(which apt-get && apt-get install -y rsyslog)
flavor_command:
description: Command to disable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog stop ; chkconfig off rsyslog
type: String